From: David S. Miller <davem@davemloft.net>
Date: Thu, 20 Apr 2017 14:35:33 +0000 (-0400)
Subject: Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
X-Git-Tag: v4.12-rc1~129^2~158
X-Git-Url: https://asedeno.scripts.mit.edu/gitweb/?a=commitdiff_plain;h=7b9f6da175f9387ebfc202f35e0d39514899ab19;p=linux.git

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

A function in kernel/bpf/syscall.c which got a bug fix in 'net'
was moved to kernel/bpf/verifier.c in 'net-next'.

Signed-off-by: David S. Miller <davem@davemloft.net>
---

7b9f6da175f9387ebfc202f35e0d39514899ab19
diff --cc kernel/bpf/verifier.c
index 62e1e447ded9,a834068a400e..ca15cf2b85bb
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@@ -3322,84 -3253,6 +3322,92 @@@ static int convert_ctx_accesses(struct 
  	return 0;
  }
  
 +/* fixup insn->imm field of bpf_call instructions
 + * and inline eligible helpers as explicit sequence of BPF instructions
 + *
 + * this function is called after eBPF program passed verification
 + */
 +static int fixup_bpf_calls(struct bpf_verifier_env *env)
 +{
 +	struct bpf_prog *prog = env->prog;
 +	struct bpf_insn *insn = prog->insnsi;
 +	const struct bpf_func_proto *fn;
 +	const int insn_cnt = prog->len;
 +	struct bpf_insn insn_buf[16];
 +	struct bpf_prog *new_prog;
 +	struct bpf_map *map_ptr;
 +	int i, cnt, delta = 0;
 +
 +	for (i = 0; i < insn_cnt; i++, insn++) {
 +		if (insn->code != (BPF_JMP | BPF_CALL))
 +			continue;
 +
 +		if (insn->imm == BPF_FUNC_get_route_realm)
 +			prog->dst_needed = 1;
 +		if (insn->imm == BPF_FUNC_get_prandom_u32)
 +			bpf_user_rnd_init_once();
 +		if (insn->imm == BPF_FUNC_xdp_adjust_head)
 +			prog->xdp_adjust_head = 1;
 +		if (insn->imm == BPF_FUNC_tail_call) {
++			/* If we tail call into other programs, we
++			 * cannot make any assumptions since they can
++			 * be replaced dynamically during runtime in
++			 * the program array.
++			 */
++			prog->cb_access = 1;
++			prog->xdp_adjust_head = 1;
++
 +			/* mark bpf_tail_call as different opcode to avoid
 +			 * conditional branch in the interpeter for every normal
 +			 * call and to prevent accidental JITing by JIT compiler
 +			 * that doesn't support bpf_tail_call yet
 +			 */
 +			insn->imm = 0;
 +			insn->code |= BPF_X;
 +			continue;
 +		}
 +
 +		if (ebpf_jit_enabled() && insn->imm == BPF_FUNC_map_lookup_elem) {
 +			map_ptr = env->insn_aux_data[i + delta].map_ptr;
 +			if (map_ptr == BPF_MAP_PTR_POISON ||
 +			    !map_ptr->ops->map_gen_lookup)
 +				goto patch_call_imm;
 +
 +			cnt = map_ptr->ops->map_gen_lookup(map_ptr, insn_buf);
 +			if (cnt == 0 || cnt >= ARRAY_SIZE(insn_buf)) {
 +				verbose("bpf verifier is misconfigured\n");
 +				return -EINVAL;
 +			}
 +
 +			new_prog = bpf_patch_insn_data(env, i + delta, insn_buf,
 +						       cnt);
 +			if (!new_prog)
 +				return -ENOMEM;
 +
 +			delta += cnt - 1;
 +
 +			/* keep walking new program and skip insns we just inserted */
 +			env->prog = prog = new_prog;
 +			insn      = new_prog->insnsi + i + delta;
 +			continue;
 +		}
 +
 +patch_call_imm:
 +		fn = prog->aux->ops->get_func_proto(insn->imm);
 +		/* all functions that have prototype and verifier allowed
 +		 * programs to call them, must be real in-kernel functions
 +		 */
 +		if (!fn->func) {
 +			verbose("kernel subsystem misconfigured func %s#%d\n",
 +				func_id_name(insn->imm), insn->imm);
 +			return -EFAULT;
 +		}
 +		insn->imm = fn->func - __bpf_call_base;
 +	}
 +
 +	return 0;
 +}
 +
  static void free_states(struct bpf_verifier_env *env)
  {
  	struct bpf_verifier_state_list *sl, *sln;