syscall.c 109 KB
Newer Older
1
// SPDX-License-Identifier: GPL-2.0-only
2 3 4
/* Copyright (c) 2011-2014 PLUMgrid, http://plumgrid.com
 */
#include <linux/bpf.h>
5
#include <linux/bpf_trace.h>
6
#include <linux/bpf_lirc.h>
7
#include <linux/bpf_verifier.h>
8
#include <linux/btf.h>
9 10
#include <linux/syscalls.h>
#include <linux/slab.h>
11
#include <linux/sched/signal.h>
12 13
#include <linux/vmalloc.h>
#include <linux/mmzone.h>
14
#include <linux/anon_inodes.h>
15
#include <linux/fdtable.h>
16
#include <linux/file.h>
17
#include <linux/fs.h>
18 19
#include <linux/license.h>
#include <linux/filter.h>
20
#include <linux/kernel.h>
21
#include <linux/idr.h>
22 23 24
#include <linux/cred.h>
#include <linux/timekeeping.h>
#include <linux/ctype.h>
25
#include <linux/nospec.h>
26
#include <linux/audit.h>
27
#include <uapi/linux/btf.h>
28
#include <linux/pgtable.h>
29
#include <linux/bpf_lsm.h>
30
#include <linux/poll.h>
31
#include <linux/bpf-netns.h>
32
#include <linux/rcupdate_trace.h>
33
#include <linux/memcontrol.h>
34

35 36 37 38
#define IS_FD_ARRAY(map) ((map)->map_type == BPF_MAP_TYPE_PERF_EVENT_ARRAY || \
			  (map)->map_type == BPF_MAP_TYPE_CGROUP_ARRAY || \
			  (map)->map_type == BPF_MAP_TYPE_ARRAY_OF_MAPS)
#define IS_FD_PROG_ARRAY(map) ((map)->map_type == BPF_MAP_TYPE_PROG_ARRAY)
39
#define IS_FD_HASH(map) ((map)->map_type == BPF_MAP_TYPE_HASH_OF_MAPS)
40 41
#define IS_FD_MAP(map) (IS_FD_ARRAY(map) || IS_FD_PROG_ARRAY(map) || \
			IS_FD_HASH(map))
42

43 44
#define BPF_OBJ_FLAG_MASK   (BPF_F_RDONLY | BPF_F_WRONLY)

45
DEFINE_PER_CPU(int, bpf_prog_active);
46 47
static DEFINE_IDR(prog_idr);
static DEFINE_SPINLOCK(prog_idr_lock);
48 49
static DEFINE_IDR(map_idr);
static DEFINE_SPINLOCK(map_idr_lock);
50 51
static DEFINE_IDR(link_idr);
static DEFINE_SPINLOCK(link_idr_lock);
52

53 54
int sysctl_unprivileged_bpf_disabled __read_mostly;

55
static const struct bpf_map_ops * const bpf_map_types[] = {
56
#define BPF_PROG_TYPE(_id, _name, prog_ctx_type, kern_ctx_type)
57 58
#define BPF_MAP_TYPE(_id, _ops) \
	[_id] = &_ops,
59
#define BPF_LINK_TYPE(_id, _name)
60 61 62
#include <linux/bpf_types.h>
#undef BPF_PROG_TYPE
#undef BPF_MAP_TYPE
63
#undef BPF_LINK_TYPE
64
};
65

66 67 68 69 70 71 72 73 74
/*
 * If we're handed a bigger struct than we know of, ensure all the unknown bits
 * are 0 - i.e. new user-space does not rely on any kernel feature extensions
 * we don't know about yet.
 *
 * There is a ToCToU between this function call and the following
 * copy_from_user() call. However, this is not a concern since this function is
 * meant to be a future-proofing of bits.
 */
75
int bpf_check_uarg_tail_zero(bpfptr_t uaddr,
76 77
			     size_t expected_size,
			     size_t actual_size)
78
{
79
	int res;
80

81 82 83
	if (unlikely(actual_size > PAGE_SIZE))	/* silly large */
		return -E2BIG;

84 85 86
	if (actual_size <= expected_size)
		return 0;

87 88 89 90 91 92
	if (uaddr.is_kernel)
		res = memchr_inv(uaddr.kernel + expected_size, 0,
				 actual_size - expected_size) == NULL;
	else
		res = check_zeroed_user(uaddr.user + expected_size,
					actual_size - expected_size);
93 94 95
	if (res < 0)
		return res;
	return res ? 0 : -E2BIG;
96 97
}

98
const struct bpf_map_ops bpf_map_offload_ops = {
99
	.map_meta_equal = bpf_map_meta_equal,
100 101
	.map_alloc = bpf_map_offload_map_alloc,
	.map_free = bpf_map_offload_map_free,
102
	.map_check_btf = map_check_no_btf,
103 104
};

105 106
static struct bpf_map *find_and_alloc_map(union bpf_attr *attr)
{
107
	const struct bpf_map_ops *ops;
108
	u32 type = attr->map_type;
109
	struct bpf_map *map;
110
	int err;
111

112
	if (type >= ARRAY_SIZE(bpf_map_types))
113
		return ERR_PTR(-EINVAL);
114 115
	type = array_index_nospec(type, ARRAY_SIZE(bpf_map_types));
	ops = bpf_map_types[type];
116
	if (!ops)
117
		return ERR_PTR(-EINVAL);
118

119 120 121 122 123
	if (ops->map_alloc_check) {
		err = ops->map_alloc_check(attr);
		if (err)
			return ERR_PTR(err);
	}
124 125
	if (attr->map_ifindex)
		ops = &bpf_map_offload_ops;
126
	map = ops->map_alloc(attr);
127 128
	if (IS_ERR(map))
		return map;
129
	map->ops = ops;
130
	map->map_type = type;
131
	return map;
132 133
}

134
static u32 bpf_map_value_size(const struct bpf_map *map)
135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168
{
	if (map->map_type == BPF_MAP_TYPE_PERCPU_HASH ||
	    map->map_type == BPF_MAP_TYPE_LRU_PERCPU_HASH ||
	    map->map_type == BPF_MAP_TYPE_PERCPU_ARRAY ||
	    map->map_type == BPF_MAP_TYPE_PERCPU_CGROUP_STORAGE)
		return round_up(map->value_size, 8) * num_possible_cpus();
	else if (IS_FD_MAP(map))
		return sizeof(u32);
	else
		return  map->value_size;
}

static void maybe_wait_bpf_programs(struct bpf_map *map)
{
	/* Wait for any running BPF programs to complete so that
	 * userspace, when we return to it, knows that all programs
	 * that could be running use the new map value.
	 */
	if (map->map_type == BPF_MAP_TYPE_HASH_OF_MAPS ||
	    map->map_type == BPF_MAP_TYPE_ARRAY_OF_MAPS)
		synchronize_rcu();
}

static int bpf_map_update_value(struct bpf_map *map, struct fd f, void *key,
				void *value, __u64 flags)
{
	int err;

	/* Need to create a kthread, thus must support schedule */
	if (bpf_map_is_dev_bound(map)) {
		return bpf_map_offload_update_elem(map, key, value, flags);
	} else if (map->map_type == BPF_MAP_TYPE_CPUMAP ||
		   map->map_type == BPF_MAP_TYPE_STRUCT_OPS) {
		return map->ops->map_update_elem(map, key, value, flags);
169 170 171
	} else if (map->map_type == BPF_MAP_TYPE_SOCKHASH ||
		   map->map_type == BPF_MAP_TYPE_SOCKMAP) {
		return sock_map_update_elem_sys(map, key, value, flags);
172 173 174 175 176
	} else if (IS_FD_PROG_ARRAY(map)) {
		return bpf_fd_array_map_update_elem(map, f.file, key, value,
						    flags);
	}

