Skip to content
Snippets Groups Projects
  1. Mar 03, 2025
  2. Jan 14, 2025
  3. Sep 17, 2024
    • Kees Cook's avatar
      bpf: Replace bpf_lpm_trie_key 0-length array with flexible array · 87d375e7
      Kees Cook authored
      
      [ Upstream commit 896880ff ]
      
      Replace deprecated 0-length array in struct bpf_lpm_trie_key with
      flexible array. Found with GCC 13:
      
      ../kernel/bpf/lpm_trie.c:207:51: warning: array subscript i is outside array bounds of 'const __u8[0]' {aka 'const unsigned char[]'} [-Warray-bounds=]
        207 |                                        *(__be16 *)&key->data[i]);
            |                                                   ^~~~~~~~~~~~~
      ../include/uapi/linux/swab.h:102:54: note: in definition of macro '__swab16'
        102 | #define __swab16(x) (__u16)__builtin_bswap16((__u16)(x))
            |                                                      ^
      ../include/linux/byteorder/generic.h:97:21: note: in expansion of macro '__be16_to_cpu'
         97 | #define be16_to_cpu __be16_to_cpu
            |                     ^~~~~~~~~~~~~
      ../kernel/bpf/lpm_trie.c:206:28: note: in expansion of macro 'be16_to_cpu'
        206 |                 u16 diff = be16_to_cpu(*(__be16 *)&node->data[i]
      ^
            |                            ^~~~~~~~~~~
      In file included from ../include/linux/bpf.h:7:
      ../include/uapi/linux/bpf.h:82:17: note: while referencing 'data'
         82 |         __u8    data[0];        /* Arbitrary size */
            |                 ^~~~
      
      And found at run-time under CONFIG_FORTIFY_SOURCE:
      
        UBSAN: array-index-out-of-bounds in kernel/bpf/lpm_trie.c:218:49
        index 0 is out of range for type '__u8 [*]'
      
      Changing struct bpf_lpm_trie_key is difficult since has been used by
      userspace. For example, in Cilium:
      
      	struct egress_gw_policy_key {
      	        struct bpf_lpm_trie_key lpm_key;
      	        __u32 saddr;
      	        __u32 daddr;
      	};
      
      While direct references to the "data" member haven't been found, there
      are static initializers what include the final member. For example,
      the "{}" here:
      
              struct egress_gw_policy_key in_key = {
                      .lpm_key = { 32 + 24, {} },
                      .saddr   = CLIENT_IP,
                      .daddr   = EXTERNAL_SVC_IP & 0Xffffff,
              };
      
      To avoid the build time and run time warnings seen with a 0-sized
      trailing array for struct bpf_lpm_trie_key, introduce a new struct
      that correctly uses a flexible array for the trailing bytes,
      struct bpf_lpm_trie_key_u8. As part of this, include the "header"
      portion (which is just the "prefixlen" member), so it can be used
      by anything building a bpf_lpr_trie_key that has trailing members that
      aren't a u8 flexible array (like the self-test[1]), which is named
      struct bpf_lpm_trie_key_hdr.
      
      Unfortunately, C++ refuses to parse the __struct_group() helper, so
      it is not possible to define struct bpf_lpm_trie_key_hdr directly in
      struct bpf_lpm_trie_key_u8, so we must open-code the union directly.
      
      Adjust the kernel code to use struct bpf_lpm_trie_key_u8 through-out,
      and for the selftest to use struct bpf_lpm_trie_key_hdr. Add a comment
      to the UAPI header directing folks to the two new options.
      
