tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

Merge tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf

Pull bpf fixes from Alexei Starovoitov:
"A number of fixes accumulated due to summer vacations

- Fix out-of-bounds dynptr write in bpf_crypto_crypt() kfunc which
was misidentified as a security issue (Daniel Borkmann)

- Update the list of BPF selftests maintainers (Eduard Zingerman)

- Fix selftests warnings with icecc compiler (Ilya Leoshkevich)

- Disable XDP/cpumap direct return optimization (Jesper Dangaard
Brouer)

- Fix unexpected get_helper_proto() result in unusual configuration
BPF_SYSCALL=y and BPF_EVENTS=n (Jiri Olsa)

- Allow fallback to interpreter when JIT support is limited (KaFai
Wan)

- Fix rqspinlock and choose trylock fallback for NMI waiters. Pick
the simplest fix. More involved fix is targeted bpf-next (Kumar
Kartikeya Dwivedi)

- Fix cleanup when tcp_bpf_send_verdict() fails to allocate
psock->cork (Kuniyuki Iwashima)

- Disallow bpf_timer in PREEMPT_RT for now. Proper solution is being
discussed for bpf-next. (Leon Hwang)

- Fix XSK cq descriptor production (Maciej Fijalkowski)

- Tell memcg to use allow_spinning=false path in bpf_timer_init() to
avoid lockup in cgroup_file_notify() (Peilin Ye)

- Fix bpf_strnstr() to handle suffix match cases (Rong Tao)"

* tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf:
selftests/bpf: Skip timer cases when bpf_timer is not supported
bpf: Reject bpf_timer for PREEMPT_RT
tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork.
bpf: Tell memcg to use allow_spinning=false path in bpf_timer_init()
bpf: Allow fall back to interpreter for programs with stack size <= 512
rqspinlock: Choose trylock fallback for NMI waiters
xsk: Fix immature cq descriptor production
bpf: Update the list of BPF selftests maintainers
selftests/bpf: Add tests for bpf_strnstr
selftests/bpf: Fix "expression result unused" warnings with icecc
bpf: Fix bpf_strnstr() to handle suffix match cases better
selftests/bpf: Extend crypto_sanity selftest with invalid dst buffer
bpf: Fix out-of-bounds dynptr write in bpf_crypto_crypt
bpf: Check the helper function is valid in get_helper_proto
bpf, cpumap: Disable page_pool direct xdp_return need larger scope

