mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-24 03:15:59 +00:00
for-netdev
-----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEE+soXsSLHKoYyzcli6rmadz2vbToFAmRHI44ACgkQ6rmadz2v bTonHxAAjERX8x00+KXAzM0gEpxunjpeL9l/4Zc8zMutKuDW5X2cZ9q0enlvWjuf +bEMAsPorVd4VSHKO5450ldp/a3HN9Y6PUkfuc6rQWITDXpt/MSgkmqUB0VtG17J Tq8M2mv3FrHNhGjf+UOQ9dZABbaQYtGiM75jZ3+Aj3hblfa04CxLDfbWxpCS3akP JYEwUbT+8v+HA+sb27wHmOeXABtjBfjiZh4z9fEoyd62c9H71feYOMIZ8TDsyb6N kMZXxWWBHiQUGx2RBVUYjWkpkVaaK0UGHaNPLApdwUfO7wEF3JqBPl+Ejde+YJRq ixEN6gVCwt7JW2joBrP408wj1autEw0OmJ2buCFaK4O46/TvSTbu5IRWAIx6k/zc xVrrXZRApIflfpd/EIRlBGPIYjoF8xbVS5Jvp/dXUXqgOsp+OAdRHBJZN+gLQ050 QjuhepVdAj7IgtDLF84S7nvwgmorhg+81u7ZCgBaYuSjLm+pOCzs1KhjdSokkDIS 44z37YQKr4+5x2AHs681wSBLwyS3OreO8N77Qs3nKV61Vq2R5YxRfvUpppXY49um mD/vimRg4oQStQSFKQ9eX4ZGl5D+lrhpPumBVj0rGDZx+vgSurC+rO/G4CAHlFrZ mLpOXI6Q8X1aB2hTot5ViVKV+wADVvXhry0TP+3++8O1EKxoTj0= =cMwX -----END PGP SIGNATURE----- Merge tag 'for-netdev' of https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next Alexei Starovoitov says: ==================== pull-request: bpf-next 2023-04-24 We've added 5 non-merge commits during the last 3 day(s) which contain a total of 7 files changed, 87 insertions(+), 44 deletions(-). The main changes are: 1) Workaround for bpf iter selftest due to lack of subprog support in precision tracking, from Andrii. 2) Disable bpf_refcount_acquire kfunc until races are fixed, from Dave. 3) One more test_verifier test converted from asm macro to asm in C, from Eduard. 4) Fix build with NETFILTER=y INET=n config, from Florian. 5) Add __rcu_read_{lock,unlock} into deny list, from Yafang. * tag 'for-netdev' of https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next: selftests/bpf: avoid mark_all_scalars_precise() trigger in one of iter tests bpf: Add __rcu_read_{lock,unlock} into btf id deny list bpf: Disable bpf_refcount_acquire kfunc calls until race conditions are fixed selftests/bpf: verifier/prevent_map_lookup converted to inline assembly bpf: fix link failure with NETFILTER=y INET=n ==================== Link: https://lore.kernel.org/r/20230425005648.86714-1-alexei.starovoitov@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
This commit is contained in:
commit
ee3392ed16
7 changed files with 87 additions and 44 deletions
|
@ -79,7 +79,7 @@ BPF_PROG_TYPE(BPF_PROG_TYPE_LSM, lsm,
|
|||
#endif
|
||||
BPF_PROG_TYPE(BPF_PROG_TYPE_SYSCALL, bpf_syscall,
|
||||
void *, void *)
|
||||
#ifdef CONFIG_NETFILTER
|
||||
#ifdef CONFIG_NETFILTER_BPF_LINK
|
||||
BPF_PROG_TYPE(BPF_PROG_TYPE_NETFILTER, netfilter,
|
||||
struct bpf_nf_ctx, struct bpf_nf_ctx)
|
||||
#endif
|
||||
|
|
|
@ -10509,7 +10509,10 @@ static int check_kfunc_args(struct bpf_verifier_env *env, struct bpf_kfunc_call_
|
|||
verbose(env, "arg#%d doesn't point to a type with bpf_refcount field\n", i);
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
if (rec->refcount_off >= 0) {
|
||||
verbose(env, "bpf_refcount_acquire calls are disabled for now\n");
|
||||
return -EINVAL;
|
||||
}
|
||||
meta->arg_refcount_acquire.btf = reg->btf;
|
||||
meta->arg_refcount_acquire.btf_id = reg->btf_id;
|
||||
break;
|
||||
|
@ -18668,6 +18671,10 @@ BTF_ID(func, rcu_read_unlock_strict)
|
|||
BTF_ID(func, preempt_count_add)
|
||||