177
	bpf_disable_instrumentation();
178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207
	if (map->map_type == BPF_MAP_TYPE_PERCPU_HASH ||
	    map->map_type == BPF_MAP_TYPE_LRU_PERCPU_HASH) {
		err = bpf_percpu_hash_update(map, key, value, flags);
	} else if (map->map_type == BPF_MAP_TYPE_PERCPU_ARRAY) {
		err = bpf_percpu_array_update(map, key, value, flags);
	} else if (map->map_type == BPF_MAP_TYPE_PERCPU_CGROUP_STORAGE) {
		err = bpf_percpu_cgroup_storage_update(map, key, value,
						       flags);
	} else if (IS_FD_ARRAY(map)) {
		rcu_read_lock();
		err = bpf_fd_array_map_update_elem(map, f.file, key, value,
						   flags);
		rcu_read_unlock();
	} else if (map->map_type == BPF_MAP_TYPE_HASH_OF_MAPS) {
		rcu_read_lock();
		err = bpf_fd_htab_map_update_elem(map, f.file, key, value,
						  flags);
		rcu_read_unlock();
	} else if (map->map_type == BPF_MAP_TYPE_REUSEPORT_SOCKARRAY) {
		/* rcu_read_lock() is not needed */
		err = bpf_fd_reuseport_array_update_elem(map, key, value,
							 flags);
	} else if (map->map_type == BPF_MAP_TYPE_QUEUE ||
		   map->map_type == BPF_MAP_TYPE_STACK) {
		err = map->ops->map_push_elem(map, value, flags);
	} else {
		rcu_read_lock();
		err = map->ops->map_update_elem(map, key, value, flags);
		rcu_read_unlock();
	}
208
	bpf_enable_instrumentation();
209 210 211 212 213 214 215 216 217 218 219
	maybe_wait_bpf_programs(map);

	return err;
}

static int bpf_map_copy_value(struct bpf_map *map, void *key, void *value,
			      __u64 flags)
{
	void *ptr;
	int err;

220 221
	if (bpf_map_is_dev_bound(map))
		return bpf_map_offload_lookup_elem(map, key, value);
222

223
	bpf_disable_instrumentation();
224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267
	if (map->map_type == BPF_MAP_TYPE_PERCPU_HASH ||
	    map->map_type == BPF_MAP_TYPE_LRU_PERCPU_HASH) {
		err = bpf_percpu_hash_copy(map, key, value);
	} else if (map->map_type == BPF_MAP_TYPE_PERCPU_ARRAY) {
		err = bpf_percpu_array_copy(map, key, value);
	} else if (map->map_type == BPF_MAP_TYPE_PERCPU_CGROUP_STORAGE) {
		err = bpf_percpu_cgroup_storage_copy(map, key, value);
	} else if (map->map_type == BPF_MAP_TYPE_STACK_TRACE) {
		err = bpf_stackmap_copy(map, key, value);
	} else if (IS_FD_ARRAY(map) || IS_FD_PROG_ARRAY(map)) {
		err = bpf_fd_array_map_lookup_elem(map, key, value);
	} else if (IS_FD_HASH(map)) {
		err = bpf_fd_htab_map_lookup_elem(map, key, value);
	} else if (map->map_type == BPF_MAP_TYPE_REUSEPORT_SOCKARRAY) {
		err = bpf_fd_reuseport_array_lookup_elem(map, key, value);
	} else if (map->map_type == BPF_MAP_TYPE_QUEUE ||
		   map->map_type == BPF_MAP_TYPE_STACK) {
		err = map->ops->map_peek_elem(map, value);
	} else if (map->map_type == BPF_MAP_TYPE_STRUCT_OPS) {
		/* struct_ops map requires directly updating "value" */
		err = bpf_struct_ops_map_sys_lookup_elem(map, key, value);
	} else {
		rcu_read_lock();
		if (map->ops->map_lookup_elem_sys_only)
			ptr = map->ops->map_lookup_elem_sys_only(map, key);
		else
			ptr = map->ops->map_lookup_elem(map, key);
		if (IS_ERR(ptr)) {
			err = PTR_ERR(ptr);
		} else if (!ptr) {
			err = -ENOENT;
		} else {
			err = 0;
			if (flags & BPF_F_LOCK)
				/* lock 'ptr' and copy everything but lock */
				copy_map_value_locked(map, value, ptr, true);
			else
				copy_map_value(map, value, ptr);
			/* mask lock, since value wasn't zero inited */
			check_and_init_map_lock(map, value);
		}
		rcu_read_unlock();
	}

268
	bpf_enable_instrumentation();
269 270 271 272 273
	maybe_wait_bpf_programs(map);

	return err;
}

274 275 276 277
/* Please, do not use this function outside from the map creation path
 * (e.g. in map update path) without taking care of setting the active
 * memory cgroup (see at bpf_map_kmalloc_node() for example).
 */
278
static void *__bpf_map_area_alloc(u64 size, int numa_node, bool mmapable)
279
{
280 281 282 283 284 285 286 287
	/* We really just want to fail instead of triggering OOM killer
	 * under memory pressure, therefore we set __GFP_NORETRY to kmalloc,
	 * which is used for lower order allocation requests.
	 *
	 * It has been observed that higher order allocation requests done by
	 * vmalloc with __GFP_NORETRY being set might fail due to not trying
	 * to reclaim memory from the page cache, thus we set
	 * __GFP_RETRY_MAYFAIL to avoid such situations.
288
	 */
289

290
	const gfp_t gfp = __GFP_NOWARN | __GFP_ZERO | __GFP_ACCOUNT;
291 292
	unsigned int flags = 0;
	unsigned long align = 1;
293 294
	void *area;

295 296 297
	if (size >= SIZE_MAX)
		return NULL;

298
	/* kmalloc()'ed memory can't be mmap()'ed */
299 300 301 302 303 304
	if (mmapable) {
		BUG_ON(!PAGE_ALIGNED(size));
		align = SHMLBA;
		flags = VM_USERMAP;
	} else if (size <= (PAGE_SIZE << PAGE_ALLOC_COSTLY_ORDER)) {
		area = kmalloc_node(size, gfp | GFP_USER | __GFP_NORETRY,
305
				    numa_node);
306 307 308
		if (area != NULL)
			return area;
	}
309 310 311 312

	return __vmalloc_node_range(size, align, VMALLOC_START, VMALLOC_END,
			gfp | GFP_KERNEL | __GFP_RETRY_MAYFAIL, PAGE_KERNEL,
			flags, numa_node, __builtin_return_address(0));
313 314
}

315
void *bpf_map_area_alloc(u64 size, int numa_node)
316 317 318 319
{
	return __bpf_map_area_alloc(size, numa_node, false);
}

320
void *bpf_map_area_mmapable_alloc(u64 size, int numa_node)
321 322 323 324
{
	return __bpf_map_area_alloc(size, numa_node, true);
}

325 326 327 328 329
void bpf_map_area_free(void *area)
{
	kvfree(area);
}

330 331 332 333 334 335 336 337 338 339 340 341
static u32 bpf_map_flags_retain_permanent(u32 flags)
{
	/* Some map creation flags are not tied to the map object but
	 * rather to the map fd instead, so they have no meaning upon
	 * map object inspection since multiple file descriptors with
	 * different (access) properties can exist here. Thus, given
	 * this has zero meaning for the map itself, lets clear these
	 * from here.
	 */
	return flags & ~(BPF_F_RDONLY | BPF_F_WRONLY);
}

342 343 344 345 346 347
void bpf_map_init_from_attr(struct bpf_map *map, union bpf_attr *attr)
{
	map->map_type = attr->map_type;
	map->key_size = attr->key_size;
	map->value_size = attr->value_size;
	map->max_entries = attr->max_entries;
348
	map->map_flags = bpf_map_flags_retain_permanent(attr->map_flags);
349 350 351
	map->numa_node = bpf_map_attr_numa_node(attr);
}

352 353 354 355
static int bpf_map_alloc_id(struct bpf_map *map)
{
	int id;

