Commit 02f8ca3d authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'bpf-6.11-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf 

Pull bpf fixes from Alexei Starovoitov:

 - Fix bpftrace regression from Kyle Huey.

   Tracing bpf prog was called with perf_event input arguments causing
   bpftrace produce garbage output.

 - Fix verifier crash in stacksafe() from Yonghong Song.

   Daniel Hodges reported verifier crash when playing with sched-ext.
   The stack depth in the known verifier state was larger than stack
   depth in being explored state causing out-of-bounds access.

 - Fix update of freplace prog in prog_array from Leon Hwang.

   freplace prog type wasn't recognized correctly.

* tag 'bpf-6.11-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf:
  perf/bpf: Don't call bpf_overflow_handler() for tracing events
  selftests/bpf: Add a test to verify previous stacksafe() fix
  bpf: Fix a kernel verifier crash in stacksafe()
  bpf: Fix updating attached freplace prog in prog_array map
parents 6b0f8db9 100bff23

include/linux/bpf_verifier.h

+2 −2
Original line number Diff line number Diff line
@@ -856,8 +856,8 @@ static inline u32 type_flag(u32 type) 
/* only use after check_attach_btf_id() */

static inline enum bpf_prog_type resolve_prog_type(const struct bpf_prog *prog)

{

	return (prog->type == BPF_PROG_TYPE_EXT && prog->aux->dst_prog) ?

		prog->aux->dst_prog->type : prog->type;

	return (prog->type == BPF_PROG_TYPE_EXT && prog->aux->saved_dst_prog_type) ?

		prog->aux->saved_dst_prog_type : prog->type;

}



static inline bool bpf_prog_check_recur(const struct bpf_prog *prog)

kernel/bpf/verifier.c

+3 −2
Original line number Diff line number Diff line
@@ -16884,8 +16884,9 @@ static bool stacksafe(struct bpf_verifier_env *env, struct bpf_func_state *old, 
		spi = i / BPF_REG_SIZE;









		if (exact != NOT_EXACT &&









		    (i >= cur->allocated_stack ||









		     old->stack[spi].slot_type[i % BPF_REG_SIZE] !=









		    cur->stack[spi].slot_type[i % BPF_REG_SIZE])









		     cur->stack[spi].slot_type[i % BPF_REG_SIZE]))









			return false;

















		if (!(old->stack[spi].spilled_ptr.live & REG_LIVE_READ)
































kernel/events/core.c



+2
−1






























Original line number
Diff line number
Diff line







@@ -9706,7 +9706,8 @@ static int __perf_event_overflow(struct perf_event *event,

















	ret = __perf_event_account_interrupt(event, throttle);



















	if (event->prog && !bpf_overflow_handler(event, data, regs))









	if (event->prog && event->prog->type == BPF_PROG_TYPE_PERF_EVENT &&









	    !bpf_overflow_handler(event, data, regs))









		return ret;



















	/*
































tools/testing/selftests/bpf/progs/iters.c



+54
−0






























Original line number
Diff line number
Diff line







@@ -1432,4 +1432,58 @@ int iter_arr_with_actual_elem_count(const void *ctx)







	return sum;









}



















__u32 upper, select_n, result;









__u64 global;



















static __noinline bool nest_2(char *str)









{









	/* some insns (including branch insns) to ensure stacksafe() is triggered









	 * in nest_2(). This way, stacksafe() can compare frame associated with nest_1().









	 */









	if (str[0] == 't')









		return true;









	if (str[1] == 'e')









		return true;









	if (str[2] == 's')









		return true;









	if (str[3] == 't')









		return true;









	return false;









}



















static __noinline bool nest_1(int n)









{









	/* case 0: allocate stack, case 1: no allocate stack */









	switch (n) {









	case 0: {









		char comm[16];



















		if (bpf_get_current_comm(comm, 16))









			return false;









		return nest_2(comm);









	}









	case 1:









		return nest_2((char *)&global);









	default:









		return false;









	}









}



















SEC("raw_tp")









__success









int iter_subprog_check_stacksafe(const void *ctx)









{









	long i;



















	bpf_for(i, 0, upper) {









		if (!nest_1(select_n)) {









			result = 1;









			return 0;









		}









	}



















	result = 2;









	return 0;









}



















char _license[] SEC("license") = "GPL";