Commit a80afe89 authored by David S. Miller's avatar David S. Miller
Browse files

Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf 



Daniel Borkmann says:

====================
pull-request: bpf 2018-09-02

The following pull-request contains BPF updates for your *net* tree.

The main changes are:

1) Fix one remaining buggy offset override in sockmap's bpf_msg_pull_data()
   when linearizing multiple scatterlist elements, from Tushar.

2) Fix BPF sockmap's misuse of ULP when a collision with another ULP is
   found on map update where it would release existing ULP. syzbot found and
   triggered this couple of times now, fix from John.

3) Add missing xskmap type to bpftool so it will properly show the type
   on map dump, from Prashant.
====================

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents 15a81b41 597222f7

kernel/bpf/sockmap.c

+11 −1
Original line number Diff line number Diff line
@@ -1462,9 +1462,15 @@ static void smap_destroy_psock(struct rcu_head *rcu) 
	schedule_work(&psock->gc_work);

}



static bool psock_is_smap_sk(struct sock *sk)

{

	return inet_csk(sk)->icsk_ulp_ops == &bpf_tcp_ulp_ops;

}



static void smap_release_sock(struct smap_psock *psock, struct sock *sock)

{

	if (refcount_dec_and_test(&psock->refcnt)) {

		if (psock_is_smap_sk(sock))

			tcp_cleanup_ulp(sock);

		write_lock_bh(&sock->sk_callback_lock);

		smap_stop_sock(psock, sock);
@@ -1892,6 +1898,10 @@ static int __sock_map_ctx_update_elem(struct bpf_map *map, 
	 * doesn't update user data.

	 */

	if (psock) {

		if (!psock_is_smap_sk(sock)) {

			err = -EBUSY;

			goto out_progs;

		}

		if (READ_ONCE(psock->bpf_parse) && parse) {

			err = -EBUSY;

			goto out_progs;

net/core/filter.c

+3 −4
Original line number Diff line number Diff line
@@ -2292,7 +2292,7 @@ static const struct bpf_func_proto bpf_msg_cork_bytes_proto = { 
BPF_CALL_4(bpf_msg_pull_data,

	   struct sk_msg_buff *, msg, u32, start, u32, end, u64, flags)

{

	unsigned int len = 0, offset = 0, copy = 0;

	unsigned int len = 0, offset = 0, copy = 0, poffset = 0;

	int bytes = end - start, bytes_sg_total;

	struct scatterlist *sg = msg->sg_data;

	int first_sg, last_sg, i, shift;
@@ -2348,16 +2348,15 @@ BPF_CALL_4(bpf_msg_pull_data, 
	if (unlikely(!page))

		return -ENOMEM;

	p = page_address(page);

	offset = 0;



	i = first_sg;

	do {

		from = sg_virt(&sg[i]);

		len = sg[i].length;

		to = p + offset;

		to = p + poffset;



		memcpy(to, from, len);

		offset += len;

		poffset += len;

		sg[i].length = 0;

		put_page(sg_page(&sg[i]));

tools/bpf/bpftool/map.c

+1 −0
Original line number Diff line number Diff line
@@ -68,6 +68,7 @@ static const char * const map_type_name[] = { 
	[BPF_MAP_TYPE_DEVMAP]		= "devmap",

	[BPF_MAP_TYPE_SOCKMAP]		= "sockmap",

	[BPF_MAP_TYPE_CPUMAP]		= "cpumap",

	[BPF_MAP_TYPE_XSKMAP]           = "xskmap",

	[BPF_MAP_TYPE_SOCKHASH]		= "sockhash",

	[BPF_MAP_TYPE_CGROUP_STORAGE]	= "cgroup_storage",

};

CRA Git | Maintained and supported by SUSTech CRA and CCSE