356
	idr_preload(GFP_KERNEL);
357 358 359 360 361
	spin_lock_bh(&map_idr_lock);
	id = idr_alloc_cyclic(&map_idr, map, 1, INT_MAX, GFP_ATOMIC);
	if (id > 0)
		map->id = id;
	spin_unlock_bh(&map_idr_lock);
362
	idr_preload_end();
363 364 365 366 367 368 369

	if (WARN_ON_ONCE(!id))
		return -ENOSPC;

	return id > 0 ? 0 : id;
}

370
void bpf_map_free_id(struct bpf_map *map, bool do_idr_lock)
371
{
372 373
	unsigned long flags;

374 375 376 377 378 379 380 381
	/* Offloaded maps are removed from the IDR store when their device
	 * disappears - even if someone holds an fd to them they are unusable,
	 * the memory is gone, all ops will fail; they are simply waiting for
	 * refcnt to drop to be freed.
	 */
	if (!map->id)
		return;

382
	if (do_idr_lock)
383
		spin_lock_irqsave(&map_idr_lock, flags);
384 385 386
	else
		__acquire(&map_idr_lock);

387
	idr_remove(&map_idr, map->id);
388
	map->id = 0;
389 390

	if (do_idr_lock)
391
		spin_unlock_irqrestore(&map_idr_lock, flags);
392 393
	else
		__release(&map_idr_lock);
394 395
}

396 397 398 399 400 401 402 403 404 405 406 407 408 409 410 411 412 413 414 415 416 417 418 419 420 421 422 423 424 425 426 427 428 429 430 431 432 433 434 435 436 437 438 439 440 441 442 443 444 445 446 447 448 449 450 451 452 453 454
#ifdef CONFIG_MEMCG_KMEM
static void bpf_map_save_memcg(struct bpf_map *map)
{
	map->memcg = get_mem_cgroup_from_mm(current->mm);
}

static void bpf_map_release_memcg(struct bpf_map *map)
{
	mem_cgroup_put(map->memcg);
}

void *bpf_map_kmalloc_node(const struct bpf_map *map, size_t size, gfp_t flags,
			   int node)
{
	struct mem_cgroup *old_memcg;
	void *ptr;

	old_memcg = set_active_memcg(map->memcg);
	ptr = kmalloc_node(size, flags | __GFP_ACCOUNT, node);
	set_active_memcg(old_memcg);

	return ptr;
}

void *bpf_map_kzalloc(const struct bpf_map *map, size_t size, gfp_t flags)
{
	struct mem_cgroup *old_memcg;
	void *ptr;

	old_memcg = set_active_memcg(map->memcg);
	ptr = kzalloc(size, flags | __GFP_ACCOUNT);
	set_active_memcg(old_memcg);

	return ptr;
}

void __percpu *bpf_map_alloc_percpu(const struct bpf_map *map, size_t size,
				    size_t align, gfp_t flags)
{
	struct mem_cgroup *old_memcg;
	void __percpu *ptr;

	old_memcg = set_active_memcg(map->memcg);
	ptr = __alloc_percpu_gfp(size, align, flags | __GFP_ACCOUNT);
	set_active_memcg(old_memcg);

	return ptr;
}

#else
static void bpf_map_save_memcg(struct bpf_map *map)
{
}

static void bpf_map_release_memcg(struct bpf_map *map)
{
}
#endif

455 456 457 458 459
/* called from workqueue */
static void bpf_map_free_deferred(struct work_struct *work)
{
	struct bpf_map *map = container_of(work, struct bpf_map, work);

460
	security_bpf_map_free(map);
461
	bpf_map_release_memcg(map);
462 463 464 465
	/* implementation dependent freeing */
	map->ops->map_free(map);
}

466 467
static void bpf_map_put_uref(struct bpf_map *map)
{
468
	if (atomic64_dec_and_test(&map->usercnt)) {
469 470
		if (map->ops->map_release_uref)
			map->ops->map_release_uref(map);
471 472 473
	}
}

474 475 476
/* decrement map refcnt and schedule it for freeing via workqueue
 * (unrelying map implementation ops->map_free() might sleep)
 */
477
static void __bpf_map_put(struct bpf_map *map, bool do_idr_lock)
478
{
479
	if (atomic64_dec_and_test(&map->refcnt)) {
480
		/* bpf_map_free_id() must be called first */
481
		bpf_map_free_id(map, do_idr_lock);
482
		btf_put(map->btf);
483 484 485 486 487
		INIT_WORK(&map->work, bpf_map_free_deferred);
		schedule_work(&map->work);
	}
}

488 489 490 491
void bpf_map_put(struct bpf_map *map)
{
	__bpf_map_put(map, true);
}
492
EXPORT_SYMBOL_GPL(bpf_map_put);
493

494
void bpf_map_put_with_uref(struct bpf_map *map)
495
{
496
	bpf_map_put_uref(map);
497
	bpf_map_put(map);
498 499 500 501
}

static int bpf_map_release(struct inode *inode, struct file *filp)
{
502 503 504 505 506 507
	struct bpf_map *map = filp->private_data;

	if (map->ops->map_release)
		map->ops->map_release(map, filp);

	bpf_map_put_with_uref(map);
508 509 510
	return 0;
}

511 512 513 514 515 516 517 518 519 520 521 522
static fmode_t map_get_sys_perms(struct bpf_map *map, struct fd f)
{
	fmode_t mode = f.file->f_mode;

	/* Our file permissions may have been overridden by global
	 * map permissions facing syscall side.
	 */
	if (READ_ONCE(map->frozen))
		mode &= ~FMODE_CAN_WRITE;
	return mode;
}

523
#ifdef CONFIG_PROC_FS
524 525 526 527 528 529 530 531 532 533 534 535 536
/* Provides an approximation of the map's memory footprint.
 * Used only to provide a backward compatibility and display
 * a reasonable "memlock" info.
 */
static unsigned long bpf_map_memory_footprint(const struct bpf_map *map)
{
	unsigned long size;

	size = round_up(map->key_size + bpf_map_value_size(map), 8);

	return round_up(map->max_entries * size, PAGE_SIZE);
}

537 538 539
static void bpf_map_show_fdinfo(struct seq_file *m, struct file *filp)
{
	const struct bpf_map *map = filp->private_data;
540
	const struct bpf_array *array;
541
	u32 type = 0, jited = 0;
542 543 544

	if (map->map_type == BPF_MAP_TYPE_PROG_ARRAY) {
		array = container_of(map, struct bpf_array, map);
545 546
		type  = array->aux->type;
		jited = array->aux->jited;
547
	}
548 549 550 551 552

	seq_printf(m,
		   "map_type:\t%u\n"
		   "key_size:\t%u\n"
		   "value_size:\t%u\n"
553
		   "max_entries:\t%u\n"
554
		   "map_flags:\t%#x\n"
555
		   "memlock:\t%lu\n"
556 557
		   "map_id:\t%u\n"
		   "frozen:\t%u\n",
558 559 560
		   map->map_type,
		   map->key_size,
		   map->value_size,
561
		   map->max_entries,
562
		   map->map_flags,
563
		   bpf_map_memory_footprint(map),
564 565
		   map->id,
		   READ_ONCE(map->frozen));
566 567 568
	if (type) {
		seq_printf(m, "owner_prog_type:\t%u\n", type);
		seq_printf(m, "owner_jited:\t%u\n", jited);
569
	}
570 571 572
}
#endif

573 574 575 576 577 578 579 580 581 582 583 584 585 586 587 588 589 590
static ssize_t bpf_dummy_read(struct file *filp, char __user *buf, size_t siz,
			      loff_t *ppos)
{
	/* We need this handler such that alloc_file() enables
	 * f_mode with FMODE_CAN_READ.
	 */
	return -EINVAL;
}

static ssize_t bpf_dummy_write(struct file *filp, const char __user *buf,
			       size_t siz, loff_t *ppos)
{
	/* We need this handler such that alloc_file() enables
	 * f_mode with FMODE_CAN_WRITE.
	 */
	return -EINVAL;
}

