Commit fe736565 authored by Song Liu's avatar Song Liu Committed by Daniel Borkmann
Browse files

bpf: Introduce bpf_arch_text_invalidate for bpf_prog_pack 



Introduce bpf_arch_text_invalidate and use it to fill unused part of the
bpf_prog_pack with illegal instructions when a BPF program is freed.

Fixes: 57631054 ("bpf: Introduce bpf_prog_pack allocator")
Fixes: 33c98058 ("bpf: Introduce bpf_jit_binary_pack_[alloc|finalize|free]")
Reported-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: default avatarSong Liu <song@kernel.org>
Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/bpf/20220520235758.1858153-4-song@kernel.org
parent aadd1b67

arch/x86/net/bpf_jit_comp.c

+5 −0
Original line number Diff line number Diff line
@@ -228,6 +228,11 @@ static void jit_fill_hole(void *area, unsigned int size) 
	memset(area, 0xcc, size);

}



int bpf_arch_text_invalidate(void *dst, size_t len)

{

	return IS_ERR_OR_NULL(text_poke_set(dst, 0xcc, len));

}



struct jit_context {

	int cleanup_addr; /* Epilogue code offset */

include/linux/bpf.h

+1 −0
Original line number Diff line number Diff line
@@ -2365,6 +2365,7 @@ int bpf_arch_text_poke(void *ip, enum bpf_text_poke_type t, 
		       void *addr1, void *addr2);



void *bpf_arch_text_copy(void *dst, void *src, size_t len);

int bpf_arch_text_invalidate(void *dst, size_t len);



struct btf_id_set;

bool btf_id_set_contains(const struct btf_id_set *set, u32 id);

kernel/bpf/core.c

+8 −0
Original line number Diff line number Diff line
@@ -968,6 +968,9 @@ static void bpf_prog_pack_free(struct bpf_binary_header *hdr) 
	nbits = BPF_PROG_SIZE_TO_NBITS(hdr->size);

	pos = ((unsigned long)hdr - (unsigned long)pack_ptr) >> BPF_PROG_CHUNK_SHIFT;



	WARN_ONCE(bpf_arch_text_invalidate(hdr, hdr->size),

		  "bpf_prog_pack bug: missing bpf_arch_text_invalidate?\n");



	bitmap_clear(pack->bitmap, pos, nbits);

	if (bitmap_find_next_zero_area(pack->bitmap, bpf_prog_chunk_count(), 0,

				       bpf_prog_chunk_count(), 0) == 0) {
@@ -2740,6 +2743,11 @@ void * __weak bpf_arch_text_copy(void *dst, void *src, size_t len) 
	return ERR_PTR(-ENOTSUPP);

}



int __weak bpf_arch_text_invalidate(void *dst, size_t len)

{

	return -ENOTSUPP;

}



DEFINE_STATIC_KEY_FALSE(bpf_stats_enabled_key);

EXPORT_SYMBOL(bpf_stats_enabled_key);