Skip to content

Commit 6788fac

Browse files
davem330davem330
committed
Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf
Daniel Borkmann says: ==================== pull-request: bpf 2018-10-27 The following pull-request contains BPF updates for your *net* tree. The main changes are: 1) Fix toctou race in BTF header validation, from Martin and Wenwen. 2) Fix devmap interface comparison in notifier call which was neglecting netns, from Taehee. 3) Several fixes in various places, for example, correcting direct packet access and helper function availability, from Daniel. 4) Fix BPF kselftest config fragment to include af_xdp and sockmap, from Naresh. ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
2 parents 345671e + d8fd9e1 commit 6788fac

File tree

12 files changed

+133
-51
lines changed

12 files changed

+133
-51
lines changed

‎Documentation/sysctl/net.txt

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -92,6 +92,14 @@ Values :
9292
0 - disable JIT kallsyms export (default value)
9393
1 - enable JIT kallsyms export for privileged users only
9494

95+
bpf_jit_limit
96+
-------------
97+
98+
This enforces a global limit for memory allocations to the BPF JIT
99+
compiler in order to reject unprivileged JIT requests once it has
100+
been surpassed. bpf_jit_limit contains the value of the global limit
101+
in bytes.
102+
95103
dev_weight
96104
--------------
97105

‎include/linux/filter.h

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -854,6 +854,7 @@ bpf_run_sk_reuseport(struct sock_reuseport *reuse, struct sock *sk,
854854
extern int bpf_jit_enable;
855855
extern int bpf_jit_harden;
856856
extern int bpf_jit_kallsyms;
857+
extern int bpf_jit_limit;
857858

858859
typedef void (*bpf_jit_fill_hole_t)(void *area, unsigned int size);
859860

‎kernel/bpf/btf.c

Lines changed: 25 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -2067,56 +2067,47 @@ static int btf_check_sec_info(struct btf_verifier_env *env,
20672067
return 0;
20682068
}
20692069

2070-
static int btf_parse_hdr(struct btf_verifier_env *env, void __user *btf_data,
2071-
u32 btf_data_size)
2070+
static int btf_parse_hdr(struct btf_verifier_env *env)
20722071
{
2072+
u32 hdr_len, hdr_copy, btf_data_size;
20732073
const struct btf_header *hdr;
2074-
u32 hdr_len, hdr_copy;
2075-
/*
2076-
* Minimal part of the "struct btf_header" that
2077-
* contains the hdr_len.
2078-
*/
2079-
struct btf_min_header {
2080-
u16 magic;
2081-
u8 version;
2082-
u8 flags;
2083-
u32 hdr_len;
2084-
} __user *min_hdr;
20852074
struct btf *btf;
20862075
int err;
20872076

20882077
btf = env->btf;
2089-
min_hdr = btf_data;
2078+
btf_data_size = btf->data_size;
20902079

2091-
if (btf_data_size < sizeof(*min_hdr)) {
2080+
if (btf_data_size <
2081+
offsetof(struct btf_header, hdr_len) + sizeof(hdr->hdr_len)) {
20922082
btf_verifier_log(env, "hdr_len not found");
20932083
return -EINVAL;
20942084
}
20952085

2096-
if (get_user(hdr_len, &min_hdr->hdr_len))
2097-
return -EFAULT;
2098-
2086+
hdr = btf->data;
2087+
hdr_len = hdr->hdr_len;
20992088
if (btf_data_size < hdr_len) {
21002089
btf_verifier_log(env, "btf_header not found");
21012090
return -EINVAL;
21022091
}
21032092