591 592 593 594 595
/* called for any extra memory-mapped regions (except initial) */
static void bpf_map_mmap_open(struct vm_area_struct *vma)
{
	struct bpf_map *map = vma->vm_file->private_data;

596
	if (vma->vm_flags & VM_MAYWRITE) {
597 598 599 600 601 602 603 604 605 606 607
		mutex_lock(&map->freeze_mutex);
		map->writecnt++;
		mutex_unlock(&map->freeze_mutex);
	}
}

/* called for all unmapped memory region (including initial) */
static void bpf_map_mmap_close(struct vm_area_struct *vma)
{
	struct bpf_map *map = vma->vm_file->private_data;

608
	if (vma->vm_flags & VM_MAYWRITE) {
609 610 611 612 613 614 615 616 617 618 619 620 621 622 623 624 625 626 627 628 629 630 631 632
		mutex_lock(&map->freeze_mutex);
		map->writecnt--;
		mutex_unlock(&map->freeze_mutex);
	}
}

static const struct vm_operations_struct bpf_map_default_vmops = {
	.open		= bpf_map_mmap_open,
	.close		= bpf_map_mmap_close,
};

static int bpf_map_mmap(struct file *filp, struct vm_area_struct *vma)
{
	struct bpf_map *map = filp->private_data;
	int err;

	if (!map->ops->map_mmap || map_value_has_spin_lock(map))
		return -ENOTSUPP;

	if (!(vma->vm_flags & VM_SHARED))
		return -EINVAL;

	mutex_lock(&map->freeze_mutex);

633 634 635 636 637 638 639 640 641 642 643 644 645 646
	if (vma->vm_flags & VM_WRITE) {
		if (map->frozen) {
			err = -EPERM;
			goto out;
		}
		/* map is meant to be read-only, so do not allow mapping as
		 * writable, because it's possible to leak a writable page
		 * reference and allows user-space to still modify it after
		 * freezing, while verifier will assume contents do not change
		 */
		if (map->map_flags & BPF_F_RDONLY_PROG) {
			err = -EACCES;
			goto out;
		}
647 648 649 650 651
	}

	/* set default open/close callbacks */
	vma->vm_ops = &bpf_map_default_vmops;
	vma->vm_private_data = map;
652 653 654 655
	vma->vm_flags &= ~VM_MAYEXEC;
	if (!(vma->vm_flags & VM_WRITE))
		/* disallow re-mapping with PROT_WRITE */
		vma->vm_flags &= ~VM_MAYWRITE;
656 657 658 659 660

	err = map->ops->map_mmap(map, vma);
	if (err)
		goto out;

661
	if (vma->vm_flags & VM_MAYWRITE)
662 663 664 665 666 667
		map->writecnt++;
out:
	mutex_unlock(&map->freeze_mutex);
	return err;
}

668 669 670 671 672 673 674 675 676 677
static __poll_t bpf_map_poll(struct file *filp, struct poll_table_struct *pts)
{
	struct bpf_map *map = filp->private_data;

	if (map->ops->map_poll)
		return map->ops->map_poll(map, filp, pts);

	return EPOLLERR;
}

678
const struct file_operations bpf_map_fops = {
679 680 681 682
#ifdef CONFIG_PROC_FS
	.show_fdinfo	= bpf_map_show_fdinfo,
#endif
	.release	= bpf_map_release,
683 684
	.read		= bpf_dummy_read,
	.write		= bpf_dummy_write,
685
	.mmap		= bpf_map_mmap,
686
	.poll		= bpf_map_poll,
687 688
};

689
int bpf_map_new_fd(struct bpf_map *map, int flags)
690
{
691 692 693 694 695 696
	int ret;

	ret = security_bpf_map(map, OPEN_FMODE(flags));
	if (ret < 0)
		return ret;

697
	return anon_inode_getfd("bpf-map", &bpf_map_fops, map,
698 699 700 701 702 703 704 705 706 707 708 709
				flags | O_CLOEXEC);
}

int bpf_get_file_flag(int flags)
{
	if ((flags & BPF_F_RDONLY) && (flags & BPF_F_WRONLY))
		return -EINVAL;
	if (flags & BPF_F_RDONLY)
		return O_RDONLY;
	if (flags & BPF_F_WRONLY)
		return O_WRONLY;
	return O_RDWR;
710 711
}

712 713 714 715 716 717 718 719
/* helper macro to check that unused fields 'union bpf_attr' are zero */
#define CHECK_ATTR(CMD) \
	memchr_inv((void *) &attr->CMD##_LAST_FIELD + \
		   sizeof(attr->CMD##_LAST_FIELD), 0, \
		   sizeof(*attr) - \
		   offsetof(union bpf_attr, CMD##_LAST_FIELD) - \
		   sizeof(attr->CMD##_LAST_FIELD)) != NULL

720 721
/* dst and src must have at least "size" number of bytes.
 * Return strlen on success and < 0 on error.
722
 */
723
int bpf_obj_name_cpy(char *dst, const char *src, unsigned int size)
724
{
725 726
	const char *end = src + size;
	const char *orig_src = src;
727

728
	memset(dst, 0, size);
729
	/* Copy all isalnum(), '_' and '.' chars. */
730
	while (src < end && *src) {
731 732
		if (!isalnum(*src) &&
		    *src != '_' && *src != '.')
733 734 735 736
			return -EINVAL;
		*dst++ = *src++;
	}

737
	/* No '\0' found in "size" number of bytes */
738 739 740
	if (src == end)
		return -EINVAL;

741
	return src - orig_src;
742 743
}

744
int map_check_no_btf(const struct bpf_map *map,
745
		     const struct btf *btf,
746 747 748 749 750 751
		     const struct btf_type *key_type,
		     const struct btf_type *value_type)
{
	return -ENOTSUPP;
}

752
static int map_check_btf(struct bpf_map *map, const struct btf *btf,
753 754 755 756 757 758
			 u32 btf_key_id, u32 btf_value_id)
{
	const struct btf_type *key_type, *value_type;
	u32 key_size, value_size;
	int ret = 0;

759 760 761 762 763 764 765 766 767 768
	/* Some maps allow key to be unspecified. */
	if (btf_key_id) {
		key_type = btf_type_id_size(btf, &btf_key_id, &key_size);
		if (!key_type || key_size != map->key_size)
			return -EINVAL;
	} else {
		key_type = btf_type_by_id(btf, 0);
		if (!map->ops->map_check_btf)
			return -EINVAL;
	}
769 770 771 772 773

	value_type = btf_type_id_size(btf, &btf_value_id, &value_size);
	if (!value_type || value_size != map->value_size)
		return -EINVAL;

774 775 776
	map->spin_lock_off = btf_find_spin_lock(btf, value_type);

	if (map_value_has_spin_lock(map)) {
777 778
		if (map->map_flags & BPF_F_RDONLY_PROG)
			return -EACCES;
779
		if (map->map_type != BPF_MAP_TYPE_HASH &&
780
		    map->map_type != BPF_MAP_TYPE_ARRAY &&
781
		    map->map_type != BPF_MAP_TYPE_CGROUP_STORAGE &&
782
		    map->map_type != BPF_MAP_TYPE_SK_STORAGE &&
783 784
		    map->map_type != BPF_MAP_TYPE_INODE_STORAGE &&
		    map->map_type != BPF_MAP_TYPE_TASK_STORAGE)
785 786 787 788 789 790 791 792 793 794
			return -ENOTSUPP;
		if (map->spin_lock_off + sizeof(struct bpf_spin_lock) >
		    map->value_size) {
			WARN_ONCE(1,
				  "verifier bug spin_lock_off %d value_size %d\n",
				  map->spin_lock_off, map->value_size);
			return -EFAULT;
		}
	}