Linus Torvalds 02ffd6f8 4f553c1e

+213 -53
-1
MAINTAINERS
··· 4683 4683 BPF [SELFTESTS] (Test Runners & Infrastructure) 4684 4684 M: Andrii Nakryiko <andrii@kernel.org> 4685 4685 M: Eduard Zingerman <eddyz87@gmail.com> 4686 - R: Mykola Lysenko <mykolal@fb.com> 4687 4686 L: bpf@vger.kernel.org 4688 4687 S: Maintained 4689 4688 F: tools/testing/selftests/bpf/
+1
kernel/bpf/Makefile
··· 62 62 CFLAGS_REMOVE_queue_stack_maps.o = $(CC_FLAGS_FTRACE) 63 63 CFLAGS_REMOVE_lpm_trie.o = $(CC_FLAGS_FTRACE) 64 64 CFLAGS_REMOVE_ringbuf.o = $(CC_FLAGS_FTRACE) 65 + CFLAGS_REMOVE_rqspinlock.o = $(CC_FLAGS_FTRACE)
+13 -8
kernel/bpf/core.c
··· 2366 2366 const struct bpf_insn *insn) 2367 2367 { 2368 2368 /* If this handler ever gets executed, then BPF_JIT_ALWAYS_ON 2369 - * is not working properly, or interpreter is being used when 2370 - * prog->jit_requested is not 0, so warn about it! 2369 + * is not working properly, so warn about it! 2371 2370 */ 2372 2371 WARN_ON_ONCE(1); 2373 2372 return 0; ··· 2467 2468 return ret; 2468 2469 } 2469 2470 2470 - static void bpf_prog_select_func(struct bpf_prog *fp) 2471 + static bool bpf_prog_select_interpreter(struct bpf_prog *fp) 2471 2472 { 2473 + bool select_interpreter = false; 2472 2474 #ifndef CONFIG_BPF_JIT_ALWAYS_ON 2473 2475 u32 stack_depth = max_t(u32, fp->aux->stack_depth, 1); 2474 2476 u32 idx = (round_up(stack_depth, 32) / 32) - 1; ··· 2478 2478 * But for non-JITed programs, we don't need bpf_func, so no bounds 2479 2479 * check needed. 2480 2480 */ 2481 - if (!fp->jit_requested && 2482 - !WARN_ON_ONCE(idx >= ARRAY_SIZE(interpreters))) { 2481 + if (idx < ARRAY_SIZE(interpreters)) { 2483 2482 fp->bpf_func = interpreters[idx]; 2483 + select_interpreter = true; 2484 2484 } else { 2485 2485 fp->bpf_func = __bpf_prog_ret0_warn; 2486 2486 } 2487 2487 #else 2488 2488 fp->bpf_func = __bpf_prog_ret0_warn; 2489 2489 #endif 2490 + return select_interpreter; 2490 2491 } 2491 2492 2492 2493 /** ··· 2506 2505 /* In case of BPF to BPF calls, verifier did all the prep 2507 2506 * work with regards to JITing, etc. 2508 2507 */ 2509 - bool jit_needed = fp->jit_requested; 2508 + bool jit_needed = false; 2510 2509 2511 2510 if (fp->bpf_func) 2512 2511 goto finalize; ··· 2515 2514 bpf_prog_has_kfunc_call(fp)) 2516 2515 jit_needed = true; 2517 2516 2518 - bpf_prog_select_func(fp); 2517 + if (!bpf_prog_select_interpreter(fp)) 2518 + jit_needed = true; 2519 2519 2520 2520 /* eBPF JITs can rewrite the program in case constant 2521 2521 * blinding is active. However, in case of error during ··· 3026 3024 3027 3025 /* Always built-in helper functions. */ 3028 3026 const struct bpf_func_proto bpf_tail_call_proto = { 3029 - .func = NULL, 3027 + /* func is unused for tail_call, we set it to pass the 3028 + * get_helper_proto check 3029 + */ 3030 + .func = BPF_PTR_POISON, 3030 3031 .gpl_only = false, 3031 3032 .ret_type = RET_VOID, 3032 3033 .arg1_type = ARG_PTR_TO_CTX,
+2 -2
kernel/bpf/cpumap.c