BTF_ID(func, preempt_count_sub)
|
||||
#endif
|
||||
#ifdef CONFIG_PREEMPT_RCU
|
||||
BTF_ID(func, __rcu_read_lock)
|
||||
BTF_ID(func, __rcu_read_unlock)
|
||||
#endif
|
||||
BTF_SET_END(btf_id_deny)
|
||||
|
||||
static bool can_be_sleepable(struct bpf_prog *prog)
|
||||
|
|
|
@ -9,10 +9,8 @@
|
|||
|
||||
void test_refcounted_kptr(void)
|
||||
{
|
||||
RUN_TESTS(refcounted_kptr);
|
||||
}
|
||||
|
||||
void test_refcounted_kptr_fail(void)
|
||||
{
|
||||
RUN_TESTS(refcounted_kptr_fail);
|
||||
}
|
||||
|
|
|
@ -42,6 +42,7 @@
|
|||
#include "verifier_meta_access.skel.h"
|
||||
#include "verifier_netfilter_ctx.skel.h"
|
||||
#include "verifier_netfilter_retcode.skel.h"
|
||||
#include "verifier_prevent_map_lookup.skel.h"
|
||||
#include "verifier_raw_stack.skel.h"
|
||||
#include "verifier_raw_tp_writable.skel.h"
|
||||
#include "verifier_reg_equal.skel.h"
|
||||
|
@ -140,6 +141,7 @@ void test_verifier_masking(void) { RUN(verifier_masking); }
|
|||
void test_verifier_meta_access(void) { RUN(verifier_meta_access); }
|
||||
void test_verifier_netfilter_ctx(void) { RUN(verifier_netfilter_ctx); }
|
||||
void test_verifier_netfilter_retcode(void) { RUN(verifier_netfilter_retcode); }
|
||||
void test_verifier_prevent_map_lookup(void) { RUN(verifier_prevent_map_lookup); }
|
||||
void test_verifier_raw_stack(void) { RUN(verifier_raw_stack); }
|
||||
void test_verifier_raw_tp_writable(void) { RUN(verifier_raw_tp_writable); }
|
||||
void test_verifier_reg_equal(void) { RUN(verifier_reg_equal); }
|
||||
|
|
|
@ -651,25 +651,29 @@ int iter_stack_array_loop(const void *ctx)
|
|||
return sum;
|
||||
}
|
||||
|
||||
static __noinline void fill(struct bpf_iter_num *it, int *arr, __u32 n, int mul)
|
||||
#define ARR_SZ 16
|
||||
|
||||
static __noinline void fill(struct bpf_iter_num *it, int *arr, int mul)
|
||||
{
|
||||
int *t, i;
|
||||
int *t;
|
||||
__u64 i;
|
||||
|
||||
while ((t = bpf_iter_num_next(it))) {
|
||||
i = *t;
|
||||
if (i >= n)
|
||||
if (i >= ARR_SZ)
|
||||
break;
|
||||
arr[i] = i * mul;
|
||||
}
|
||||
}
|
||||
|
||||
static __noinline int sum(struct bpf_iter_num *it, int *arr, __u32 n)
|
||||
static __noinline int sum(struct bpf_iter_num *it, int *arr)
|
||||
{
|
||||
int *t, i, sum = 0;;
|
||||
int *t, sum = 0;;
|
||||
__u64 i;
|
||||
|
||||
while ((t = bpf_iter_num_next(it))) {
|
||||
i = *t;
|
||||
if (i >= n)
|
||||
if (i >= ARR_SZ)
|
||||
break;
|
||||
sum += arr[i];
|
||||
}
|
||||
|
@ -681,7 +685,7 @@ SEC("raw_tp")
|
|||
__success
|
||||
int iter_pass_iter_ptr_to_subprog(const void *ctx)
|
||||
{
|
||||
int arr1[16], arr2[32];
|
||||
int arr1[ARR_SZ], arr2[ARR_SZ];
|
||||
struct bpf_iter_num it;
|
||||
int n, sum1, sum2;
|
||||
|
||||
|
@ -690,25 +694,25 @@ int iter_pass_iter_ptr_to_subprog(const void *ctx)
|
|||
/* fill arr1 */
|
||||
n = ARRAY_SIZE(arr1);
|
||||
bpf_iter_num_new(&it, 0, n);
|
||||
fill(&it, arr1, n, 2);
|
||||
fill(&it, arr1, 2);
|
||||
bpf_iter_num_destroy(&it);
|
||||
|
||||
/* fill arr2 */
|
||||
n = ARRAY_SIZE(arr2);
|
||||
bpf_iter_num_new(&it, 0, n);
|
||||
fill(&it, arr2, n, 10);
|
||||
fill(&it, arr2, 10);
|
||||
bpf_iter_num_destroy(&it);
|
||||
|
||||
/* sum arr1 */
|
||||
n = ARRAY_SIZE(arr1);
|
||||
bpf_iter_num_new(&it, 0, n);
|
||||
sum1 = sum(&it, arr1, n);
|
||||
