[PATCH OLK-6.6 0/4] mainline patch submission for OLK-6.6
Jiri Olsa (1): bpf: Clear buf on error in __bpf_get_task_stack Junseo Lim (1): bpf: Reject negative optlen in cgroup getsockopt hook Kumar Kartikeya Dwivedi (1): bpf: Zero queue and stack outputs on lock failure Leon Hwang (1): bpf: Fix WARNING in bpf_tracing_link_release include/linux/bpf.h | 3 +++ kernel/bpf/cgroup.c | 2 +- kernel/bpf/queue_stack_maps.c | 8 ++++++-- kernel/bpf/stackmap.c | 7 +++++-- kernel/bpf/trampoline.c | 7 +++++++ kernel/bpf/verifier.c | 2 +- 6 files changed, 23 insertions(+), 6 deletions(-) -- 2.34.1
From: Junseo Lim <zirajs7@gmail.com> mainline inclusion from mainline-v7.3-rc1 commit 1b5aacd5b2419b0790e955e466d389a61c79b4b1 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18560 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?i... -------------------------------- A cgroup getsockopt BPF program can shrink ctx->optlen after the kernel getsockopt handler has run. The kernel-buffer variant, used by TCP_ZEROCOPY_RECEIVE, only rejects values larger than the original length. If BPF writes a negative optlen, that value is accepted and propagated back to the TCP getsockopt code. It can then be passed to copy_to_sockptr() as a size_t and trigger the hardened usercopy bytes > INT_MAX warning. Reject negative ctx.optlen in __cgroup_bpf_run_filter_getsockopt_kern(), matching the lower-bound validation already present in the sockptr-based getsockopt hook. Fixes: 9cacf81f8161 ("bpf: Remove extra lock_sock for TCP_ZEROCOPY_RECEIVE") Reported-by: Sechang Lim <rhkrqnwk98@gmail.com> Signed-off-by: Junseo Lim <zirajs7@gmail.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com> Link: https://lore.kernel.org/bpf/187a4d756275aaaee5d65eecb63c1477b3b66554.1786448... Conflicts: kernel/bpf/cgroup.c [commit f10d059661968b01ef61a8b516775f95a18ab8ae not backport] Signed-off-by: Chen Yuxi <chenyuxi19@huawei.com> --- kernel/bpf/cgroup.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/bpf/cgroup.c b/kernel/bpf/cgroup.c index 1c8513521951..d72413d9b9bc 100644 --- a/kernel/bpf/cgroup.c +++ b/kernel/bpf/cgroup.c @@ -2101,7 +2101,7 @@ int __cgroup_bpf_run_filter_getsockopt_kern(struct sock *sk, int level, if (ret < 0) return ret; - if (ctx.optlen > *optlen) + if (ctx.optlen > *optlen || ctx.optlen < 0) return -EFAULT; /* BPF programs can shrink the buffer, export the modifications. -- 2.34.1
From: Jiri Olsa <jolsa@kernel.org> mainline inclusion from mainline-v7.3-rc1 commit f5d242825ca417bb6afe35fde6e8880f97ca43fb category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18560 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?i... -------------------------------- Both bpf_get_task_stack and bpf_get_task_stack_sleepable helpers that use __bpf_get_task_stack have buf defined as ARG_PTR_TO_UNINIT_MEM argument and we should initialize the buf on every return path. Adding missing buf memset for __bpf_get_task_stack fail paths. This provides deterministic buffer contents, which is useful when the buffer is used directly as a map key. Fixes: 06ab134ce8ec ("bpf: Refcount task stack in bpf_get_task_stack") Fixes: b992f01e6615 ("bpf: Guard against accessing NULL pt_regs in bpf_get_task_stack()") Reported-by: Sashiko <sashiko-bot@kernel.org> Signed-off-by: Jiri Olsa <jolsa@kernel.org> Signed-off-by: Andrii Nakryiko <andrii@kernel.org> Link: https://lore.kernel.org/bpf/20260803210149.296496-10-jolsa@kernel.org Conflicts: kernel/bpf/stackmap.c [commit 58cfc2201d964163fe9c4a703136eb64db799f08 not backport] Signed-off-by: Chen Yuxi <chenyuxi19@huawei.com> --- kernel/bpf/stackmap.