Skip to content

Commit 22bdf7d

Browse files
davem330davem330
committed
Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf
Daniel Borkmann says: ==================== pull-request: bpf 2019-03-29 The following pull-request contains BPF updates for your *net* tree. The main changes are: 1) Bug fix in BTF deduplication that was mishandling an equivalence comparison, from Andrii. 2) libbpf Makefile fixes to properly link against libelf for the shared object and to actually export AF_XDP's xsk.h header, from Björn. 3) Fix use after free in bpf inode eviction, from Daniel. 4) Fix a bug in skb creation out of cpumap redirect, from Jesper. 5) Remove an unnecessary and triggerable WARN_ONCE() in max number of call stack frames checking in verifier, from Paul. ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2 parents 19c8474 + 676e4a6 commit 22bdf7d

File tree

8 files changed

+127
-26
lines changed

8 files changed

+127
-26
lines changed

‎Documentation/bpf/btf.rst

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -148,16 +148,16 @@ The ``btf_type.size * 8`` must be equal to or greater than ``BTF_INT_BITS()``
148148
for the type. The maximum value of ``BTF_INT_BITS()`` is 128.
149149

150150
The ``BTF_INT_OFFSET()`` specifies the starting bit offset to calculate values
151-
for this int. For example, a bitfield struct member has: * btf member bit
152-
offset 100 from the start of the structure, * btf member pointing to an int
153-
type, * the int type has ``BTF_INT_OFFSET() = 2`` and ``BTF_INT_BITS() = 4``
151+
for this int. For example, a bitfield struct member has:
152+
* btf member bit offset 100 from the start of the structure,
153+
* btf member pointing to an int type,
154+
* the int type has ``BTF_INT_OFFSET() = 2`` and ``BTF_INT_BITS() = 4``
154155

155156
Then in the struct memory layout, this member will occupy ``4`` bits starting
156157
from bits ``100 + 2 = 102``.
157158

158159
Alternatively, the bitfield struct member can be the following to access the
159160
same bits as the above:
160-
161161
* btf member bit offset 102,
162162
* btf member pointing to an int type,
163163
* the int type has ``BTF_INT_OFFSET() = 0`` and ``BTF_INT_BITS() = 4``

‎kernel/bpf/cpumap.c

Lines changed: 10 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -162,10 +162,14 @@ static void cpu_map_kthread_stop(struct work_struct *work)
162162
static struct sk_buff *cpu_map_build_skb(struct bpf_cpu_map_entry *rcpu,
163163
struct xdp_frame *xdpf)
164164
{
165+
unsigned int hard_start_headroom;
165166
unsigned int frame_size;
166167
void *pkt_data_start;
167168
struct sk_buff *skb;
168169

170+
/* Part of headroom was reserved to xdpf */
171+
hard_start_headroom = sizeof(struct xdp_frame) + xdpf->headroom;
172+
169173
/* build_skb need to place skb_shared_info after SKB end, and
170174
* also want to know the memory "truesize". Thus, need to
171175
* know the memory frame size backing xdp_buff.
@@ -183,15 +187,15 @@ static struct sk_buff *cpu_map_build_skb(struct bpf_cpu_map_entry *rcpu,
183187
* is not at a fixed memory location, with mixed length
184188
* packets, which is bad for cache-line hotness.
185189
*/
186-
frame_size = SKB_DATA_ALIGN(xdpf->len + xdpf->headroom) +
190+
frame_size = SKB_DATA_ALIGN(xdpf->len + hard_start_headroom) +
187191
SKB_DATA_ALIGN(sizeof(struct skb_shared_info));
188192

189-
pkt_data_start = xdpf->data - xdpf->headroom;
193+
pkt_data_start = xdpf->data - hard_start_headroom;
190194
skb = build_skb(pkt_data_start, frame_size);
191195
if (!skb)
192196
return NULL;
193197

194-
skb_reserve(skb, xdpf->headroom);
198+
skb_reserve(skb, hard_start_headroom);
195199
__skb_put(skb, xdpf->len);
196200
if (xdpf->metasize)
197201
skb_metadata_set(skb, xdpf->metasize);
@@ -205,6 +209,9 @@ static struct sk_buff *cpu_map_build_skb(struct bpf_cpu_map_entry *rcpu,
205209
* - RX ring dev queue index (skb_record_rx_queue)
206210
*/
207211