sum1 = sum(&it, arr1);
|
||||
bpf_iter_num_destroy(&it);
|
||||
|
||||
/* sum arr2 */
|
||||
n = ARRAY_SIZE(arr2);
|
||||
bpf_iter_num_new(&it, 0, n);
|
||||
sum2 = sum(&it, arr2, n);
|
||||
sum2 = sum(&it, arr2);
|
||||
bpf_iter_num_destroy(&it);
|
||||
|
||||
bpf_printk("sum1=%d, sum2=%d", sum1, sum2);
|
||||
|
|
|
@ -0,0 +1,61 @@
|
|||
// SPDX-License-Identifier: GPL-2.0
|
||||
/* Converted from tools/testing/selftests/bpf/verifier/prevent_map_lookup.c */
|
||||
|
||||
#include <linux/bpf.h>
|
||||
#include <bpf/bpf_helpers.h>
|
||||
#include "bpf_misc.h"
|
||||
|
||||
struct {
|
||||
__uint(type, BPF_MAP_TYPE_STACK_TRACE);
|
||||
__uint(max_entries, 1);
|
||||
__type(key, __u32);
|
||||
__type(value, __u64);
|
||||
} map_stacktrace SEC(".maps");
|
||||
|
||||
struct {
|
||||
__uint(type, BPF_MAP_TYPE_PROG_ARRAY);
|
||||
__uint(max_entries, 8);
|
||||
__uint(key_size, sizeof(int));
|
||||
__array(values, void (void));
|
||||
} map_prog2_socket SEC(".maps");
|
||||
|
||||
SEC("perf_event")
|
||||
__description("prevent map lookup in stack trace")
|
||||
__failure __msg("cannot pass map_type 7 into func bpf_map_lookup_elem")
|
||||
__naked void map_lookup_in_stack_trace(void)
|
||||
{
|
||||
asm volatile (" \
|
||||
r1 = 0; \
|
||||
*(u64*)(r10 - 8) = r1; \
|
||||
r2 = r10; \
|
||||
r2 += -8; \
|
||||
r1 = %[map_stacktrace] ll; \
|
||||
call %[bpf_map_lookup_elem]; \
|
||||
exit; \
|
||||
" :
|
||||
: __imm(bpf_map_lookup_elem),
|
||||
__imm_addr(map_stacktrace)
|
||||
: __clobber_all);
|
||||
}
|
||||
|
||||
SEC("socket")
|
||||
__description("prevent map lookup in prog array")
|
||||
__failure __msg("cannot pass map_type 3 into func bpf_map_lookup_elem")
|
||||
__failure_unpriv
|
||||
__naked void map_lookup_in_prog_array(void)
|
||||
{
|
||||
asm volatile (" \
|
||||
r1 = 0; \
|
||||
*(u64*)(r10 - 8) = r1; \
|
||||
r2 = r10; \
|
||||
r2 += -8; \
|
||||
r1 = %[map_prog2_socket] ll; \
|
||||
call %[bpf_map_lookup_elem]; \
|
||||
exit; \
|
||||
" :
|
||||
: __imm(bpf_map_lookup_elem),
|
||||
__imm_addr(map_prog2_socket)
|
||||
: __clobber_all);
|
||||
}
|
||||
|
||||
char _license[] SEC("license") = "GPL";
|
|
@ -1,29 +0,0 @@
|
|||
{
|
||||
"prevent map lookup in stack trace",
|
||||
.insns = {
|
||||
BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
|
||||
BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
|
||||
BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
|
||||
BPF_LD_MAP_FD(BPF_REG_1, 0),
|
||||
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.fixup_map_stacktrace = { 3 },
|
||||
.result = REJECT,
|
||||
.errstr = "cannot pass map_type 7 into func bpf_map_lookup_elem",
|
||||
.prog_type = BPF_PROG_TYPE_PERF_EVENT,
|
||||
},
|
||||
{
|
||||
"prevent map lookup in prog array",
|
||||
.insns = {
|
||||
BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
|
||||
BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
|
||||
BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
|
||||
BPF_LD_MAP_FD(BPF_REG_1, 0),
|
||||
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
|
||||
BPF_EXIT_INSN(),
|
||||
},
|
||||
.fixup_prog2 = { 3 },
|
||||
.result = REJECT,
|
||||
.errstr = "cannot pass map_type 3 into func bpf_map_lookup_elem",
|
||||
},
|
Loading…
Reference in a new issue