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/kernel/bpf/stackmap.c b/kernel/bpf/stackmap.c index 7f8adb1dc152..2a4070d0b594 100644 --- a/kernel/bpf/stackmap.c +++ b/kernel/bpf/stackmap.c @@ -501,14 +501,17 @@ BPF_CALL_4(bpf_get_task_stack, struct task_struct *, task, void *, buf, struct pt_regs *regs; long res = -EINVAL; - if (!try_get_task_stack(task)) + if (!try_get_task_stack(task)) { + memset(buf, 0, size); return -EFAULT; + } regs = task_pt_regs(task); if (regs) res = __bpf_get_stack(regs, task, NULL, buf, size, flags); + else + memset(buf, 0, size); put_task_stack(task); - return res; } -- 2.34.1
From: Kumar Kartikeya Dwivedi <memxor@gmail.com> mainline inclusion from mainline-v7.3-rc1 commit 7ac6e1ae41a09f1dd4baeeff1d028ae49ee01232 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18560 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?i... ------------------------------- Queue and stack pop/peek helpers accept an uninitialized output buffer because the verifier expects the helper to initialize it. The empty-map error path clears the buffer, but a failed lock acquisition returns -EBUSY without writing it. Clear the output before returning -EBUSY so BPF programs cannot observe uninitialized stack contents after a failed helper call. Fixes: a34a9f1a19af ("bpf: Avoid deadlock when using queue and stack maps from NMI") Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com> Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com> Link: https://lore.kernel.org/bpf/20260719125419.1782196-1-memxor@gmail.com Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com> Conflicts: kernel/bpf/queue_stack_maps.c [commit 2f41503d647629cfafea42cf6f827e4139536703 not backport] Signed-off-by: Chen Yuxi <chenyuxi19@huawei.com> --- kernel/bpf/queue_stack_maps.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/kernel/bpf/queue_stack_maps.c b/kernel/bpf/queue_stack_maps.c index d869f51ea93a..36384342d7d8 100644 --- a/kernel/bpf/queue_stack_maps.c +++ b/kernel/bpf/queue_stack_maps.c @@ -99,8 +99,10 @@ static long __queue_map_get(struct bpf_map *map, void *value, bool delete) void *ptr; if (in_nmi()) { - if (!raw_spin_trylock_irqsave(&qs->lock, flags)) + if (!raw_spin_trylock_irqsave(&qs->lock, flags)) { + memset(value, 0, qs->map.value_size); return -EBUSY; + } } else { raw_spin_lock_irqsave(&qs->lock, flags); } @@ -134,8 +136,10 @@ static long __stack_map_get(struct bpf_map *map, void *value, bool delete) u32 index; if (in_nmi()) { - if (!raw_spin_trylock_irqsave(&qs->lock, flags)) + if (!raw_spin_trylock_irqsave(&qs->lock, flags)) { + memset(value, 0, qs->map.value_size); return -EBUSY; + } } else { raw_spin_lock_irqsave(&qs->lock, flags); } -- 2.34.1
From: Leon Hwang <leon.hwang@linux.dev> mainline inclusion from mainline-v7.3-rc1 commit 61aaa8782bec59ecffd22e030f54ef9351bcabf9 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18560 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?i... -------------------------------- The trampoline could be corrupted by the blindly 'tr->flags = BPF_TRAMP_F_TAIL_CALL_CTX' in verifier. 1. A fexit attached to a tail_call_reachable prog. 'tr->flags' became 'BPF_TRAMP_F_CALL_ORIG | BPF_TRAMP_F_TAIL_CALL_CTX'. And, the trampoline would poke the target prog's nop insn using jmp insn instead of call insn. 2. Another fexit loaded with the same tail_call_reachable prog target. 'tr->flags' became 'BPF_TRAMP_F_TAIL_CALL_CTX'. 