··· 186 186 struct xdp_buff xdp; 187 187 int i, nframes = 0; 188 188 189 - xdp_set_return_frame_no_direct(); 190 189 xdp.rxq = &rxq; 191 190 192 191 for (i = 0; i < n; i++) { ··· 230 231 } 231 232 } 232 233 233 - xdp_clear_return_frame_no_direct(); 234 234 stats->pass += nframes; 235 235 236 236 return nframes; ··· 253 255 254 256 rcu_read_lock(); 255 257 bpf_net_ctx = bpf_net_ctx_set(&__bpf_net_ctx); 258 + xdp_set_return_frame_no_direct(); 256 259 257 260 ret->xdp_n = cpu_map_bpf_prog_run_xdp(rcpu, frames, ret->xdp_n, stats); 258 261 if (unlikely(ret->skb_n)) ··· 263 264 if (stats->redirect) 264 265 xdp_do_flush(); 265 266 267 + xdp_clear_return_frame_no_direct(); 266 268 bpf_net_ctx_clear(bpf_net_ctx); 267 269 rcu_read_unlock(); 268 270
+1 -1
kernel/bpf/crypto.c
··· 278 278 siv_len = siv ? __bpf_dynptr_size(siv) : 0; 279 279 src_len = __bpf_dynptr_size(src); 280 280 dst_len = __bpf_dynptr_size(dst); 281 - if (!src_len || !dst_len) 281 + if (!src_len || !dst_len || src_len > dst_len) 282 282 return -EINVAL; 283 283 284 284 if (siv_len != ctx->siv_len)
+13 -3
kernel/bpf/helpers.c
··· 1274 1274 goto out; 1275 1275 } 1276 1276 1277 - /* allocate hrtimer via map_kmalloc to use memcg accounting */ 1278 - cb = bpf_map_kmalloc_node(map, size, GFP_ATOMIC, map->numa_node); 1277 + /* Allocate via bpf_map_kmalloc_node() for memcg accounting. Until 1278 + * kmalloc_nolock() is available, avoid locking issues by using 1279 + * __GFP_HIGH (GFP_ATOMIC & ~__GFP_RECLAIM). 1280 + */ 1281 + cb = bpf_map_kmalloc_node(map, size, __GFP_HIGH, map->numa_node); 1279 1282 if (!cb) { 1280 1283 ret = -ENOMEM; 1281 1284 goto out; ··· 3667 3664 3668 3665 guard(pagefault)(); 3669 3666 for (i = 0; i < XATTR_SIZE_MAX; i++) { 3670 - for (j = 0; i + j < len && j < XATTR_SIZE_MAX; j++) { 3667 + for (j = 0; i + j <= len && j < XATTR_SIZE_MAX; j++) { 3671 3668 __get_kernel_nofault(&c2, s2__ign + j, char, err_out); 3672 3669 if (c2 == '\0') 3673 3670 return i; 3671 + /* 3672 + * We allow reading an extra byte from s2 (note the 3673 + * `i + j <= len` above) to cover the case when s2 is 3674 + * a suffix of the first len chars of s1. 3675 + */ 3676 + if (i + j == len) 3677 + break; 3674 3678 __get_kernel_nofault(&c1, s1__ign + j, char, err_out); 3675 3679 if (c1 == '\0') 3676 3680 return -ENOENT;
+1 -1
kernel/bpf/rqspinlock.c
··· 471 471 * any MCS node. This is not the most elegant solution, but is 472 472 * simple enough. 473 473 */ 474 - if (unlikely(idx >= _Q_MAX_NODES)) { 474 + if (unlikely(idx >= _Q_MAX_NODES || in_nmi())) { 475 475 lockevent_inc(lock_no_node); 476 476 RES_RESET_TIMEOUT(ts, RES_DEF_TIMEOUT); 477 477 while (!queued_spin_trylock(lock)) {
+5 -1
kernel/bpf/verifier.c
··· 8547 8547 verifier_bug(env, "Two map pointers in a timer helper"); 8548 8548 return -EFAULT; 8549 8549 } 8550 + if (IS_ENABLED(CONFIG_PREEMPT_RT)) { 8551 + verbose(env, "bpf_timer cannot be used for PREEMPT_RT.\n"); 8552 + return -EOPNOTSUPP; 8553 + } 8550 8554 meta->map_uid = reg->map_uid; 8551 8555 meta->map_ptr = map; 8552 8556 return 0; ··· 11358 11354 return -EINVAL; 11359 11355 11360 11356 *ptr = env->ops->get_func_proto(func_id, env->prog); 11361 - return *ptr ? 0 : -EINVAL; 11357 + return *ptr && (*ptr)->func ? 0 : -EINVAL; 11362 11358 } 11363 11359 11364 11360 static int check_helper_call(struct bpf_verifier_env *env, struct bpf_insn *insn,