212+
/* Allow SKB to reuse area used by xdp_frame */
213+
xdp_scrub_frame(xdpf);
214+
208215
return skb;
209216
}
210217

‎kernel/bpf/inode.c

Lines changed: 18 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -554,19 +554,6 @@ struct bpf_prog *bpf_prog_get_type_path(const char *name, enum bpf_prog_type typ
554554
}
555555
EXPORT_SYMBOL(bpf_prog_get_type_path);
556556

557-
static void bpf_evict_inode(struct inode *inode)
558-
{
559-
enum bpf_type type;
560-
561-
truncate_inode_pages_final(&inode->i_data);
562-
clear_inode(inode);
563-
564-
if (S_ISLNK(inode->i_mode))
565-
kfree(inode->i_link);
566-
if (!bpf_inode_type(inode, &type))
567-
bpf_any_put(inode->i_private, type);
568-
}
569-
570557
/*
571558
* Display the mount options in /proc/mounts.
572559
*/
@@ -579,11 +566,28 @@ static int bpf_show_options(struct seq_file *m, struct dentry *root)
579566
return 0;
580567
}
581568

569+
static void bpf_destroy_inode_deferred(struct rcu_head *head)
570+
{
571+
struct inode *inode = container_of(head, struct inode, i_rcu);
572+
enum bpf_type type;
573+
574+
if (S_ISLNK(inode->i_mode))
575+
kfree(inode->i_link);
576+
if (!bpf_inode_type(inode, &type))
577+
bpf_any_put(inode->i_private, type);
578+
free_inode_nonrcu(inode);
579+
}
580+
581+
static void bpf_destroy_inode(struct inode *inode)
582+
{
583+
call_rcu(&inode->i_rcu, bpf_destroy_inode_deferred);
584+
}
585+
582586
static const struct super_operations bpf_super_ops = {
583587
.statfs = simple_statfs,
584588
.drop_inode = generic_delete_inode,
585589
.show_options = bpf_show_options,
586-
.evict_inode = bpf_evict_inode,
590+
.destroy_inode = bpf_destroy_inode,
587591
};
588592

589593
enum {

‎kernel/bpf/verifier.c

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1897,8 +1897,9 @@ static int check_max_stack_depth(struct bpf_verifier_env *env)
18971897
}
18981898
frame++;
18991899
if (frame >= MAX_CALL_FRAMES) {
1900-
WARN_ONCE(1, "verifier bug. Call stack is too deep\n");
1901-
return -EFAULT;
1900+
verbose(env, "the call stack of %d frames is too deep !\n",
1901+
frame);
1902+
return -E2BIG;
19021903
}
19031904
goto process_func;
19041905
}

‎tools/lib/bpf/Makefile

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -177,7 +177,7 @@ $(OUTPUT)libbpf.so: $(OUTPUT)libbpf.so.$(LIBBPF_VERSION)
177177

178178
$(OUTPUT)libbpf.so.$(LIBBPF_VERSION): $(BPF_IN)
179179
$(QUIET_LINK)$(CC) --shared -Wl,-soname,libbpf.so.$(VERSION) \
180-
-Wl,--version-script=$(VERSION_SCRIPT) $^ -o $@
180+
-Wl,--version-script=$(VERSION_SCRIPT) $^ -lelf -o $@
181181
@ln -sf $(@F) $(OUTPUT)libbpf.so
182182
@ln -sf $(@F) $(OUTPUT)libbpf.so.$(VERSION)
183183

@@ -220,8 +220,9 @@ install_lib: all_cmd
220220
install_headers:
221221
$(call QUIET_INSTALL, headers) \
222222
$(call do_install,bpf.h,$(prefix)/include/bpf,644); \
223-
$(call do_install,libbpf.h,$(prefix)/include/bpf,644);
224-
$(call do_install,btf.h,$(prefix)/include/bpf,644);
223+
$(call do_install,libbpf.h,$(prefix)/include/bpf,644); \
224+
$(call do_install,btf.h,$(prefix)/include/bpf,644); \
225+
$(call do_install,xsk.h,$(prefix)/include/bpf,644);
225226

226227
install: install_lib
227228

‎tools/lib/bpf/btf.c

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2107,6 +2107,9 @@ static int btf_dedup_is_equiv(struct btf_dedup *d, __u32 cand_id,
21072107
return fwd_kind == real_kind;
21082108
}
21092109

