Commit 76b5e303 authored by Alexei Starovoitov's avatar Alexei Starovoitov
Browse files

Merge branch 'misc-improvements' 



Daniel Borkmann says:

====================
Last batch of misc patches I had in queue: first one removes some left-over
bits from ULP, second is a fix in the verifier where we wrongly use register
number as type to fetch the string for the dump, third disables xadd on flow
keys and subsequent one removes the flow key type from check_helper_mem_access()
as they cannot be passed into any helper as of today. Next one lets map push,
pop, peek avoid having to go through retpoline, and last one has a couple of
minor fixes and cleanups for the ring buffer walk.
====================

Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
parents 2576b967 3dca2115

include/net/tcp.h

+0 −7
Original line number Diff line number Diff line
@@ -2051,11 +2051,6 @@ enum hrtimer_restart tcp_pace_kick(struct hrtimer *timer); 
#define TCP_ULP_MAX		128

#define TCP_ULP_BUF_MAX		(TCP_ULP_NAME_MAX*TCP_ULP_MAX)



enum {

	TCP_ULP_TLS,

	TCP_ULP_BPF,

};



struct tcp_ulp_ops {

	struct list_head	list;
@@ -2064,9 +2059,7 @@ struct tcp_ulp_ops { 
	/* cleanup ulp */

	void (*release)(struct sock *sk);



	int		uid;

	char		name[TCP_ULP_NAME_MAX];

	bool		user_visible;

	struct module	*owner;

};

int tcp_register_ulp(struct tcp_ulp_ops *type);

kernel/bpf/verifier.c

+47 −10
Original line number Diff line number Diff line
@@ -1528,14 +1528,19 @@ static bool __is_pointer_value(bool allow_ptr_leaks, 
	return reg->type != SCALAR_VALUE;

}



static struct bpf_reg_state *reg_state(struct bpf_verifier_env *env, int regno)

{

	return cur_regs(env) + regno;

}



static bool is_pointer_value(struct bpf_verifier_env *env, int regno)

{

	return __is_pointer_value(env->allow_ptr_leaks, cur_regs(env) + regno);

	return __is_pointer_value(env->allow_ptr_leaks, reg_state(env, regno));

}



static bool is_ctx_reg(struct bpf_verifier_env *env, int regno)

{

	const struct bpf_reg_state *reg = cur_regs(env) + regno;

	const struct bpf_reg_state *reg = reg_state(env, regno);



	return reg->type == PTR_TO_CTX ||

	       reg->type == PTR_TO_SOCKET;
@@ -1543,11 +1548,19 @@ static bool is_ctx_reg(struct bpf_verifier_env *env, int regno) 


static bool is_pkt_reg(struct bpf_verifier_env *env, int regno)

{

	const struct bpf_reg_state *reg = cur_regs(env) + regno;

	const struct bpf_reg_state *reg = reg_state(env, regno);



	return type_is_pkt_pointer(reg->type);

}



static bool is_flow_key_reg(struct bpf_verifier_env *env, int regno)

{

	const struct bpf_reg_state *reg = reg_state(env, regno);



	/* Separate to is_ctx_reg() since we still want to allow BPF_ST here. */

	return reg->type == PTR_TO_FLOW_KEYS;

}



static int check_pkt_ptr_alignment(struct bpf_verifier_env *env,

				   const struct bpf_reg_state *reg,

				   int off, int size, bool strict)
@@ -1956,9 +1969,11 @@ static int check_xadd(struct bpf_verifier_env *env, int insn_idx, struct bpf_ins 
	}



	if (is_ctx_reg(env, insn->dst_reg) ||

	    is_pkt_reg(env, insn->dst_reg)) {

	    is_pkt_reg(env, insn->dst_reg) ||

	    is_flow_key_reg(env, insn->dst_reg)) {

		verbose(env, "BPF_XADD stores into R%d %s is not allowed\n",

			insn->dst_reg, reg_type_str[insn->dst_reg]);

			insn->dst_reg,

			reg_type_str[reg_state(env, insn->dst_reg)->type]);

		return -EACCES;