795
	if (map->ops->map_check_btf)
796
		ret = map->ops->map_check_btf(map, btf, key_type, value_type);
797 798 799 800

	return ret;
}

801
#define BPF_MAP_CREATE_LAST_FIELD btf_vmlinux_value_type_id
802 803 804
/* called via syscall */
static int map_create(union bpf_attr *attr)
{
805
	int numa_node = bpf_map_attr_numa_node(attr);
806
	struct bpf_map *map;
807
	int f_flags;
808 809 810 811 812 813
	int err;

	err = CHECK_ATTR(BPF_MAP_CREATE);
	if (err)
		return -EINVAL;

814 815 816 817 818 819 820 821
	if (attr->btf_vmlinux_value_type_id) {
		if (attr->map_type != BPF_MAP_TYPE_STRUCT_OPS ||
		    attr->btf_key_type_id || attr->btf_value_type_id)
			return -EINVAL;
	} else if (attr->btf_key_type_id && !attr->btf_value_type_id) {
		return -EINVAL;
	}

822 823 824 825
	f_flags = bpf_get_file_flag(attr->map_flags);
	if (f_flags < 0)
		return f_flags;

826
	if (numa_node != NUMA_NO_NODE &&
827 828
	    ((unsigned int)numa_node >= nr_node_ids ||
	     !node_online(numa_node)))
829 830
		return -EINVAL;

831 832 833 834 835
	/* find map type and init map: hashtable vs rbtree vs bloom vs ... */
	map = find_and_alloc_map(attr);
	if (IS_ERR(map))
		return PTR_ERR(map);

836 837 838
	err = bpf_obj_name_cpy(map->name, attr->map_name,
			       sizeof(attr->map_name));
	if (err < 0)
839
		goto free_map;
840

841 842
	atomic64_set(&map->refcnt, 1);
	atomic64_set(&map->usercnt, 1);
843
	mutex_init(&map->freeze_mutex);
844

845 846 847 848 849 850 851 852 853
	map->spin_lock_off = -EINVAL;
	if (attr->btf_key_type_id || attr->btf_value_type_id ||
	    /* Even the map's value is a kernel's struct,
	     * the bpf_prog.o must have BTF to begin with
	     * to figure out the corresponding kernel's
	     * counter part.  Thus, attr->btf_fd has
	     * to be valid also.
	     */
	    attr->btf_vmlinux_value_type_id) {
854 855 856 857 858
		struct btf *btf;

		btf = btf_get_by_fd(attr->btf_fd);
		if (IS_ERR(btf)) {
			err = PTR_ERR(btf);
859
			goto free_map;
860
		}
861 862 863 864 865
		if (btf_is_kernel(btf)) {
			btf_put(btf);
			err = -EACCES;
			goto free_map;
		}
866
		map->btf = btf;
867

868 869 870 871 872
		if (attr->btf_value_type_id) {
			err = map_check_btf(map, btf, attr->btf_key_type_id,
					    attr->btf_value_type_id);
			if (err)
				goto free_map;
873 874
		}

875 876
		map->btf_key_type_id = attr->btf_key_type_id;
		map->btf_value_type_id = attr->btf_value_type_id;
877 878
		map->btf_vmlinux_value_type_id =
			attr->btf_vmlinux_value_type_id;
879 880
	}

881
	err = security_bpf_map_alloc(map);
882
	if (err)
883
		goto free_map;
884

885 886
	err = bpf_map_alloc_id(map);
	if (err)
887
		goto free_map_sec;
888

889 890
	bpf_map_save_memcg(map);

891
	err = bpf_map_new_fd(map, f_flags);
892 893
	if (err < 0) {
		/* failed to allocate fd.
894
		 * bpf_map_put_with_uref() is needed because the above
895 896 897 898
		 * bpf_map_alloc_id() has published the map
		 * to the userspace and the userspace may
		 * have refcnt-ed it through BPF_MAP_GET_FD_BY_ID.
		 */
899
		bpf_map_put_with_uref(map);
900 901
		return err;
	}
902 903 904

	return err;

905 906
free_map_sec:
	security_bpf_map_free(map);
907
free_map:
908
	btf_put(map->btf);
909 910 911 912
	map->ops->map_free(map);
	return err;
}

913 914 915
/* if error is returned, fd is released.
 * On success caller should complete fd access with matching fdput()
 */
916
struct bpf_map *__bpf_map_get(struct fd f)
917 918 919 920 921 922 923 924
{
	if (!f.file)
		return ERR_PTR(-EBADF);
	if (f.file->f_op != &bpf_map_fops) {
		fdput(f);
		return ERR_PTR(-EINVAL);
	}

925 926 927
	return f.file->private_data;
}

928
void bpf_map_inc(struct bpf_map *map)
929
{
930
	atomic64_inc(&map->refcnt);
931
}
932
EXPORT_SYMBOL_GPL(bpf_map_inc);
933

934 935 936 937 938 939 940
void bpf_map_inc_with_uref(struct bpf_map *map)
{
	atomic64_inc(&map->refcnt);
	atomic64_inc(&map->usercnt);
}
EXPORT_SYMBOL_GPL(bpf_map_inc_with_uref);

941 942 943 944 945 946 947 948 949 950 951 952 953 954 955
struct bpf_map *bpf_map_get(u32 ufd)
{
	struct fd f = fdget(ufd);
	struct bpf_map *map;

	map = __bpf_map_get(f);
	if (IS_ERR(map))
		return map;

	bpf_map_inc(map);
	fdput(f);

	return map;
}

956
struct bpf_map *bpf_map_get_with_uref(u32 ufd)
957 958 959 960 961 962 963 964
{
	struct fd f = fdget(ufd);
	struct bpf_map *map;

	map = __bpf_map_get(f);
	if (IS_ERR(map))
		return map;

965
	bpf_map_inc_with_uref(map);
966
	fdput(f);
967 968 969 970

	return map;
}

971
/* map_idr_lock should have been held */
972
static struct bpf_map *__bpf_map_inc_not_zero(struct bpf_map *map, bool uref)
973 974 975
{
	int refold;

976
	refold = atomic64_fetch_add_unless(&map->refcnt, 1, 0);
977 978 979
	if (!refold)
		return ERR_PTR(-ENOENT);
	if (uref)
980
		atomic64_inc(&map->usercnt);
981 982 983 984

	return map;
}

985
struct bpf_map *bpf_map_inc_not_zero(struct bpf_map *map)
986 987
{
	spin_lock_bh(&map_idr_lock);
988
	map = __bpf_map_inc_not_zero(map, false);
989 990 991 992 993 994
	spin_unlock_bh(&map_idr_lock);

	return map;
}
EXPORT_SYMBOL_GPL(bpf_map_inc_not_zero);

995 996 997 998 999
int __weak bpf_stackmap_copy(struct bpf_map *map, void *key, void *value)
{
	return -ENOTSUPP;
}

1000 1001 1002 1003 1004 1005 1006 1007 1008 1009 1010
static void *__bpf_copy_key(void __user *ukey, u64 key_size)
{
	if (key_size)
		return memdup_user(ukey, key_size);

	if (ukey)
		return ERR_PTR(-EINVAL);

	return NULL;
}

1011 1012 1013 1014 1015 1016 1017 1018 1019 1020 1021
static void *___bpf_copy_key(bpfptr_t ukey, u64 key_size)
{
	if (key_size)
		return memdup_bpfptr(ukey, key_size);

	if (!bpfptr_is_null(ukey))
		return ERR_PTR(-EINVAL);

	return NULL;
}

1022
/* last field in 'union bpf_attr' used by this command */
1023
#define BPF_MAP_LOOKUP_ELEM_LAST_FIELD flags
1024 1025 1026

static int map_lookup_elem(union bpf_attr *attr)
{
1027 1028
	void __user *ukey = u64_to_user_ptr(attr->key);
	void __user *uvalue = u64_to_user_ptr(attr->value);
1029 1030
	int ufd = attr->map_fd;
	struct bpf_map *map;
1031
	void *key, *value;
1032
	u32 value_size;
1033
	struct fd f;
1034 1035 1036 1037 1038
	int err;

	if (CHECK_ATTR(BPF_MAP_LOOKUP_ELEM))
		return -EINVAL;