2104-
err = bpf_check_uarg_tail_zero(btf_data, sizeof(btf->hdr), hdr_len);
2105-
if (err) {
2106-
if (err == -E2BIG)
2107-
btf_verifier_log(env, "Unsupported btf_header");
2108-
return err;
2093+
/* Ensure the unsupported header fields are zero */
2094+
if (hdr_len > sizeof(btf->hdr)) {
2095+
u8 *expected_zero = btf->data + sizeof(btf->hdr);
2096+
u8 *end = btf->data + hdr_len;
2097+
2098+
for (; expected_zero < end; expected_zero++) {
2099+
if (*expected_zero) {
2100+
btf_verifier_log(env, "Unsupported btf_header");
2101+
return -E2BIG;
2102+
}
2103+
}
21092104
}
21102105

21112106
hdr_copy = min_t(u32, hdr_len, sizeof(btf->hdr));
2112-
if (copy_from_user(&btf->hdr, btf_data, hdr_copy))
2113-
return -EFAULT;
2107+
memcpy(&btf->hdr, btf->data, hdr_copy);
21142108

21152109
hdr = &btf->hdr;
21162110

2117-
if (hdr->hdr_len != hdr_len)
2118-
return -EINVAL;
2119-
21202111
btf_verifier_log_hdr(env, btf_data_size);
21212112

21222113
if (hdr->magic != BTF_MAGIC) {
@@ -2186,10 +2177,6 @@ static struct btf *btf_parse(void __user *btf_data, u32 btf_data_size,
21862177
}
21872178
env->btf = btf;
21882179

2189-
err = btf_parse_hdr(env, btf_data, btf_data_size);
2190-
if (err)
2191-
goto errout;
2192-
21932180
data = kvmalloc(btf_data_size, GFP_KERNEL | __GFP_NOWARN);
21942181
if (!data) {
21952182
err = -ENOMEM;
@@ -2198,13 +2185,18 @@ static struct btf *btf_parse(void __user *btf_data, u32 btf_data_size,
21982185

21992186
btf->data = data;
22002187
btf->data_size = btf_data_size;
2201-
btf->nohdr_data = btf->data + btf->hdr.hdr_len;
22022188

22032189
if (copy_from_user(data, btf_data, btf_data_size)) {
22042190
err = -EFAULT;
22052191
goto errout;
22062192
}
22072193

2194+
err = btf_parse_hdr(env);
2195+
if (err)
2196+
goto errout;
2197+
2198+
btf->nohdr_data = btf->data + btf->hdr.hdr_len;
2199+
22082200
err = btf_parse_str_sec(env);
22092201
if (err)
22102202
goto errout;

‎kernel/bpf/core.c

Lines changed: 46 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -365,10 +365,13 @@ void bpf_prog_kallsyms_del_all(struct bpf_prog *fp)
365365
}
366366

367367
#ifdef CONFIG_BPF_JIT
368+
# define BPF_JIT_LIMIT_DEFAULT (PAGE_SIZE * 40000)
369+
368370
/* All BPF JIT sysctl knobs here. */
369371
int bpf_jit_enable __read_mostly = IS_BUILTIN(CONFIG_BPF_JIT_ALWAYS_ON);
370372
int bpf_jit_harden __read_mostly;
371373
int bpf_jit_kallsyms __read_mostly;
374+
int bpf_jit_limit __read_mostly = BPF_JIT_LIMIT_DEFAULT;
372375

373376
static __always_inline void
374377
bpf_get_prog_addr_region(const struct bpf_prog *prog,
@@ -577,27 +580,64 @@ int bpf_get_kallsym(unsigned int symnum, unsigned long *value, char *type,
577580
return ret;
578581
}
579582

