linux-dev - Linux kernel development work

Age	Commit message (Collapse)	Author	Files	Lines
2019-01-18	tools: bpftool: Cleanup license mess	Thomas Gleixner	2	-11/+1
	Precise and non-ambiguous license information is important. The recent relicensing of the bpftools introduced a license conflict. The files have now: SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause and * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version * 2 of the License, or (at your option) any later version Amazingly about 20 people acked that change and neither they nor the committer noticed. Oh well. Digging deeper: The files were imported from the iproute2 repository with the GPL V2 or later boiler plate text in commit b66e907cfee2 ("tools: bpftool: copy JSON writer from iproute2 repository") Looking at the iproute2 repository at git://git.kernel.org/pub/scm/network/iproute2/iproute2.git the following commit is the equivivalent: commit d9d8c839 ("json_writer: add SPDX Identifier (GPL-2/BSD-2)") That commit explicitly removes the boiler plate and relicenses the code uner GPL-2.0-only and BSD-2-Clause. As Steven wrote the original code and also the relicensing commit, it's assumed that the relicensing was intended to do exaclty that. Just the kernel side update failed to remove the boiler plate. Do so now. Fixes: 907b22365115 ("tools: bpftool: dual license all files") Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Cc: Jakub Kicinski <jakub.kicinski@netronome.com> Cc: Roman Gushchin <guro@fb.com> Cc: YueHaibing <yuehaibing@huawei.com> Cc: Yonghong Song <yhs@fb.com> Cc: Stanislav Fomichev <sdf@google.com> Cc: Sean Young <sean@mess.org> Cc: Jiri Benc <jbenc@redhat.com> Cc: David Calavera <david.calavera@gmail.com> Cc: Andrey Ignatov <rdna@fb.com> Cc: Joe Stringer <joe@wand.net.nz> Cc: David Ahern <dsahern@gmail.com> Cc: Alexei Starovoitov <alexei.starovoitov@gmail.com> Cc: Petar Penkov <ppenkov@stanford.edu> Cc: Sandipan Das <sandipan@linux.ibm.com> Cc: Prashant Bhole <bhole_prashant_q7@lab.ntt.co.jp> Cc: Stephen Hemminger <stephen@networkplumber.org> Cc: John Fastabend <john.fastabend@gmail.com> Cc: Taeung Song <treeze.taeung@gmail.com> Cc: Jiri Olsa <jolsa@kernel.org> Cc: Alexei Starovoitov <ast@kernel.org> Cc: Daniel Borkmann <daniel@iogearbox.net> Cc: Quentin Monnet <quentin.monnet@netronome.com> CC: okash.khawaja@gmail.com Cc: netdev@vger.kernel.org Acked-by: Jakub Kicinski <jakub.kicinski@netronome.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2019-01-18	bpf: fix inner map masking to prevent oob under speculation	Daniel Borkmann	1	-2/+15
	During review I noticed that inner meta map setup for map in map is buggy in that it does not propagate all needed data from the reference map which the verifier is later accessing. In particular one such case is index masking to prevent out of bounds access under speculative execution due to missing the map's unpriv_array/index_mask field propagation. Fix this such that the verifier is generating the correct code for inlined lookups in case of unpriviledged use. Before patch (test_verifier's 'map in map access' dump): # bpftool prog dump xla id 3 0: (62) (u32 )(r10 -4) = 0 1: (bf) r2 = r10 2: (07) r2 += -4 3: (18) r1 = map[id:4] 5: (07) r1 += 272 \| 6: (61) r0 = (u32 )(r2 +0) \| 7: (35) if r0 >= 0x1 goto pc+6 \| Inlined map in map lookup 8: (54) (u32) r0 &= (u32) 0 \| with index masking for 9: (67) r0 <<= 3 \| map->unpriv_array. 10: (0f) r0 += r1 \| 11: (79) r0 = (u64 )(r0 +0) \| 12: (15) if r0 == 0x0 goto pc+1 \| 13: (05) goto pc+1 \| 14: (b7) r0 = 0 \| 15: (15) if r0 == 0x0 goto pc+11 16: (62) (u32 )(r10 -4) = 0 17: (bf) r2 = r10 18: (07) r2 += -4 19: (bf) r1 = r0 20: (07) r1 += 272 \| 21: (61) r0 = (u32 )(r2 +0) \| Index masking missing (!) 22: (35) if r0 >= 0x1 goto pc+3 \| for inner map despite 23: (67) r0 <<= 3 \| map->unpriv_array set. 24: (0f) r0 += r1 \| 25: (05) goto pc+1 \| 26: (b7) r0 = 0 \| 27: (b7) r0 = 0 28: (95) exit After patch: # bpftool prog dump xla id 1 0: (62) (u32 )(r10 -4) = 0 1: (bf) r2 = r10 2: (07) r2 += -4 3: (18) r1 = map[id:2] 5: (07) r1 += 272 \| 6: (61) r0 = (u32 )(r2 +0) \| 7: (35) if r0 >= 0x1 goto pc+6 \| Same inlined map in map lookup 8: (54) (u32) r0 &= (u32) 0 \| with index masking due to 9: (67) r0 <<= 3 \| map->unpriv_array. 10: (0f) r0 += r1 \| 11: (79) r0 = (u64 )(r0 +0) \| 12: (15) if r0 == 0x0 goto pc+1 \| 13: (05) goto pc+1 \| 14: (b7) r0 = 0 \| 15: (15) if r0 == 0x0 goto pc+12 16: (62) (u32 )(r10 -4) = 0 17: (bf) r2 = r10 18: (07) r2 += -4 19: (bf) r1 = r0 20: (07) r1 += 272 \| 21: (61) r0 = (u32 )(r2 +0) \| 22: (35) if r0 >= 0x1 goto pc+4 \| Now fixed inlined inner map 23: (54) (u32) r0 &= (u32) 0 \| lookup with proper index masking 24: (67) r0 <<= 3 \| for map->unpriv_array. 25: (0f) r0 += r1 \| 26: (05) goto pc+1 \| 27: (b7) r0 = 0 \| 28: (b7) r0 = 0 29: (95) exit Fixes: b2157399cc98 ("bpf: prevent out-of-bounds speculation") Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Acked-by: Martin KaFai Lau <kafai@fb.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org>