      Reported-by: default avatarMark Rutland <mark.rutland@arm.com>
      Signed-off-by: default avatarKees Cook <keescook@chromium.org>
      Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
      Acked-by: default avatarGustavo A. R. Silva <gustavoars@kernel.org>
      Closes: https://paste.debian.net/hidden/ca500597/
      Link: https://lore.kernel.org/all/202206281009.4332AA33@keescook/ [1]
      Link: https://lore.kernel.org/bpf/20240222155612.it.533-kees@kernel.org
      
      
      Stable-dep-of: 59f2f841 ("bpf: Avoid kfree_rcu() under lock in bpf_lpm_trie.")
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      87d375e7
  4. Mar 11, 2024
  5. Oct 31, 2023
  6. Oct 12, 2023
    • Arnd Bergmann's avatar
      samples/hw_breakpoint: fix building without module unloading · a8cdfc22
      Arnd Bergmann authored and Frieder Schrempf's avatar Frieder Schrempf committed
      
      [ Upstream commit b9080468 ]
      
      __symbol_put() is really meant as an internal helper and is not available
      when module unloading is disabled, unlike the previously used symbol_put():
      
      samples/hw_breakpoint/data_breakpoint.c: In function 'hw_break_module_exit':
      samples/hw_breakpoint/data_breakpoint.c:73:9: error: implicit declaration of function '__symbol_put'; did you mean '__symbol_get'? [-Werror=implicit-function-declaration]
      
      The hw_break_module_exit() function is not actually used when module
      unloading is disabled, but it still causes the build failure for an
      undefined identifier. Enclose this one call in an appropriate #ifdef to
      clarify what the requirement is. Leaving out the entire exit function
      would also work but feels less clar in this case.
      
      Fixes: 910e230d ("samples/hw_breakpoint: Fix kernel BUG 'invalid opcode: 0000'")
      Fixes: d8a84d33 ("samples/hw_breakpoint: drop use of kallsyms_lookup_name()")
      Signed-off-by: default avatarArnd Bergmann <arnd@arndb.de>
      Reviewed-by: default avatarPetr Mladek <pmladek@suse.com>
      Signed-off-by: default avatarLuis Chamberlain <mcgrof@kernel.org>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      a8cdfc22
    • Rong Tao's avatar
      samples/hw_breakpoint: Fix kernel BUG 'invalid opcode: 0000' · e49a5849
      Rong Tao authored and Frieder Schrempf's avatar Frieder Schrempf committed
      
      [ Upstream commit 910e230d ]
      
      Macro symbol_put() is defined as __symbol_put(__stringify(x))
      
          ksym_name = "jiffies"
          symbol_put(ksym_name)
      
      will be resolved as
      
          __symbol_put("ksym_name")
      
      which is clearly wrong. So symbol_put must be replaced with __symbol_put.
      
      When we uninstall hw_breakpoint.ko (rmmod), a kernel bug occurs with the
      following error:
      
      [11381.854152] kernel BUG at kernel/module/main.c:779!
      [11381.854159] invalid opcode: 0000 [#2] PREEMPT SMP PTI
      [11381.854163] CPU: 8 PID: 59623 Comm: rmmod Tainted: G      D    OE      6.2.9-200.fc37.x86_64 #1
      [11381.854167] Hardware name: To Be Filled By O.E.M. To Be Filled By O.E.M./B360M-HDV, BIOS P3.20 10/23/2018
      [11381.854169] RIP: 0010:__symbol_put+0xa2/0xb0
      [11381.854175] Code: 00 e8 92 d2 f7 ff 65 8b 05 c3 2f e6 78 85 c0 74 1b 48 8b 44 24 30 65 48 2b 04 25 28 00 00 00 75 12 48 83 c4 38 c3 cc cc cc cc <0f> 0b 0f 1f 44 00 00 eb de e8 c0 df d8 00 90 90 90 90 90 90 90 90
      [11381.854178] RSP: 0018:ffffad8ec6ae7dd0 EFLAGS: 00010246
      [11381.854181] RAX: 0000000000000000 RBX: ffffffffc1fd1240 RCX: 000000000000000c
      [11381.854184] RDX: 000000000000006b RSI: ffffffffc02bf7c7 RDI: ffffffffc1fd001c
      [11381.854186] RBP: 000055a38b76e7c8 R08: ffffffff871ccfe0 R09: 0000000000000000
      [11381.854188] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
      [11381.854190] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
      [11381.854192] FS:  00007fbf7c62c740(0000) GS:ffff8c5badc00000(0000) knlGS:0000000000000000
      [11381.854195] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      [11381.854197] CR2: 000055a38b7793f8 CR3: 0000000363e1e001 CR4: 00000000003726e0
      [11381.854200] DR0: ffffffffb3407980 DR1: 0000000000000000 DR2: 0000000000000000
      [11381.854202] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
      [11381.854204] Call Trace:
      [11381.854207]  <TASK>
      [11381.854212]  s_module_exit+0xc/0xff0 [symbol_getput]
      [11381.854219]  __do_sys_delete_module.constprop.0+0x198/0x2f0
      [11381.854225]  do_syscall_64+0x58/0x80
      [11381.854231]  ? exit_to_user_mode_prepare+0x180/0x1f0
      [11381.854237]  ? syscall_exit_to_user_mode+0x17/0x40
      [11381.854241]  ? do_syscall_64+0x67/0x80
      [11381.854245]  ? syscall_exit_to_user_mode+0x17/0x40
      [11381.854248]  ? do_syscall_64+0x67/0x80
      [11381.854252]  ? exc_page_fault+0x70/0x170
      [11381.854256]  entry_SYSCALL_64_after_hwframe+0x72/0xdc
      