+4 -1
net/ipv4/tcp_bpf.c
··· 408 408 if (!psock->cork) { 409 409 psock->cork = kzalloc(sizeof(*psock->cork), 410 410 GFP_ATOMIC | __GFP_NOWARN); 411 - if (!psock->cork) 411 + if (!psock->cork) { 412 + sk_msg_free(sk, msg); 413 + *copied = 0; 412 414 return -ENOMEM; 415 + } 413 416 } 414 417 memcpy(psock->cork, msg, sizeof(*msg)); 415 418 return 0;
+99 -14
net/xdp/xsk.c
··· 36 36 #define TX_BATCH_SIZE 32 37 37 #define MAX_PER_SOCKET_BUDGET 32 38 38 39 + struct xsk_addr_node { 40 + u64 addr; 41 + struct list_head addr_node; 42 + }; 43 + 44 + struct xsk_addr_head { 45 + u32 num_descs; 46 + struct list_head addrs_list; 47 + }; 48 + 49 + static struct kmem_cache *xsk_tx_generic_cache; 50 + 51 + #define XSKCB(skb) ((struct xsk_addr_head *)((skb)->cb)) 52 + 39 53 void xsk_set_rx_need_wakeup(struct xsk_buff_pool *pool) 40 54 { 41 55 if (pool->cached_need_wakeup & XDP_WAKEUP_RX) ··· 546 532 return dev->netdev_ops->ndo_xsk_wakeup(dev, xs->queue_id, flags); 547 533 } 548 534 549 - static int xsk_cq_reserve_addr_locked(struct xsk_buff_pool *pool, u64 addr) 535 + static int xsk_cq_reserve_locked(struct xsk_buff_pool *pool) 550 536 { 551 537 unsigned long flags; 552 538 int ret; 553 539 554 540 spin_lock_irqsave(&pool->cq_lock, flags); 555 - ret = xskq_prod_reserve_addr(pool->cq, addr); 541 + ret = xskq_prod_reserve(pool->cq); 556 542 spin_unlock_irqrestore(&pool->cq_lock, flags); 557 543 558 544 return ret; 559 545 } 560 546 561 - static void xsk_cq_submit_locked(struct xsk_buff_pool *pool, u32 n) 547 + static void xsk_cq_submit_addr_locked(struct xsk_buff_pool *pool, 548 + struct sk_buff *skb) 562 549 { 550 + struct xsk_addr_node *pos, *tmp; 551 + u32 descs_processed = 0; 563 552 unsigned long flags; 553 + u32 idx; 564 554 565 555 spin_lock_irqsave(&pool->cq_lock, flags); 566 - xskq_prod_submit_n(pool->cq, n); 556 + idx = xskq_get_prod(pool->cq); 557 + 558 + xskq_prod_write_addr(pool->cq, idx, 559 + (u64)(uintptr_t)skb_shinfo(skb)->destructor_arg); 560 + descs_processed++; 561 + 562 + if (unlikely(XSKCB(skb)->num_descs > 1)) { 563 + list_for_each_entry_safe(pos, tmp, &XSKCB(skb)->addrs_list, addr_node) { 564 + xskq_prod_write_addr(pool->cq, idx + descs_processed, 565 + pos->addr); 566 + descs_processed++; 567 + list_del(&pos->addr_node); 568 + kmem_cache_free(xsk_tx_generic_cache, pos); 569 + } 570 + } 571 + xskq_prod_submit_n(pool->cq, descs_processed); 567 572 spin_unlock_irqrestore(&pool->cq_lock, flags); 568 573 } 569 574 ··· 595 562 spin_unlock_irqrestore(&pool->cq_lock, flags); 596 563 } 597 564 565 + static void xsk_inc_num_desc(struct sk_buff *skb) 566 + { 567 + XSKCB(skb)->num_descs++; 568 + } 569 + 598 570 static u32 xsk_get_num_desc(struct sk_buff *skb) 599 571 { 600 - return skb ? (long)skb_shinfo(skb)->destructor_arg : 0; 572 + return XSKCB(skb)->num_descs; 601 573 } 602 574 603 575 static void xsk_destruct_skb(struct sk_buff *skb) ··· 614 576 *compl->tx_timestamp = ktime_get_tai_fast_ns(); 615 577 } 616 578 617 - xsk_cq_submit_locked(xdp_sk(skb->sk)->pool, xsk_get_num_desc(skb)); 579 + xsk_cq_submit_addr_locked(xdp_sk(skb->sk)->pool, skb); 618 580 sock_wfree(skb); 619 581 } 620 582 621 - static void xsk_set_destructor_arg(struct sk_buff *skb) 583 + static void xsk_set_destructor_arg(struct sk_buff *skb, u64 addr) 622 584 { 623 - long num = xsk_get_num_desc(xdp_sk(skb->sk)->skb) + 1; 624 - 625 - skb_shinfo(skb)->destructor_arg = (void *)num; 585 + BUILD_BUG_ON(sizeof(struct xsk_addr_head) > sizeof(skb->cb)); 586 + INIT_LIST_HEAD(&XSKCB(skb)->addrs_list); 587 + XSKCB(skb)->num_descs = 0; 588 + skb_shinfo(skb)->destructor_arg = (void *)(uintptr_t)addr; 626 589 } 627 590 628 591 static void xsk_consume_skb(struct sk_buff *skb) 629 592 { 630 593 struct xdp_sock *xs = xdp_sk(skb->sk); 594 + u32 num_descs = xsk_get_num_desc(skb); 595 + struct xsk_addr_node *pos, *tmp; 596 + 597 + if (unlikely(num_descs > 1)) { 598 + list_for_each_entry_safe(pos, tmp, &XSKCB(skb)->addrs_list, addr_node) { 599 + list_del(&pos->addr_node); 600 + kmem_cache_free(xsk_tx_generic_cache, pos); 601 + } 602 + } 631 603 632 604 skb->destructor = sock_wfree; 633 - xsk_cq_cancel_locked(xs->pool, xsk_get_num_desc(skb)); 605 + xsk_cq_cancel_locked(xs->pool, num_descs); 634 606 /* Free skb without triggering the perf drop trace */ 635 607 consume_skb(skb); 636 608 xs->skb = NULL; ··· 657 609 { 658 610 struct xsk_buff_pool *pool = xs->pool; 659 611 u32 hr, len, ts, offset, copy, copied; 612 + struct xsk_addr_node *xsk_addr; 660 613 struct sk_buff *skb = xs->skb; 661 614 struct page *page; 662 615 void *buffer; ··· 672 623 return ERR_PTR(err); 673 624 674 625 skb_reserve(skb, hr); 626 + 627 + xsk_set_destructor_arg(skb, desc->addr); 628 + } else { 629 + xsk_addr = kmem_cache_zalloc(xsk_tx_generic_cache, GFP_KERNEL); 630 + if (!xsk_addr) 631 + return ERR_PTR(-ENOMEM); 632 + 633 + /* in case of -EOVERFLOW that could happen below, 634 + * xsk_consume_skb() will release this node as whole skb 635 + * would be dropped, which implies freeing all list elements 636 + */ 637 + xsk_addr->addr = desc->addr; 638 + list_add_tail(&xsk_addr->addr_node, &XSKCB(skb)->addrs_list); 675 639 } 676 640 677 641 addr = desc->addr; ··· 756 694 err = skb_store_bits(skb, 0, buffer, len); 757 695 if (unlikely(err)) 758 696 goto free_err; 697 + 698 + xsk_set_destructor_arg(skb, desc->addr); 759 699 } else { 760 700 int nr_frags = skb_shinfo(skb)->nr_frags; 701 + struct xsk_addr_node *xsk_addr; 761 702 struct page *page; 762 703 u8 *vaddr; 763 704 ··· 775 710 goto free_err; 776 711 } 777 712 713 + xsk_addr = kmem_cache_zalloc(xsk_tx_generic_cache, GFP_KERNEL); 714 + if (!xsk_addr) { 715 + __free_page(page); 716 + err = -ENOMEM; 717 + goto free_err; 718 + } 719 + 778 720 vaddr = kmap_local_page(page); 779 721 memcpy(vaddr, buffer, len); 780 722 kunmap_local(vaddr); 781 723 782 724 skb_add_rx_frag(skb, nr_frags, page, 0, len, PAGE_SIZE); 783 725 refcount_add(PAGE_SIZE, &xs->sk.sk_wmem_alloc); 726 + 727 + xsk_addr->addr = desc->addr; 728 + list_add_tail(&xsk_addr->addr_node, &XSKCB(skb)->addrs_list); 784 729 } 785 730 786 731 if (first_frag && desc->options & XDP_TX_METADATA) { ··· 834 759 skb->mark = READ_ONCE(xs->sk.sk_mark); 835 760 skb->destructor = xsk_destruct_skb; 836 761 xsk_tx_metadata_to_compl(meta, &skb_shinfo(skb)->xsk_meta); 837 - xsk_set_destructor_arg(skb); 762 + xsk_inc_num_desc(skb); 838 763 839 764 return skb; 840 765 ··· 844 769 845 770 if (err == -EOVERFLOW) { 846 771 /* Drop the packet */ 847 - xsk_set_destructor_arg(xs->skb); 772 + xsk_inc_num_desc(xs->skb); 848 773 xsk_drop_skb(xs->skb); 849 774 xskq_cons_release(xs->tx); 850 775 } else { ··· 887 812 * if there is space in it. This avoids having to implement 888 813 * any buffering in the Tx path. 889 814 */ 890 - err = xsk_cq_reserve_addr_locked(xs->pool, desc.addr); 815 + err = xsk_cq_reserve_locked(xs->pool); 891 816 if (err) { 892 817 err = -EAGAIN; 893 818 goto out; ··· 1890 1815 if (err) 1891 1816 goto out_pernet; 1892 1817 1818 + xsk_tx_generic_cache = kmem_cache_create("xsk_generic_xmit_cache", 1819 + sizeof(struct xsk_addr_node), 1820 + 0, SLAB_HWCACHE_ALIGN, NULL); 1821 + if (!xsk_tx_generic_cache) { 1822 + err = -ENOMEM; 1823 + goto out_unreg_notif; 1824 + } 1825 + 1893 1826 return 0; 1894 1827 1828 + out_unreg_notif: 1829 + unregister_netdevice_notifier(&xsk_netdev_notifier); 1895 1830 out_pernet: 1896 1831 unregister_pernet_subsys(&xsk_net_ops); 1897 1832 out_sk:
+12
net/xdp/xsk_queue.h
··· 344 344 345 345 /* Functions for producers */ 346 346 347 + static inline u32 xskq_get_prod(struct xsk_queue *q) 348 + { 349 + return READ_ONCE(q->ring->producer); 350 + } 351 + 347 352 static inline u32 xskq_prod_nb_free(struct xsk_queue *q, u32 max) 348 353 { 349 354 u32 free_entries = q->nentries - (q->cached_prod - q->cached_cons); ··· 393 388 /* A, matches D */ 394 389 ring->desc[q->cached_prod++ & q->ring_mask] = addr; 395 390 return 0; 391 + } 392 + 393 + static inline void xskq_prod_write_addr(struct xsk_queue *q, u32 idx, u64 addr) 394 + { 395 + struct xdp_umem_ring *ring = (struct xdp_umem_ring *)q->ring; 396 + 397 + ring->desc[idx & q->ring_mask] = addr; 396 398 } 397 399 398 400 static inline void xskq_prod_write_addr_batch(struct xsk_queue *q, struct xdp_desc *descs,
+4
tools/testing/selftests/bpf/prog_tests/free_timer.c
··· 124 124 int err; 125 125 126 126 skel = free_timer__open_and_load(); 127 + if (!skel && errno == EOPNOTSUPP) { 128 + test__skip(); 129 + return; 130 + } 127 131 if (!ASSERT_OK_PTR(skel, "open_load")) 128 132 return; 129 133
+4
tools/testing/selftests/bpf/prog_tests/timer.c
··· 86 86 int err; 87 87 88 88 timer_skel = timer__open_and_load(); 89 + if (!timer_skel && errno == EOPNOTSUPP) { 90 + test__skip(); 91 + return; 92 + } 89 93 if (!ASSERT_OK_PTR(timer_skel, "timer_skel_load")) 90 94 return; 91 95
+4
tools/testing/selftests/bpf/prog_tests/timer_crash.c
··· 12 12 struct timer_crash *skel; 13 13 14 14 skel = timer_crash__open_and_load(); 15 + if (!skel && errno == EOPNOTSUPP) { 16 + test__skip(); 17 + return; 18 + } 15 19 if (!ASSERT_OK_PTR(skel, "timer_crash__open_and_load")) 16 20 return; 17 21 skel->bss->pid = getpid();