583+
static atomic_long_t bpf_jit_current;
584+
585+
#if defined(MODULES_VADDR)
586+
static int __init bpf_jit_charge_init(void)
587+
{
588+
/* Only used as heuristic here to derive limit. */
589+
bpf_jit_limit = min_t(u64, round_up((MODULES_END - MODULES_VADDR) >> 2,
590+
PAGE_SIZE), INT_MAX);
591+
return 0;
592+
}
593+
pure_initcall(bpf_jit_charge_init);
594+
#endif
595+
596+
static int bpf_jit_charge_modmem(u32 pages)
597+
{
598+
if (atomic_long_add_return(pages, &bpf_jit_current) >
599+
(bpf_jit_limit >> PAGE_SHIFT)) {
600+
if (!capable(CAP_SYS_ADMIN)) {
601+
atomic_long_sub(pages, &bpf_jit_current);
602+
return -EPERM;
603+
}
604+
}
605+
606+
return 0;
607+
}
608+
609+
static void bpf_jit_uncharge_modmem(u32 pages)
610+
{
611+
atomic_long_sub(pages, &bpf_jit_current);
612+
}
613+
580614
struct bpf_binary_header *
581615
bpf_jit_binary_alloc(unsigned int proglen, u8 **image_ptr,
582616
unsigned int alignment,
583617
bpf_jit_fill_hole_t bpf_fill_ill_insns)
584618
{
585619
struct bpf_binary_header *hdr;
586-
unsigned int size, hole, start;
620+
u32 size, hole, start, pages;
587621

588622
/* Most of BPF filters are really small, but if some of them
589623
* fill a page, allow at least 128 extra bytes to insert a
590624
* random section of illegal instructions.
591625
*/
592626
size = round_up(proglen + sizeof(*hdr) + 128, PAGE_SIZE);
627+
pages = size / PAGE_SIZE;
628+
629+
if (bpf_jit_charge_modmem(pages))
630+
return NULL;
593631
hdr = module_alloc(size);
594-
if (hdr == NULL)
632+
if (!hdr) {
633+
bpf_jit_uncharge_modmem(pages);
595634
return NULL;
635+
}
596636

597637
/* Fill space with illegal/arch-dep instructions. */
598638
bpf_fill_ill_insns(hdr, size);
599639

600-
hdr->pages = size / PAGE_SIZE;
640+
hdr->pages = pages;
601641
hole = min_t(unsigned int, size - (proglen + sizeof(*hdr)),
602642
PAGE_SIZE - sizeof(*hdr));
603643
start = (get_random_int() % hole) & ~(alignment - 1);
@@ -610,7 +650,10 @@ bpf_jit_binary_alloc(unsigned int proglen, u8 **image_ptr,
610650

611651
void bpf_jit_binary_free(struct bpf_binary_header *hdr)
612652
{
653+
u32 pages = hdr->pages;
654+
613655
module_memfree(hdr);
656+
bpf_jit_uncharge_modmem(pages);
614657
}
615658

616659
/* This symbol is only overridden by archs that have different

‎kernel/bpf/devmap.c

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -512,8 +512,7 @@ static int dev_map_notification(struct notifier_block *notifier,
512512
struct bpf_dtab_netdev *dev, *odev;
513513

514514
dev = READ_ONCE(dtab->netdev_map[i]);
515-
if (!dev ||
516-
dev->dev->ifindex != netdev->ifindex)
515+
if (!dev || netdev != dev->dev)
517516
continue;
518517
odev = cmpxchg(&dtab->netdev_map[i], dev, NULL);
519518
if (dev == odev)

‎kernel/bpf/helpers.c

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -99,7 +99,6 @@ BPF_CALL_2(bpf_map_pop_elem, struct bpf_map *, map, void *, value)
9999
const struct bpf_func_proto bpf_map_pop_elem_proto = {
100100
.func = bpf_map_pop_elem,
101101
.gpl_only = false,
102-
.pkt_access = true,
103102
.ret_type = RET_INTEGER,
104103
.arg1_type = ARG_CONST_MAP_PTR,
105104
.arg2_type = ARG_PTR_TO_UNINIT_MAP_VALUE,
@@ -113,7 +112,6 @@ BPF_CALL_2(bpf_map_peek_elem, struct bpf_map *, map, void *, value)
113112
const struct bpf_func_proto bpf_map_peek_elem_proto = {
114113
.func = bpf_map_pop_elem,
115114
.gpl_only = false,
116-
.pkt_access = true,
117115
.ret_type = RET_INTEGER,
118116
.arg1_type = ARG_CONST_MAP_PTR,
119117
.arg2_type = ARG_PTR_TO_UNINIT_MAP_VALUE,

