Commit f0e77c59 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf 

Pull bpf fixes from Alexei Starovoitov:

 - Fix bpf_throw() and global subprog combination (Kumar Kartikeya
   Dwivedi)

 - Fix out of bounds access in BPF interpreter (Yazhou Tang)

 - Fix potential out of bounds access in inner per-cpu array map
   (Guannan Wang)

 - Reject NULL data/sig in bpf_verify_pkcs7_signature (KP Singh)

* tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf:
  libbpf: fix off-by-one in emit_signature_match jump offset
  bpf: Reject NULL data/sig in bpf_verify_pkcs7_signature
  selftests/bpf: Cover global subprog exception leaks
  bpf: Check global subprog exception paths
  bpf: make bpf_session_is_return() reference optional
  bpf: Use array_map_meta_equal for percpu array inner map replacement
  selftests/bpf: Add test for large offset bpf-to-bpf call
  bpf: Fix s16 truncation for large bpf-to-bpf call offsets
  bpf: Fix out-of-bounds read in bpf_patch_call_args()
parents 4cbfe450 7dd62566

include/linux/bpf.h

+7 −1
Original line number Diff line number Diff line
@@ -2917,7 +2917,13 @@ int bpf_check_uarg_tail_zero(bpfptr_t uaddr, size_t expected_size, 
int bpf_check(struct bpf_prog **fp, union bpf_attr *attr, bpfptr_t uattr, u32 uattr_size);



#ifndef CONFIG_BPF_JIT_ALWAYS_ON

void bpf_patch_call_args(struct bpf_insn *insn, u32 stack_depth);

int bpf_patch_call_args(struct bpf_insn *insn, u32 stack_depth);

s32 bpf_call_args_imm(s16 idx);

#else

static inline s32 bpf_call_args_imm(s16 idx)

{

	return 0;

}

#endif



struct btf *bpf_get_btf_vmlinux(void);

include/linux/bpf_verifier.h

+2 −0
Original line number Diff line number Diff line
@@ -729,6 +729,7 @@ struct bpf_subprog_info { 
	 */

	s16 fastcall_stack_off;

	bool has_tail_call: 1;

	bool might_throw: 1;

	bool tail_call_reachable: 1;

	bool has_ld_abs: 1;

	bool is_cb: 1;
@@ -1308,6 +1309,7 @@ void bpf_fmt_stack_mask(char *buf, ssize_t buf_sz, u64 stack_mask); 
bool bpf_subprog_is_global(const struct bpf_verifier_env *env, int subprog);



int bpf_find_subprog(struct bpf_verifier_env *env, int off);

bool bpf_is_throw_kfunc(struct bpf_insn *insn);

int bpf_compute_const_regs(struct bpf_verifier_env *env);

int bpf_prune_dead_branches(struct bpf_verifier_env *env);

int bpf_check_cfg(struct bpf_verifier_env *env);

include/linux/filter.h

+0 −3
Original line number Diff line number Diff line
@@ -1151,9 +1151,6 @@ bool sk_filter_charge(struct sock *sk, struct sk_filter *fp); 
void sk_filter_uncharge(struct sock *sk, struct sk_filter *fp);



u64 __bpf_call_base(u64 r1, u64 r2, u64 r3, u64 r4, u64 r5);

#define __bpf_call_base_args \

	((u64 (*)(u64, u64, u64, u64, u64, const struct bpf_insn *)) \

	 (void *)__bpf_call_base)



struct bpf_prog *bpf_int_jit_compile(struct bpf_verifier_env *env, struct bpf_prog *prog);

void bpf_jit_compile(struct bpf_prog *prog);

kernel/bpf/arraymap.c

+1 −1
Original line number Diff line number Diff line
@@ -827,7 +827,7 @@ const struct bpf_map_ops array_map_ops = { 
};



const struct bpf_map_ops percpu_array_map_ops = {

	.map_meta_equal = bpf_map_meta_equal,

	.map_meta_equal = array_map_meta_equal,

	.map_alloc_check = array_map_alloc_check,

	.map_alloc = array_map_alloc,

	.map_free = array_map_free,

kernel/bpf/cfg.c

+12 −1
Original line number Diff line number Diff line
@@ -64,11 +64,19 @@ static void mark_subprog_might_sleep(struct bpf_verifier_env *env, int off) 
	subprog->might_sleep = true;

}



static void mark_subprog_might_throw(struct bpf_verifier_env *env, int off)

{

	struct bpf_subprog_info *subprog;



	subprog = bpf_find_containing_subprog(env, off);

	subprog->might_throw = true;

}



/* 't' is an index of a call-site.

 * 'w' is a callee entry point.

 * Eventually this function would be called when env->cfg.insn_state[w] == EXPLORED.

 * Rely on DFS traversal order and absence of recursive calls to guarantee that

 * callee's change_pkt_data marks would be correct at that moment.

 * callee's effect marks would be correct at that moment.

 */

static void merge_callee_effects(struct bpf_verifier_env *env, int t, int w)

{
@@ -78,6 +86,7 @@ static void merge_callee_effects(struct bpf_verifier_env *env, int t, int w) 
	callee = bpf_find_containing_subprog(env, w);

	caller->changes_pkt_data |= callee->changes_pkt_data;

	caller->might_sleep |= callee->might_sleep;

	caller->might_throw |= callee->might_throw;

}



enum {
@@ -509,6 +518,8 @@ static int visit_insn(int t, struct bpf_verifier_env *env) 
				mark_subprog_might_sleep(env, t);

			if (ret == 0 && bpf_is_kfunc_pkt_changing(&meta))

				mark_subprog_changes_pkt_data(env, t);

			if (ret == 0 && bpf_is_throw_kfunc(insn))

				mark_subprog_might_throw(env, t);

		}

		return visit_func_call_insn(t, insns, env, insn->src_reg == BPF_PSEUDO_CALL);