+4
tools/testing/selftests/bpf/prog_tests/timer_lockup.c
··· 59 59 } 60 60 61 61 skel = timer_lockup__open_and_load(); 62 + if (!skel && errno == EOPNOTSUPP) { 63 + test__skip(); 64 + return; 65 + } 62 66 if (!ASSERT_OK_PTR(skel, "timer_lockup__open_and_load")) 63 67 return; 64 68
+4
tools/testing/selftests/bpf/prog_tests/timer_mim.c
··· 65 65 goto cleanup; 66 66 67 67 timer_skel = timer_mim__open_and_load(); 68 + if (!timer_skel && errno == EOPNOTSUPP) { 69 + test__skip(); 70 + return; 71 + } 68 72 if (!ASSERT_OK_PTR(timer_skel, "timer_skel_load")) 69 73 goto cleanup; 70 74
+2 -2
tools/testing/selftests/bpf/progs/bpf_arena_spin_lock.h
··· 302 302 * barriers. 303 303 */ 304 304 if (val & _Q_LOCKED_MASK) 305 - smp_cond_load_acquire_label(&lock->locked, !VAL, release_err); 305 + (void)smp_cond_load_acquire_label(&lock->locked, !VAL, release_err); 306 306 307 307 /* 308 308 * take ownership and clear the pending bit. ··· 380 380 /* Link @node into the waitqueue. */ 381 381 WRITE_ONCE(prev->next, node); 382 382 383 - arch_mcs_spin_lock_contended_label(&node->locked, release_node_err); 383 + (void)arch_mcs_spin_lock_contended_label(&node->locked, release_node_err); 384 384 385 385 /* 386 386 * While waiting for the MCS lock, the next pointer may have
+32 -14
tools/testing/selftests/bpf/progs/crypto_sanity.c
··· 14 14 u16 udp_test_port = 7777; 15 15 u32 authsize, key_len; 16 16 char algo[128] = {}; 17 - char dst[16] = {}; 17 + char dst[16] = {}, dst_bad[8] = {}; 18 18 int status; 19 19 20 20 static int skb_dynptr_validate(struct __sk_buff *skb, struct bpf_dynptr *psrc) ··· 59 59 .authsize = authsize, 60 60 }; 61 61 struct bpf_crypto_ctx *cctx; 62 - int err = 0; 62 + int err; 63 63 64 64 status = 0; 65 - 66 65 if (key_len > 256) { 67 66 status = -EINVAL; 68 67 return 0; ··· 69 70 70 71 __builtin_memcpy(&params.algo, algo, sizeof(algo)); 71 72 __builtin_memcpy(&params.key, key, sizeof(key)); 72 - cctx = bpf_crypto_ctx_create(&params, sizeof(params), &err); 73 73 74 + cctx = bpf_crypto_ctx_create(&params, sizeof(params), &err); 74 75 if (!cctx) { 75 76 status = err; 76 77 return 0; ··· 79 80 err = crypto_ctx_insert(cctx); 80 81 if (err && err != -EEXIST) 81 82 status = err; 82 - 83 83 return 0; 84 84 } 85 85 ··· 90 92 struct bpf_dynptr psrc, pdst; 91 93 int err; 92 94 95 + status = 0; 93 96 err = skb_dynptr_validate(skb, &psrc); 94 97 if (err < 0) { 95 98 status = err; ··· 109 110 return TC_ACT_SHOT; 110 111 } 111 112 112 - /* dst is a global variable to make testing part easier to check. In real 113 - * production code, a percpu map should be used to store the result. 113 + /* Check also bad case where the dst buffer is smaller than the 114 + * skb's linear section. 115 + */ 116 + bpf_dynptr_from_mem(dst_bad, sizeof(dst_bad), 0, &pdst); 117 + status = bpf_crypto_decrypt(ctx, &psrc, &pdst, NULL); 118 + if (!status) 119 + status = -EIO; 120 + if (status != -EINVAL) 121 + goto err; 122 + 123 + /* dst is a global variable to make testing part easier to check. 