‎kernel/bpf/queue_stack_maps.c

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -122,6 +122,7 @@ static int __queue_map_get(struct bpf_map *map, void *value, bool delete)
122122
raw_spin_lock_irqsave(&qs->lock, flags);
123123

124124
if (queue_stack_map_is_empty(qs)) {
125+
memset(value, 0, qs->map.value_size);
125126
err = -ENOENT;
126127
goto out;
127128
}
@@ -151,6 +152,7 @@ static int __stack_map_get(struct bpf_map *map, void *value, bool delete)
151152
raw_spin_lock_irqsave(&qs->lock, flags);
152153

153154
if (queue_stack_map_is_empty(qs)) {
155+
memset(value, 0, qs->map.value_size);
154156
err = -ENOENT;
155157
goto out;
156158
}

‎kernel/bpf/verifier.c

Lines changed: 10 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1387,21 +1387,24 @@ static bool may_access_direct_pkt_data(struct bpf_verifier_env *env,
13871387
enum bpf_access_type t)
13881388
{
13891389
switch (env->prog->type) {
1390+
/* Program types only with direct read access go here! */
13901391
case BPF_PROG_TYPE_LWT_IN:
13911392
case BPF_PROG_TYPE_LWT_OUT:
13921393
case BPF_PROG_TYPE_LWT_SEG6LOCAL:
13931394
case BPF_PROG_TYPE_SK_REUSEPORT:
1394-
/* dst_input() and dst_output() can't write for now */
1395+
case BPF_PROG_TYPE_FLOW_DISSECTOR:
1396+
case BPF_PROG_TYPE_CGROUP_SKB:
13951397
if (t == BPF_WRITE)
13961398
return false;
13971399
/* fallthrough */
1400+
1401+
/* Program types with direct read + write access go here! */
13981402
case BPF_PROG_TYPE_SCHED_CLS:
13991403
case BPF_PROG_TYPE_SCHED_ACT:
14001404
case BPF_PROG_TYPE_XDP:
14011405
case BPF_PROG_TYPE_LWT_XMIT:
14021406
case BPF_PROG_TYPE_SK_SKB:
14031407
case BPF_PROG_TYPE_SK_MSG:
1404-
case BPF_PROG_TYPE_FLOW_DISSECTOR:
14051408
if (meta)
14061409
return meta->pkt_access;
14071410

@@ -5706,7 +5709,11 @@ static int convert_ctx_accesses(struct bpf_verifier_env *env)
57065709
bool is_narrower_load;
57075710
u32 target_size;
57085711

5709-
if (ops->gen_prologue) {
5712+
if (ops->gen_prologue || env->seen_direct_write) {
5713+
if (!ops->gen_prologue) {
5714+
verbose(env, "bpf verifier is misconfigured\n");
5715+
return -EINVAL;
5716+
}
57105717
cnt = ops->gen_prologue(insn_buf, env->seen_direct_write,
57115718
env->prog);
57125719
if (cnt >= ARRAY_SIZE(insn_buf)) {