	}
@@ -1983,7 +1998,7 @@ static int check_stack_boundary(struct bpf_verifier_env *env, int regno, 
				int access_size, bool zero_size_allowed,

				struct bpf_call_arg_meta *meta)

{

	struct bpf_reg_state *reg = cur_regs(env) + regno;

	struct bpf_reg_state *reg = reg_state(env, regno);

	struct bpf_func_state *state = func(env, reg);

	int off, i, slot, spi;
@@ -2062,8 +2077,6 @@ static int check_helper_mem_access(struct bpf_verifier_env *env, int regno, 
	case PTR_TO_PACKET_META:

		return check_packet_access(env, regno, reg->off, access_size,

					   zero_size_allowed);

	case PTR_TO_FLOW_KEYS:

		return check_flow_keys_access(env, reg->off, access_size);

	case PTR_TO_MAP_VALUE:

		return check_map_access(env, regno, reg->off, access_size,

					zero_size_allowed);
@@ -5264,7 +5277,8 @@ static int do_check(struct bpf_verifier_env *env) 


			if (is_ctx_reg(env, insn->dst_reg)) {

				verbose(env, "BPF_ST stores into R%d %s is not allowed\n",

					insn->dst_reg, reg_type_str[insn->dst_reg]);

					insn->dst_reg,

					reg_type_str[reg_state(env, insn->dst_reg)->type]);

				return -EACCES;

			}
@@ -6164,7 +6178,10 @@ static int fixup_bpf_calls(struct bpf_verifier_env *env) 
		if (prog->jit_requested && BITS_PER_LONG == 64 &&

		    (insn->imm == BPF_FUNC_map_lookup_elem ||

		     insn->imm == BPF_FUNC_map_update_elem ||

		     insn->imm == BPF_FUNC_map_delete_elem)) {

		     insn->imm == BPF_FUNC_map_delete_elem ||

		     insn->imm == BPF_FUNC_map_push_elem   ||

		     insn->imm == BPF_FUNC_map_pop_elem    ||

		     insn->imm == BPF_FUNC_map_peek_elem)) {

			aux = &env->insn_aux_data[i + delta];

			if (bpf_map_ptr_poisoned(aux))

				goto patch_call_imm;
@@ -6197,6 +6214,14 @@ static int fixup_bpf_calls(struct bpf_verifier_env *env) 
			BUILD_BUG_ON(!__same_type(ops->map_update_elem,

				     (int (*)(struct bpf_map *map, void *key, void *value,

					      u64 flags))NULL));

			BUILD_BUG_ON(!__same_type(ops->map_push_elem,

				     (int (*)(struct bpf_map *map, void *value,

					      u64 flags))NULL));

			BUILD_BUG_ON(!__same_type(ops->map_pop_elem,

				     (int (*)(struct bpf_map *map, void *value))NULL));

			BUILD_BUG_ON(!__same_type(ops->map_peek_elem,

				     (int (*)(struct bpf_map *map, void *value))NULL));



			switch (insn->imm) {

			case BPF_FUNC_map_lookup_elem:

				insn->imm = BPF_CAST_CALL(ops->map_lookup_elem) -
@@ -6210,6 +6235,18 @@ static int fixup_bpf_calls(struct bpf_verifier_env *env) 
				insn->imm = BPF_CAST_CALL(ops->map_delete_elem) -

					    __bpf_call_base;

				continue;

			case BPF_FUNC_map_push_elem:

				insn->imm = BPF_CAST_CALL(ops->map_push_elem) -

					    __bpf_call_base;

				continue;

			case BPF_FUNC_map_pop_elem:

				insn->imm = BPF_CAST_CALL(ops->map_pop_elem) -

					    __bpf_call_base;

				continue;

			case BPF_FUNC_map_peek_elem:

				insn->imm = BPF_CAST_CALL(ops->map_peek_elem) -

					    __bpf_call_base;

				continue;