      Signed-off-by: default avatarRong Tao <rongtao@cestc.cn>
      Reviewed-by: default avatarPetr Mladek <pmladek@suse.com>
      Signed-off-by: default avatarLuis Chamberlain <mcgrof@kernel.org>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      e49a5849
    • Daniel T. Lee's avatar
      samples/bpf: fix broken map lookup probe · 9753b943
      Daniel T. Lee authored and Frieder Schrempf's avatar Frieder Schrempf committed
      
      [ Upstream commit d93a7cf6 ]
      
      In the commit 7c4cd051 ("bpf: Fix syscall's stackmap lookup
      potential deadlock"), a potential deadlock issue was addressed, which
      resulted in *_map_lookup_elem not triggering BPF programs.
      (prior to lookup, bpf_disable_instrumentation() is used)
      
      To resolve the broken map lookup probe using "htab_map_lookup_elem",
      this commit introduces an alternative approach. Instead, it utilize
      "bpf_map_copy_value" and apply a filter specifically for the hash table
      with map_type.
      
      Signed-off-by: default avatarDaniel T. Lee <danieltimlee@gmail.com>
      Fixes: 7c4cd051 ("bpf: Fix syscall's stackmap lookup potential deadlock")
      Link: https://lore.kernel.org/r/20230818090119.477441-8-danieltimlee@gmail.com
      
      
      Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      9753b943
    • Daniel T. Lee's avatar
      samples/bpf: fix bio latency check with tracepoint · 1a6cde2e
      Daniel T. Lee authored and Frieder Schrempf's avatar Frieder Schrempf committed
      [ Upstream commit 92632115 ]
      
      Recently, a new tracepoint for the block layer, specifically the
      block_io_start/done tracepoints, was introduced in commit 5a80bd07
      ("block: introduce block_io_start/block_io_done tracepoints").
      
      Previously, the kprobe entry used for this purpose was quite unstable
      and inherently broke relevant probes [1]. Now that a stable tracepoint
      is available, this commit replaces the bio latency check with it.
      
      One of the changes made during this replacement is the key used for the
      hash table. Since 'struct request' cannot be used as a hash key, the
      approach taken follows that which was implemented in bcc/biolatency [2].
      (uses dev:sector for the key)
      
      [1]: https://github.com/iovisor/bcc/issues/4261
      [2]: https://github.com/iovisor/bcc/pull/4691
      
      
      
      Fixes: 450b7879 ("block: move blk_account_io_{start,done} to blk-mq.c")
      Signed-off-by: default avatarDaniel T. Lee <danieltimlee@gmail.com>
      Link: https://lore.kernel.org/r/20230818090119.477441-7-danieltimlee@gmail.com
      
      
      Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
      Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
      1a6cde2e
  7. Aug 17, 2023
  8. Feb 01, 2023
  9. Dec 31, 2022
  10. Oct 04, 2022
  11. Sep 30, 2022
  12. Sep 29, 2022
  13. Sep 28, 2022
  14. Sep 21, 2022
  15. Sep 05, 2022
  16. Aug 29, 2022
  17. Jul 24, 2022
  18. Jul 15, 2022
  19. Jul 14, 2022
Loading