2110+
if (cand_kind != canon_kind)
2111+
return 0;
2112+
21102113
switch (cand_kind) {
21112114
case BTF_KIND_INT:
21122115
return btf_equal_int(cand_type, canon_type);

‎tools/testing/selftests/bpf/test_btf.c

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5776,6 +5776,53 @@ const struct btf_dedup_test dedup_tests[] = {
57765776
.dedup_table_size = 1, /* force hash collisions */
57775777
},
57785778
},
5779+
{
5780+
.descr = "dedup: void equiv check",
5781+
/*
5782+
* // CU 1:
5783+
* struct s {
5784+
* struct {} *x;
5785+
* };
5786+
* // CU 2:
5787+
* struct s {
5788+
* int *x;
5789+
* };
5790+
*/
5791+
.input = {
5792+
.raw_types = {
5793+
/* CU 1 */
5794+
BTF_STRUCT_ENC(0, 0, 1), /* [1] struct {} */
5795+
BTF_PTR_ENC(1), /* [2] ptr -> [1] */
5796+
BTF_STRUCT_ENC(NAME_NTH(1), 1, 8), /* [3] struct s */
5797+
BTF_MEMBER_ENC(NAME_NTH(2), 2, 0),
5798+
/* CU 2 */
5799+
BTF_PTR_ENC(0), /* [4] ptr -> void */
5800+
BTF_STRUCT_ENC(NAME_NTH(1), 1, 8), /* [5] struct s */
5801+
BTF_MEMBER_ENC(NAME_NTH(2), 4, 0),
5802+
BTF_END_RAW,
5803+
},
5804+
BTF_STR_SEC("\0s\0x"),
5805+
},
5806+
.expect = {
5807+
.raw_types = {
5808+
/* CU 1 */
5809+
BTF_STRUCT_ENC(0, 0, 1), /* [1] struct {} */
5810+
BTF_PTR_ENC(1), /* [2] ptr -> [1] */
5811+
BTF_STRUCT_ENC(NAME_NTH(1), 1, 8), /* [3] struct s */
5812+
BTF_MEMBER_ENC(NAME_NTH(2), 2, 0),
5813+
/* CU 2 */
5814+
BTF_PTR_ENC(0), /* [4] ptr -> void */
5815+
BTF_STRUCT_ENC(NAME_NTH(1), 1, 8), /* [5] struct s */
5816+
BTF_MEMBER_ENC(NAME_NTH(2), 4, 0),
5817+
BTF_END_RAW,
5818+
},
5819+
BTF_STR_SEC("\0s\0x"),
5820+
},
5821+
.opts = {
5822+
.dont_resolve_fwds = false,
5823+
.dedup_table_size = 1, /* force hash collisions */
5824+
},
5825+
},
57795826
{
57805827
.descr = "dedup: all possible kinds (no duplicates)",
57815828
.input = {

‎tools/testing/selftests/bpf/verifier/calls.c

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -907,6 +907,44 @@
907907
.errstr = "call stack",
908908
.result = REJECT,
909909
},
910+
{
911+
"calls: stack depth check in dead code",
912+
.insns = {
913+
/* main */
914+
BPF_MOV64_IMM(BPF_REG_1, 0),
915+
BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call A */
916+
BPF_EXIT_INSN(),
917+
/* A */
918+
BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
919+
BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 2), /* call B */
920+
BPF_MOV64_IMM(BPF_REG_0, 0),
921+
BPF_EXIT_INSN(),
922+
/* B */
923+
BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call C */
924+
BPF_EXIT_INSN(),
925+
/* C */
926+
BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call D */
927+
BPF_EXIT_INSN(),
928+
/* D */
929+
BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call E */
930+
BPF_EXIT_INSN(),
931+
/* E */
932+
BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call F */
933+
BPF_EXIT_INSN(),
934+
/* F */
935+
BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call G */
936+
BPF_EXIT_INSN(),
937+
/* G */
938+
BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call H */
939+
BPF_EXIT_INSN(),
940+
/* H */
941+
BPF_MOV64_IMM(BPF_REG_0, 0),
942+
BPF_EXIT_INSN(),
943+
},
944+
.prog_type = BPF_PROG_TYPE_XDP,
945+
.errstr = "call stack",
946+
.result = REJECT,
947+
},
910948
{
911949
"calls: spill into caller stack frame",
912950
.insns = {

0 commit comments

Comments
 (0)