			}



			goto patch_call_imm;

net/tls/tls_main.c

+0 −2
Original line number Diff line number Diff line
@@ -715,8 +715,6 @@ EXPORT_SYMBOL(tls_unregister_device); 


static struct tcp_ulp_ops tcp_tls_ulp_ops __read_mostly = {

	.name			= "tls",

	.uid			= TCP_ULP_TLS,

	.user_visible		= true,

	.owner			= THIS_MODULE,

	.init			= tls_init,

};

tools/bpf/bpftool/map_perf_ring.c

+6 −4
Original line number Diff line number Diff line
@@ -50,15 +50,17 @@ static void int_exit(int signo) 
	stop = true;

}



static enum bpf_perf_event_ret print_bpf_output(void *event, void *priv)

static enum bpf_perf_event_ret

print_bpf_output(struct perf_event_header *event, void *private_data)

{

	struct event_ring_info *ring = priv;

	struct perf_event_sample *e = event;

	struct perf_event_sample *e = container_of(event, struct perf_event_sample,

						   header);

	struct event_ring_info *ring = private_data;

	struct {

		struct perf_event_header header;

		__u64 id;

		__u64 lost;

	} *lost = event;

	} *lost = (typeof(lost))event;



	if (json_output) {

		jsonw_start_object(json_wtr);

tools/lib/bpf/libbpf.c

+29 −38
Original line number Diff line number Diff line
@@ -2415,56 +2415,47 @@ int bpf_prog_load_xattr(const struct bpf_prog_load_attr *attr, 
}



enum bpf_perf_event_ret

bpf_perf_event_read_simple(void *mem, unsigned long size,

			   unsigned long page_size, void **buf, size_t *buf_len,

			   bpf_perf_event_print_t fn, void *priv)

bpf_perf_event_read_simple(void *mmap_mem, size_t mmap_size, size_t page_size,

			   void **copy_mem, size_t *copy_size,

			   bpf_perf_event_print_t fn, void *private_data)

{

	struct perf_event_mmap_page *header = mem;

	struct perf_event_mmap_page *header = mmap_mem;

	__u64 data_head = ring_buffer_read_head(header);

	__u64 data_tail = header->data_tail;

	int ret = LIBBPF_PERF_EVENT_ERROR;

	void *base, *begin, *end;



	if (data_head == data_tail)

		return LIBBPF_PERF_EVENT_CONT;



	base = ((char *)header) + page_size;



	begin = base + data_tail % size;

	end = base + data_head % size;



	while (begin != end) {

	void *base = ((__u8 *)header) + page_size;

	int ret = LIBBPF_PERF_EVENT_CONT;

	struct perf_event_header *ehdr;



		ehdr = begin;

		if (begin + ehdr->size > base + size) {

			long len = base + size - begin;



			if (*buf_len < ehdr->size) {

				free(*buf);

				*buf = malloc(ehdr->size);

				if (!*buf) {

	size_t ehdr_size;



	while (data_head != data_tail) {

		ehdr = base + (data_tail & (mmap_size - 1));

		ehdr_size = ehdr->size;



		if (((void *)ehdr) + ehdr_size > base + mmap_size) {

			void *copy_start = ehdr;

			size_t len_first = base + mmap_size - copy_start;

			size_t len_secnd = ehdr_size - len_first;



			if (*copy_size < ehdr_size) {

				free(*copy_mem);

				*copy_mem = malloc(ehdr_size);

				if (!*copy_mem) {

					*copy_size = 0;

					ret = LIBBPF_PERF_EVENT_ERROR;

					break;

				}

				*buf_len = ehdr->size;

				*copy_size = ehdr_size;

			}



			memcpy(*buf, begin, len);

			memcpy(*buf + len, base, ehdr->size - len);

			ehdr = (void *)*buf;

			begin = base + ehdr->size - len;

		} else if (begin + ehdr->size == base + size) {

			begin = base;

		} else {

			begin += ehdr->size;

			memcpy(*copy_mem, copy_start, len_first);

			memcpy(*copy_mem + len_first, base, len_secnd);

			ehdr = *copy_mem;

		}



		ret = fn(ehdr, priv);

		ret = fn(ehdr, private_data);

		data_tail += ehdr_size;

		if (ret != LIBBPF_PERF_EVENT_CONT)

			break;



		data_tail += ehdr->size;

	}



	ring_buffer_write_tail(header, data_tail);

CRA Git | Maintained and supported by SUSTech CRA and CCSE