1039 1040 1041
	if (attr->flags & ~BPF_F_LOCK)
		return -EINVAL;

1042
	f = fdget(ufd);
1043
	map = __bpf_map_get(f);
1044 1045
	if (IS_ERR(map))
		return PTR_ERR(map);
1046
	if (!(map_get_sys_perms(map, f) & FMODE_CAN_READ)) {
1047 1048 1049 1050
		err = -EPERM;
		goto err_put;
	}

1051 1052 1053 1054 1055 1056
	if ((attr->flags & BPF_F_LOCK) &&
	    !map_value_has_spin_lock(map)) {
		err = -EINVAL;
		goto err_put;
	}

1057
	key = __bpf_copy_key(ukey, map->key_size);
1058 1059
	if (IS_ERR(key)) {
		err = PTR_ERR(key);
1060
		goto err_put;
1061
	}
1062

1063
	value_size = bpf_map_value_size(map);
1064

1065
	err = -ENOMEM;
1066
	value = kmalloc(value_size, GFP_USER | __GFP_NOWARN);
1067
	if (!value)
1068 1069
		goto free_key;

1070
	err = bpf_map_copy_value(map, key, value, attr->flags);
1071
	if (err)
1072
		goto free_value;
1073 1074

	err = -EFAULT;
1075
	if (copy_to_user(uvalue, value, value_size) != 0)
1076
		goto free_value;
1077 1078 1079

	err = 0;

1080 1081
free_value:
	kfree(value);
1082 1083 1084 1085 1086 1087 1088
free_key:
	kfree(key);
err_put:
	fdput(f);
	return err;
}

1089

1090
#define BPF_MAP_UPDATE_ELEM_LAST_FIELD flags
1091

1092
static int map_update_elem(union bpf_attr *attr, bpfptr_t uattr)
1093
{
1094 1095
	bpfptr_t ukey = make_bpfptr(attr->key, uattr.is_kernel);
	bpfptr_t uvalue = make_bpfptr(attr->value, uattr.is_kernel);
1096 1097 1098
	int ufd = attr->map_fd;
	struct bpf_map *map;
	void *key, *value;
1099
	u32 value_size;
1100
	struct fd f;
1101 1102 1103 1104 1105
	int err;

	if (CHECK_ATTR(BPF_MAP_UPDATE_ELEM))
		return -EINVAL;

1106
	f = fdget(ufd);
1107
	map = __bpf_map_get(f);
1108 1109
	if (IS_ERR(map))
		return PTR_ERR(map);
1110
	if (!(map_get_sys_perms(map, f) & FMODE_CAN_WRITE)) {
1111 1112 1113 1114
		err = -EPERM;
		goto err_put;
	}

1115 1116 1117 1118 1119 1120
	if ((attr->flags & BPF_F_LOCK) &&
	    !map_value_has_spin_lock(map)) {
		err = -EINVAL;
		goto err_put;
	}

1121
	key = ___bpf_copy_key(ukey, map->key_size);
1122 1123
	if (IS_ERR(key)) {
		err = PTR_ERR(key);
1124
		goto err_put;
1125
	}
1126

1127
	if (map->map_type == BPF_MAP_TYPE_PERCPU_HASH ||
1128
	    map->map_type == BPF_MAP_TYPE_LRU_PERCPU_HASH ||
1129 1130
	    map->map_type == BPF_MAP_TYPE_PERCPU_ARRAY ||
	    map->map_type == BPF_MAP_TYPE_PERCPU_CGROUP_STORAGE)
1131 1132 1133 1134
		value_size = round_up(map->value_size, 8) * num_possible_cpus();
	else
		value_size = map->value_size;

1135
	err = -ENOMEM;
1136
	value = kmalloc(value_size, GFP_USER | __GFP_NOWARN);
1137 1138 1139 1140
	if (!value)
		goto free_key;

	err = -EFAULT;
1141
	if (copy_from_bpfptr(value, uvalue, value_size) != 0)
1142 1143
		goto free_value;

1144
	err = bpf_map_update_value(map, f, key, value, attr->flags);
1145

1146 1147 1148 1149 1150 1151 1152 1153 1154 1155 1156 1157 1158
free_value:
	kfree(value);
free_key:
	kfree(key);
err_put:
	fdput(f);
	return err;
}

#define BPF_MAP_DELETE_ELEM_LAST_FIELD key

static int map_delete_elem(union bpf_attr *attr)
{
1159
	void __user *ukey = u64_to_user_ptr(attr->key);
1160 1161
	int ufd = attr->map_fd;
	struct bpf_map *map;
1162
	struct fd f;
1163 1164 1165 1166 1167 1168
	void *key;
	int err;

	if (CHECK_ATTR(BPF_MAP_DELETE_ELEM))
		return -EINVAL;

1169
	f = fdget(ufd);
1170
	map = __bpf_map_get(f);
1171 1172
	if (IS_ERR(map))
		return PTR_ERR(map);
1173
	if (!(map_get_sys_perms(map, f) & FMODE_CAN_WRITE)) {
1174 1175 1176 1177
		err = -EPERM;
		goto err_put;
	}

1178
	key = __bpf_copy_key(ukey, map->key_size);
1179 1180
	if (IS_ERR(key)) {
		err = PTR_ERR(key);
1181
		goto err_put;
1182
	}
1183

1184 1185 1186
	if (bpf_map_is_dev_bound(map)) {
		err = bpf_map_offload_delete_elem(map, key);
		goto out;
1187 1188 1189
	} else if (IS_FD_PROG_ARRAY(map) ||
		   map->map_type == BPF_MAP_TYPE_STRUCT_OPS) {
		/* These maps require sleepable context */
1190 1191
		err = map->ops->map_delete_elem(map, key);
		goto out;
1192 1193
	}

1194
	bpf_disable_instrumentation();
1195 1196 1197
	rcu_read_lock();
	err = map->ops->map_delete_elem(map, key);
	rcu_read_unlock();
1198
	bpf_enable_instrumentation();
1199
	maybe_wait_bpf_programs(map);
1200
out:
1201 1202 1203 1204 1205 1206 1207 1208 1209 1210 1211
	kfree(key);
err_put:
	fdput(f);
	return err;
}

/* last field in 'union bpf_attr' used by this command */
#define BPF_MAP_GET_NEXT_KEY_LAST_FIELD next_key

static int map_get_next_key(union bpf_attr *attr)
{
1212 1213
	void __user *ukey = u64_to_user_ptr(attr->key);
	void __user *unext_key = u64_to_user_ptr(attr->next_key);
1214 1215 1216
	int ufd = attr->map_fd;
	struct bpf_map *map;
	void *key, *next_key;
1217
	struct fd f;
1218 1219 1220 1221 1222
	int err;

	if (CHECK_ATTR(BPF_MAP_GET_NEXT_KEY))
		return -EINVAL;

1223
	f = fdget(ufd);
1224
	map = __bpf_map_get(f);
1225 1226
	if (IS_ERR(map))
		return PTR_ERR(map);
1227
	if (!(map_get_sys_perms(map, f) & FMODE_CAN_READ)) {
1228 1229 1230 1231
		err = -EPERM;
		goto err_put;
	}

1232
	if (ukey) {
1233
		key = __bpf_copy_key(ukey, map->key_size);
1234 1235
		if (IS_ERR(key)) {
			err = PTR_ERR(key);
1236
			goto err_put;
1237
		}
1238 1239 1240
	} else {
		key = NULL;
	}
1241 1242 1243 1244 1245 1246

	err = -ENOMEM;
	next_key = kmalloc(map->key_size, GFP_USER);
	if (!next_key)
		goto free_key;

1247 1248 1249 1250 1251
	if (bpf_map_is_dev_bound(map)) {
		err = bpf_map_offload_get_next_key(map, key, next_key);
		goto out;
	}

