Commit 211c4624 authored by David S. Miller's avatar David S. Miller
Browse files

Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf 



Daniel Borkmann says:

====================
pull-request: bpf 2019-08-24

The following pull-request contains BPF updates for your *net* tree.

The main changes are:

1) Fix verifier precision tracking with BPF-to-BPF calls, from Alexei.

2) Fix a use-after-free in prog symbol exposure, from Daniel.

3) Several s390x JIT fixes plus BE related fixes in BPF kselftests, from Ilya.

4) Fix memory leak by unpinning XDP umem pages in error path, from Ivan.

5) Fix a potential use-after-free on flow dissector detach, from Jakub.

6) Fix bpftool to close prog fd after showing metadata, from Quentin.

7) BPF kselftest config and TEST_PROGS_EXTENDED fixes, from Anders.
====================

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents 345b9326 2c238177

arch/s390/net/bpf_jit_comp.c

+7 −5
Original line number Diff line number Diff line
@@ -863,7 +863,7 @@ static noinline int bpf_jit_insn(struct bpf_jit *jit, struct bpf_prog *fp, int i 
		break;

	case BPF_ALU64 | BPF_NEG: /* dst = -dst */

		/* lcgr %dst,%dst */

		EMIT4(0xb9130000, dst_reg, dst_reg);

		EMIT4(0xb9030000, dst_reg, dst_reg);

		break;

	/*

	 * BPF_FROM_BE/LE
@@ -1049,8 +1049,8 @@ static noinline int bpf_jit_insn(struct bpf_jit *jit, struct bpf_prog *fp, int i 
		/* llgf %w1,map.max_entries(%b2) */

		EMIT6_DISP_LH(0xe3000000, 0x0016, REG_W1, REG_0, BPF_REG_2,

			      offsetof(struct bpf_array, map.max_entries));

		/* clgrj %b3,%w1,0xa,label0: if %b3 >= %w1 goto out */

		EMIT6_PCREL_LABEL(0xec000000, 0x0065, BPF_REG_3,

		/* clrj %b3,%w1,0xa,label0: if (u32)%b3 >= (u32)%w1 goto out */

		EMIT6_PCREL_LABEL(0xec000000, 0x0077, BPF_REG_3,

				  REG_W1, 0, 0xa);



		/*
@@ -1076,8 +1076,10 @@ static noinline int bpf_jit_insn(struct bpf_jit *jit, struct bpf_prog *fp, int i 
		 *         goto out;

		 */



		/* sllg %r1,%b3,3: %r1 = index * 8 */

		EMIT6_DISP_LH(0xeb000000, 0x000d, REG_1, BPF_REG_3, REG_0, 3);

		/* llgfr %r1,%b3: %r1 = (u32) index */

		EMIT4(0xb9160000, REG_1, BPF_REG_3);

		/* sllg %r1,%r1,3: %r1 *= 8 */

		EMIT6_DISP_LH(0xeb000000, 0x000d, REG_1, REG_1, REG_0, 3);

		/* lg %r1,prog(%b2,%r1) */

		EMIT6_DISP_LH(0xe3000000, 0x0004, REG_1, BPF_REG_2,

			      REG_1, offsetof(struct bpf_array, ptrs));

kernel/bpf/syscall.c

+18 −12
Original line number Diff line number Diff line
@@ -1707,20 +1707,26 @@ static int bpf_prog_load(union bpf_attr *attr, union bpf_attr __user *uattr) 
	if (err)

		goto free_used_maps;



	err = bpf_prog_new_fd(prog);

	if (err < 0) {

		/* failed to allocate fd.

		 * bpf_prog_put() is needed because the above

		 * bpf_prog_alloc_id() has published the prog

		 * to the userspace and the userspace may

		 * have refcnt-ed it through BPF_PROG_GET_FD_BY_ID.

	/* Upon success of bpf_prog_alloc_id(), the BPF prog is

	 * effectively publicly exposed. However, retrieving via

	 * bpf_prog_get_fd_by_id() will take another reference,

	 * therefore it cannot be gone underneath us.

	 *

	 * Only for the time /after/ successful bpf_prog_new_fd()

	 * and before returning to userspace, we might just hold

	 * one reference and any parallel close on that fd could

	 * rip everything out. Hence, below notifications must

	 * happen before bpf_prog_new_fd().

	 *

	 * Also, any failure handling from this point onwards must

	 * be using bpf_prog_put() given the program is exposed.

	 */

		bpf_prog_put(prog);

		return err;

	}



	bpf_prog_kallsyms_add(prog);

	perf_event_bpf_event(prog, PERF_BPF_EVENT_PROG_LOAD, 0);



	err = bpf_prog_new_fd(prog);

	if (err < 0)

		bpf_prog_put(prog);

	return err;



free_used_maps:

kernel/bpf/verifier.c

+5 −4
Original line number Diff line number Diff line
@@ -985,9 +985,6 @@ static void __mark_reg_unbounded(struct bpf_reg_state *reg) 
	reg->smax_value = S64_MAX;

	reg->umin_value = 0;

	reg->umax_value = U64_MAX;



	/* constant backtracking is enabled for root only for now */

	reg->precise = capable(CAP_SYS_ADMIN) ? false : true;

}



/* Mark a register as having a completely unknown (scalar) value. */
@@ -1014,7 +1011,11 @@ static void mark_reg_unknown(struct bpf_verifier_env *env, 
			__mark_reg_not_init(regs + regno);

		return;

	}

	__mark_reg_unknown(regs + regno);

	regs += regno;

	__mark_reg_unknown(regs);

	/* constant backtracking is enabled for root without bpf2bpf calls */

	regs->precise = env->subprog_cnt > 1 || !env->allow_ptr_leaks ?

			true : false;

}



static void __mark_reg_not_init(struct bpf_reg_state *reg)

net/core/filter.c

+4 −4
Original line number Diff line number Diff line
@@ -8757,13 +8757,13 @@ sk_reuseport_is_valid_access(int off, int size, 
		return size == size_default;



	/* Fields that allow narrowing */

	case offsetof(struct sk_reuseport_md, eth_protocol):

	case bpf_ctx_range(struct sk_reuseport_md, eth_protocol):

		if (size < FIELD_SIZEOF(struct sk_buff, protocol))

			return false;

		/* fall through */

	case offsetof(struct sk_reuseport_md, ip_protocol):

	case offsetof(struct sk_reuseport_md, bind_inany):

	case offsetof(struct sk_reuseport_md, len):

	case bpf_ctx_range(struct sk_reuseport_md, ip_protocol):

	case bpf_ctx_range(struct sk_reuseport_md, bind_inany):

	case bpf_ctx_range(struct sk_reuseport_md, len):

		bpf_ctx_record_field_size(info, size_default);

		return bpf_ctx_narrow_access_ok(off, size, size_default);

net/core/flow_dissector.c

+1 −1
Original line number Diff line number Diff line
@@ -142,8 +142,8 @@ int skb_flow_dissector_bpf_prog_detach(const union bpf_attr *attr) 
		mutex_unlock(&flow_dissector_mutex);

		return -ENOENT;

	}

	bpf_prog_put(attached);

	RCU_INIT_POINTER(net->flow_dissector_prog, NULL);

	bpf_prog_put(attached);

	mutex_unlock(&flow_dissector_mutex);

	return 0;

}

CRA Git | Maintained and supported by SUSTech CRA and CCSE