‎net/core/filter.c

Lines changed: 17 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -5264,8 +5264,6 @@ sk_msg_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
52645264
return &bpf_msg_pull_data_proto;
52655265
case BPF_FUNC_msg_push_data:
52665266
return &bpf_msg_push_data_proto;
5267-
case BPF_FUNC_get_local_storage:
5268-
return &bpf_get_local_storage_proto;
52695267
default:
52705268
return bpf_base_func_proto(func_id);
52715269
}
@@ -5296,8 +5294,6 @@ sk_skb_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
52965294
return &bpf_sk_redirect_map_proto;
52975295
case BPF_FUNC_sk_redirect_hash:
52985296
return &bpf_sk_redirect_hash_proto;
5299-
case BPF_FUNC_get_local_storage:
5300-
return &bpf_get_local_storage_proto;
53015297
#ifdef CONFIG_INET
53025298
case BPF_FUNC_sk_lookup_tcp:
53035299
return &bpf_sk_lookup_tcp_proto;
@@ -5496,7 +5492,13 @@ static bool cg_skb_is_valid_access(int off, int size,
54965492
case bpf_ctx_range(struct __sk_buff, data_meta):
54975493
case bpf_ctx_range(struct __sk_buff, flow_keys):
54985494
return false;
5495+
case bpf_ctx_range(struct __sk_buff, data):
5496+
case bpf_ctx_range(struct __sk_buff, data_end):
5497+
if (!capable(CAP_SYS_ADMIN))
5498+
return false;
5499+
break;
54995500
}
5501+
55005502
if (type == BPF_WRITE) {
55015503
switch (off) {
55025504
case bpf_ctx_range(struct __sk_buff, mark):
@@ -5638,6 +5640,15 @@ static bool sock_filter_is_valid_access(int off, int size,
56385640
prog->expected_attach_type);
56395641
}
56405642

5643+
static int bpf_noop_prologue(struct bpf_insn *insn_buf, bool direct_write,
5644+
const struct bpf_prog *prog)
5645+
{
5646+
/* Neither direct read nor direct write requires any preliminary
5647+
* action.
5648+
*/
5649+
return 0;
5650+
}
5651+
56415652
static int bpf_unclone_prologue(struct bpf_insn *insn_buf, bool direct_write,
56425653
const struct bpf_prog *prog, int drop_verdict)
56435654
{
@@ -7204,6 +7215,7 @@ const struct bpf_verifier_ops xdp_verifier_ops = {
72047215
.get_func_proto = xdp_func_proto,
72057216
.is_valid_access = xdp_is_valid_access,
72067217
.convert_ctx_access = xdp_convert_ctx_access,
7218+
.gen_prologue = bpf_noop_prologue,
72077219
};
72087220

72097221
const struct bpf_prog_ops xdp_prog_ops = {
@@ -7302,6 +7314,7 @@ const struct bpf_verifier_ops sk_msg_verifier_ops = {
73027314
.get_func_proto = sk_msg_func_proto,
73037315
.is_valid_access = sk_msg_is_valid_access,
73047316
.convert_ctx_access = sk_msg_convert_ctx_access,
7317+
.gen_prologue = bpf_noop_prologue,
73057318
};
73067319

73077320
const struct bpf_prog_ops sk_msg_prog_ops = {

‎net/core/sysctl_net_core.c

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -279,7 +279,6 @@ static int proc_dointvec_minmax_bpf_enable(struct ctl_table *table, int write,
279279
return ret;
280280
}
281281

282-
# ifdef CONFIG_HAVE_EBPF_JIT
283282
static int
284283
proc_dointvec_minmax_bpf_restricted(struct ctl_table *table, int write,
285284
void __user *buffer, size_t *lenp,
@@ -290,7 +289,6 @@ proc_dointvec_minmax_bpf_restricted(struct ctl_table *table, int write,
290289

291290
return proc_dointvec_minmax(table, write, buffer, lenp, ppos);
292291
}
293-
# endif
294292
#endif
295293

296294
static struct ctl_table net_core_table[] = {
@@ -397,6 +395,14 @@ static struct ctl_table net_core_table[] = {
397395
.extra2 = &one,
398396
},
399397
# endif
398+
{
399+
.procname = "bpf_jit_limit",
400+
.data = &bpf_jit_limit,
401+
.maxlen = sizeof(int),
402+
.mode = 0600,
403+
.proc_handler = proc_dointvec_minmax_bpf_restricted,
404+
.extra1 = &one,
405+
},
400406
#endif
401407
{
402408
.procname = "netdev_tstamp_prequeue",

0 commit comments

Comments
 (0)