3. Close the first fexit link. Due to no BPF_TRAMP_F_CALL_ORIG in 'tr->flags', the trampoline will fail to restore the prog's nop insn using call insn. [ 3.410719] WARNING: kernel/bpf/syscall.c:3551 at bpf_tracing_link_release+0x53/0x60, CPU#1: test_progs/98 ... [ 3.428793] bpf_link_free+0x58/0x130 [ 3.429293] bpf_link_release+0x23/0x30 Fix the warning by updating 'tr->flags' with '|=' and lock. Fixes: 2b5dcb31a19a ("bpf, x64: Fix tailcall infinite loop") Signed-off-by: Leon Hwang <leon.hwang@linux.dev> Reviewed-by: Pu Lehui <pulehui@huawei.com> Acked-by: Jiri Olsa <jolsa@kernel.org> Link: https://lore.kernel.org/bpf/20260722151909.69142-2-leon.hwang@linux.dev Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com> Conflicts: include/linux/bpf.h, kernel/bpf/trampoline.c [commit aef4dfa790b22d8052cfb78044eadbe03c876c39 ("bpf: Add bpf_trampoline_multi_attach/detach functions"), 8a35e8db740f96ec17b85db5a0f83c028c707a3e ("bpf: Add struct bpf_trampoline_ops object") and e6abd4cd157bf63cd89c74f8f10abae76e7b0359 ("bpf: Use mutex lock pool for bpf trampolines") are not backport] Signed-off-by: Chen Yuxi <chenyuxi19@huawei.com> --- include/linux/bpf.h | 3 +++ kernel/bpf/trampoline.c | 7 +++++++ kernel/bpf/verifier.c | 2 +- 3 files changed, 11 insertions(+), 1 deletion(-) diff --git a/include/linux/bpf.h b/include/linux/bpf.h index cc2a0cc4b411..696ed5b6269f 100644 --- a/include/linux/bpf.h +++ b/include/linux/bpf.h @@ -1345,6 +1345,8 @@ struct bpf_trampoline *bpf_trampoline_get(u64 key, void bpf_trampoline_put(struct bpf_trampoline *tr); int arch_prepare_bpf_dispatcher(void *image, void *buf, s64 *funcs, int num_funcs); +void bpf_trampoline_set_flags(struct bpf_trampoline *tr, u32 flags); + /* * When the architecture supports STATIC_CALL replace the bpf_dispatcher_fn * indirection with a direct call to the bpf program. If the architecture does @@ -1452,6 +1454,7 @@ static inline bool bpf_prog_has_trampoline(const struct bpf_prog *prog) { return false; } +static inline void bpf_trampoline_set_flags(struct bpf_trampoline *tr, u32 flags) {} #endif struct bpf_func_info_aux { diff --git a/kernel/bpf/trampoline.c b/kernel/bpf/trampoline.c index f1bde7d021ce..fd23fdbdcf00 100644 --- a/kernel/bpf/trampoline.c +++ b/kernel/bpf/trampoline.c @@ -392,6 +392,13 @@ static struct bpf_tramp_image *bpf_tramp_image_alloc(u64 key, int size) return ERR_PTR(err); } +void bpf_trampoline_set_flags(struct bpf_trampoline *tr, u32 flags) +{ + mutex_lock(&tr->mutex); + tr->flags |= flags; + mutex_unlock(&tr->mutex); +} + static int bpf_trampoline_update(struct bpf_trampoline *tr, bool lock_direct_mutex) { struct bpf_tramp_image *im; diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index 3de3edcb0344..179ace544ade 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -20910,7 +20910,7 @@ static int check_attach_btf_id(struct bpf_verifier_env *env) return -ENOMEM; if (tgt_prog && tgt_prog->aux->tail_call_reachable) - tr->flags = BPF_TRAMP_F_TAIL_CALL_CTX; + bpf_trampoline_set_flags(tr, BPF_TRAMP_F_TAIL_CALL_CTX); prog->aux->dst_trampoline = tr; return 0; -- 2.34.1
反馈： 您发送到kernel@openeuler.org的补丁/补丁集，已成功转换为PR！ PR链接地址： https://atomgit.com/openeuler/kernel/merge_requests/27021 邮件列表地址：https://mailweb.openeuler.org/archives/list/kernel@openeuler.org/message/L6Z... FeedBack: The patch(es) which you have sent to kernel@openeuler.org mailing list has been converted to a pull request successfully! Pull request link: https://atomgit.com/openeuler/kernel/merge_requests/27021 Mailing list address: https://mailweb.openeuler.org/archives/list/kernel@openeuler.org/message/L6Z...
participants (2)
-
Chen Yuxi -
patchwork bot