1252 1253 1254
	rcu_read_lock();
	err = map->ops->map_get_next_key(map, key, next_key);
	rcu_read_unlock();
1255
out:
1256 1257 1258 1259 1260 1261 1262 1263 1264 1265 1266 1267 1268 1269 1270 1271 1272 1273
	if (err)
		goto free_next_key;

	err = -EFAULT;
	if (copy_to_user(unext_key, next_key, map->key_size) != 0)
		goto free_next_key;

	err = 0;

free_next_key:
	kfree(next_key);
free_key:
	kfree(key);
err_put:
	fdput(f);
	return err;
}

1274 1275 1276 1277 1278 1279 1280 1281 1282 1283 1284 1285 1286 1287 1288 1289 1290 1291 1292 1293 1294
int generic_map_delete_batch(struct bpf_map *map,
			     const union bpf_attr *attr,
			     union bpf_attr __user *uattr)
{
	void __user *keys = u64_to_user_ptr(attr->batch.keys);
	u32 cp, max_count;
	int err = 0;
	void *key;

	if (attr->batch.elem_flags & ~BPF_F_LOCK)
		return -EINVAL;

	if ((attr->batch.elem_flags & BPF_F_LOCK) &&
	    !map_value_has_spin_lock(map)) {
		return -EINVAL;
	}

	max_count = attr->batch.count;
	if (!max_count)
		return 0;

1295 1296 1297 1298
	key = kmalloc(map->key_size, GFP_USER | __GFP_NOWARN);
	if (!key)
		return -ENOMEM;

1299
	for (cp = 0; cp < max_count; cp++) {
1300 1301 1302
		err = -EFAULT;
		if (copy_from_user(key, keys + cp * map->key_size,
				   map->key_size))
1303 1304 1305 1306 1307 1308 1309
			break;

		if (bpf_map_is_dev_bound(map)) {
			err = bpf_map_offload_delete_elem(map, key);
			break;
		}

1310
		bpf_disable_instrumentation();
1311 1312 1313
		rcu_read_lock();
		err = map->ops->map_delete_elem(map, key);
		rcu_read_unlock();
1314
		bpf_enable_instrumentation();
1315 1316 1317 1318 1319 1320
		maybe_wait_bpf_programs(map);
		if (err)
			break;
	}
	if (copy_to_user(&uattr->batch.count, &cp, sizeof(cp)))
		err = -EFAULT;
1321 1322

	kfree(key);
1323 1324 1325 1326 1327 1328 1329 1330 1331 1332 1333 1334 1335 1336 1337 1338 1339 1340 1341 1342 1343 1344 1345 1346 1347 1348 1349 1350 1351 1352
	return err;
}

int generic_map_update_batch(struct bpf_map *map,
			     const union bpf_attr *attr,
			     union bpf_attr __user *uattr)
{
	void __user *values = u64_to_user_ptr(attr->batch.values);
	void __user *keys = u64_to_user_ptr(attr->batch.keys);
	u32 value_size, cp, max_count;
	int ufd = attr->map_fd;
	void *key, *value;
	struct fd f;
	int err = 0;

	f = fdget(ufd);
	if (attr->batch.elem_flags & ~BPF_F_LOCK)
		return -EINVAL;

	if ((attr->batch.elem_flags & BPF_F_LOCK) &&
	    !map_value_has_spin_lock(map)) {
		return -EINVAL;
	}

	value_size = bpf_map_value_size(map);

	max_count = attr->batch.count;
	if (!max_count)
		return 0;

1353 1354 1355 1356
	key = kmalloc(map->key_size, GFP_USER | __GFP_NOWARN);
	if (!key)
		return -ENOMEM;

1357
	value = kmalloc(value_size, GFP_USER | __GFP_NOWARN);
1358 1359
	if (!value) {
		kfree(key);
1360
		return -ENOMEM;
1361
	}
1362 1363 1364

	for (cp = 0; cp < max_count; cp++) {
		err = -EFAULT;
1365 1366 1367
		if (copy_from_user(key, keys + cp * map->key_size,
		    map->key_size) ||
		    copy_from_user(value, values + cp * value_size, value_size))
1368 1369 1370 1371 1372 1373 1374 1375 1376 1377 1378 1379 1380 1381 1382 1383 1384
			break;

		err = bpf_map_update_value(map, f, key, value,
					   attr->batch.elem_flags);

		if (err)
			break;
	}

	if (copy_to_user(&uattr->batch.count, &cp, sizeof(cp)))
		err = -EFAULT;

	kfree(value);
	kfree(key);
	return err;
}

1385 1386 1387 1388 1389 1390 1391 1392 1393 1394 1395 1396 1397 1398 1399 1400 1401 1402 1403 1404 1405 1406 1407 1408 1409 1410 1411 1412 1413 1414 1415 1416 1417 1418 1419 1420
#define MAP_LOOKUP_RETRIES 3

int generic_map_lookup_batch(struct bpf_map *map,
				    const union bpf_attr *attr,
				    union bpf_attr __user *uattr)
{
	void __user *uobatch = u64_to_user_ptr(attr->batch.out_batch);
	void __user *ubatch = u64_to_user_ptr(attr->batch.in_batch);
	void __user *values = u64_to_user_ptr(attr->batch.values);
	void __user *keys = u64_to_user_ptr(attr->batch.keys);
	void *buf, *buf_prevkey, *prev_key, *key, *value;
	int err, retry = MAP_LOOKUP_RETRIES;
	u32 value_size, cp, max_count;

	if (attr->batch.elem_flags & ~BPF_F_LOCK)
		return -EINVAL;

	if ((attr->batch.elem_flags & BPF_F_LOCK) &&
	    !map_value_has_spin_lock(map))
		return -EINVAL;

	value_size = bpf_map_value_size(map);

	max_count = attr->batch.count;
	if (!max_count)
		return 0;

	if (put_user(0, &uattr->batch.count))
		return -EFAULT;

	buf_prevkey = kmalloc(map->key_size, GFP_USER | __GFP_NOWARN);
	if (!buf_prevkey)
		return -ENOMEM;

	buf = kmalloc(map->key_size + value_size, GFP_USER | __GFP_NOWARN);
	if (!buf) {
1421
		kfree(buf_prevkey);
1422 1423 1424 1425 1426 1427 1428 1429 1430 1431 1432 1433 1434 1435 1436 1437 1438 1439 1440 1441 1442 1443 1444 1445 1446 1447 1448 1449 1450 1451 1452 1453 1454 1455 1456 1457 1458 1459 1460 1461 1462 1463 1464 1465 1466 1467 1468 1469 1470 1471 1472 1473 1474 1475 1476 1477 1478 1479 1480 1481 1482 1483 1484 1485
		return -ENOMEM;
	}

	err = -EFAULT;
	prev_key = NULL;
	if (ubatch && copy_from_user(buf_prevkey, ubatch, map->key_size))
		goto free_buf;
	key = buf;
	value = key + map->key_size;
	if (ubatch)
		prev_key = buf_prevkey;

	for (cp = 0; cp < max_count;) {
		rcu_read_lock();
		err = map->ops->map_get_next_key(map, prev_key, key);
		rcu_read_unlock();
		if (err)
			break;
		err = bpf_map_copy_value(map, key, value,
					 attr->batch.elem_flags);

		if (err == -ENOENT) {
			if (retry) {
				retry--;
				continue;
			}
			err = -EINTR;
			break;
		}

		if (err)
			goto free_buf;

		if (copy_to_user(keys + cp * map->key_size, key,
				 map->key_size)) {
			err = -EFAULT;
			goto free_buf;
		}
		if (copy_to_user(values + cp * value_size, value, value_size)) {
			err = -EFAULT;
			goto free_buf;
		}

		if (!prev_key)
			prev_key = buf_prevkey;

		swap(prev_key, key);
		retry = MAP_LOOKUP_RETRIES;
		cp++;
	}

	if (err == -EFAULT)
		goto free_buf;

	if ((copy_to_user(&uattr->batch.count, &cp, sizeof(cp)) ||
		    (cp && copy_to_user(uobatch, prev_key, map->key_size))))
		err = -EFAULT;