124 + * In real production code, a percpu map should be used to store 125 + * the result. 114 126 */ 115 127 bpf_dynptr_from_mem(dst, sizeof(dst), 0, &pdst); 116 - 117 128 status = bpf_crypto_decrypt(ctx, &psrc, &pdst, NULL); 118 - 129 + err: 119 130 return TC_ACT_SHOT; 120 131 } 121 132 ··· 138 129 int err; 139 130 140 131 status = 0; 141 - 142 132 err = skb_dynptr_validate(skb, &psrc); 143 133 if (err < 0) { 144 134 status = err; ··· 156 148 return TC_ACT_SHOT; 157 149 } 158 150 159 - /* dst is a global variable to make testing part easier to check. In real 160 - * production code, a percpu map should be used to store the result. 151 + /* Check also bad case where the dst buffer is smaller than the 152 + * skb's linear section. 153 + */ 154 + bpf_dynptr_from_mem(dst_bad, sizeof(dst_bad), 0, &pdst); 155 + status = bpf_crypto_encrypt(ctx, &psrc, &pdst, NULL); 156 + if (!status) 157 + status = -EIO; 158 + if (status != -EINVAL) 159 + goto err; 160 + 161 + /* dst is a global variable to make testing part easier to check. 162 + * In real production code, a percpu map should be used to store 163 + * the result. 161 164 */ 162 165 bpf_dynptr_from_mem(dst, sizeof(dst), 0, &pdst); 163 - 164 166 status = bpf_crypto_encrypt(ctx, &psrc, &pdst, NULL); 165 - 167 + err: 166 168 return TC_ACT_SHOT; 167 169 } 168 170
+2 -3
tools/testing/selftests/bpf/progs/linked_list_fail.c
··· 226 226 SEC("?tc") 227 227 int obj_new_no_struct(void *ctx) 228 228 { 229 - 230 - bpf_obj_new(union { int data; unsigned udata; }); 229 + (void)bpf_obj_new(union { int data; unsigned udata; }); 231 230 return 0; 232 231 } 233 232 ··· 251 252 SEC("?tc") 252 253 int obj_new_acq(void *ctx) 253 254 { 254 - bpf_obj_new(struct foo); 255 + (void)bpf_obj_new(struct foo); 255 256 return 0; 256 257 } 257 258
+6 -2
tools/testing/selftests/bpf/progs/string_kfuncs_success.c
··· 30 30 __test(6) int test_strstr_found(void *ctx) { return bpf_strstr(str, "world"); } 31 31 __test(-ENOENT) int test_strstr_notfound(void *ctx) { return bpf_strstr(str, "hi"); } 32 32 __test(0) int test_strstr_empty(void *ctx) { return bpf_strstr(str, ""); } 33 - __test(0) int test_strnstr_found(void *ctx) { return bpf_strnstr(str, "hello", 6); } 34 - __test(-ENOENT) int test_strnstr_notfound(void *ctx) { return bpf_strnstr(str, "hi", 10); } 33 + __test(0) int test_strnstr_found1(void *ctx) { return bpf_strnstr("", "", 0); } 34 + __test(0) int test_strnstr_found2(void *ctx) { return bpf_strnstr(str, "hello", 5); } 35 + __test(0) int test_strnstr_found3(void *ctx) { return bpf_strnstr(str, "hello", 6); } 36 + __test(-ENOENT) int test_strnstr_notfound1(void *ctx) { return bpf_strnstr(str, "hi", 10); } 37 + __test(-ENOENT) int test_strnstr_notfound2(void *ctx) { return bpf_strnstr(str, "hello", 4); } 38 + __test(-ENOENT) int test_strnstr_notfound3(void *ctx) { return bpf_strnstr("", "a", 0); } 35 39 __test(0) int test_strnstr_empty(void *ctx) { return bpf_strnstr(str, "", 1); } 36 40 37 41 char _license[] SEC("license") = "GPL";