free_buf:
	kfree(buf_prevkey);
	kfree(buf);
	return err;
}

1486 1487 1488 1489 1490 1491 1492 1493
#define BPF_MAP_LOOKUP_AND_DELETE_ELEM_LAST_FIELD value

static int map_lookup_and_delete_elem(union bpf_attr *attr)
{
	void __user *ukey = u64_to_user_ptr(attr->key);
	void __user *uvalue = u64_to_user_ptr(attr->value);
	int ufd = attr->map_fd;
	struct bpf_map *map;
1494
	void *key, *value;
1495 1496 1497 1498 1499 1500 1501 1502 1503 1504 1505
	u32 value_size;
	struct fd f;
	int err;

	if (CHECK_ATTR(BPF_MAP_LOOKUP_AND_DELETE_ELEM))
		return -EINVAL;

	f = fdget(ufd);
	map = __bpf_map_get(f);
	if (IS_ERR(map))
		return PTR_ERR(map);
1506 1507
	if (!(map_get_sys_perms(map, f) & FMODE_CAN_READ) ||
	    !(map_get_sys_perms(map, f) & FMODE_CAN_WRITE)) {
1508 1509 1510 1511 1512 1513 1514 1515 1516 1517 1518 1519 1520 1521 1522 1523 1524 1525 1526 1527 1528 1529 1530 1531 1532 1533 1534
		err = -EPERM;
		goto err_put;
	}

	key = __bpf_copy_key(ukey, map->key_size);
	if (IS_ERR(key)) {
		err = PTR_ERR(key);
		goto err_put;
	}

	value_size = map->value_size;

	err = -ENOMEM;
	value = kmalloc(value_size, GFP_USER | __GFP_NOWARN);
	if (!value)
		goto free_key;

	if (map->map_type == BPF_MAP_TYPE_QUEUE ||
	    map->map_type == BPF_MAP_TYPE_STACK) {
		err = map->ops->map_pop_elem(map, value);
	} else {
		err = -ENOTSUPP;
	}

	if (err)
		goto free_value;

1535 1536
	if (copy_to_user(uvalue, value, value_size) != 0) {
		err = -EFAULT;
1537
		goto free_value;
1538
	}
1539 1540 1541 1542 1543 1544 1545 1546 1547 1548 1549 1550

	err = 0;

free_value:
	kfree(value);
free_key:
	kfree(key);
err_put:
	fdput(f);
	return err;
}

1551 1552 1553 1554 1555 1556 1557 1558 1559 1560 1561 1562 1563 1564 1565
#define BPF_MAP_FREEZE_LAST_FIELD map_fd

static int map_freeze(const union bpf_attr *attr)
{
	int err = 0, ufd = attr->map_fd;
	struct bpf_map *map;
	struct fd f;

	if (CHECK_ATTR(BPF_MAP_FREEZE))
		return -EINVAL;

	f = fdget(ufd);
	map = __bpf_map_get(f);
	if (IS_ERR(map))
		return PTR_ERR(map);
1566

1567 1568 1569 1570 1571
	if (map->map_type == BPF_MAP_TYPE_STRUCT_OPS) {
		fdput(f);
		return -ENOTSUPP;
	}

1572 1573 1574 1575 1576 1577
	mutex_lock(&map->freeze_mutex);

	if (map->writecnt) {
		err = -EBUSY;
		goto err_put;
	}
1578 1579 1580 1581
	if (READ_ONCE(map->frozen)) {
		err = -EBUSY;
		goto err_put;
	}
1582
	if (!bpf_capable()) {
1583 1584 1585 1586 1587 1588
		err = -EPERM;
		goto err_put;
	}

	WRITE_ONCE(map->frozen, true);
err_put:
1589
	mutex_unlock(&map->freeze_mutex);
1590 1591 1592 1593
	fdput(f);
	return err;
}

1594
static const struct bpf_prog_ops * const bpf_prog_types[] = {
1595
#define BPF_PROG_TYPE(_id, _name, prog_ctx_type, kern_ctx_type) \
1596 1597
	[_id] = & _name ## _prog_ops,
#define BPF_MAP_TYPE(_id, _ops)
1598
#define BPF_LINK_TYPE(_id, _name)
1599 1600 1601
#include <linux/bpf_types.h>
#undef BPF_PROG_TYPE
#undef BPF_MAP_TYPE
1602
#undef BPF_LINK_TYPE
1603 1604
};

1605 1606
static int find_prog_type(enum bpf_prog_type type, struct bpf_prog *prog)
{
1607 1608 1609 1610 1611 1612 1613
	const struct bpf_prog_ops *ops;

	if (type >= ARRAY_SIZE(bpf_prog_types))
		return -EINVAL;
	type = array_index_nospec(type, ARRAY_SIZE(bpf_prog_types));
	ops = bpf_prog_types[type];
	if (!ops)
1614
		return -EINVAL;
1615

1616
	if (!bpf_prog_is_dev_bound(prog->aux))
1617
		prog->aux->ops = ops;
1618 1619
	else
		prog->aux->ops = &bpf_offload_prog_ops;
1620 1621
	prog->type = type;
	return 0;
1622 1623
}

1624 1625 1626 1627 1628 1629 1630 1631 1632 1633 1634 1635 1636 1637 1638 1639 1640 1641 1642 1643 1644 1645 1646 1647 1648 1649 1650 1651 1652 1653
enum bpf_audit {
	BPF_AUDIT_LOAD,
	BPF_AUDIT_UNLOAD,
	BPF_AUDIT_MAX,
};

static const char * const bpf_audit_str[BPF_AUDIT_MAX] = {
	[BPF_AUDIT_LOAD]   = "LOAD",
	[BPF_AUDIT_UNLOAD] = "UNLOAD",
};

static void bpf_audit_prog(const struct bpf_prog *prog, unsigned int op)
{
	struct audit_context *ctx = NULL;
	struct audit_buffer *ab;

	if (WARN_ON_ONCE(op >= BPF_AUDIT_MAX))
		return;
	if (audit_enabled == AUDIT_OFF)
		return;
	if (op == BPF_AUDIT_LOAD)
		ctx = audit_context();
	ab = audit_log_start(ctx, GFP_ATOMIC, AUDIT_BPF);
	if (unlikely(!ab))
		return;
	audit_log_format(ab, "prog-id=%u op=%s",
			 prog->aux->id, bpf_audit_str[op]);
	audit_log_end(ab);
}

1654 1655 1656 1657
static int bpf_prog_alloc_id(struct bpf_prog *prog)
{
	int id;

1658
	idr_preload(GFP_KERNEL);
1659 1660 1661 1662 1663
	spin_lock_bh(&prog_idr_lock);
	id = idr_alloc_cyclic(&prog_idr, prog, 1, INT_MAX, GFP_ATOMIC);
	if (id > 0)
		prog->aux->id = id;
	spin_unlock_bh(&prog_idr_lock);
1664
	idr_preload_end();
1665 1666 1667 1668 1669 1670 1671 1672

	/* id is in [1, INT_MAX) */
	if (WARN_ON_ONCE(!id))
		return -ENOSPC;

	return id > 0 ? 0 : id;
}

1673
void bpf_prog_free_id(struct bpf_prog *prog, bool do_idr_lock)
1674
{
1675 1676 1677 1678 1679
	/* cBPF to eBPF migrations are currently not in the idr store.
	 * Offloaded programs are removed from the store when their device
	 * disappears - even if someone grabs an fd to them they are unusable,
	 * simply waiting for refcnt to drop to be freed.
	 */
1680 1681 1682
	if (!prog->aux->id)
		return;

1683 1684 1685 1686 1687
	if (do_idr_lock)
		spin_lock_bh(&prog_idr_lock);
	else
		__acquire(&prog_idr_lock);

1688
	idr_remove(&prog_idr, prog->aux->id);
1689
	prog->aux->id = 0;
1690 1691 1692 1693 1694

	if (do_idr_lock)
		spin_unlock_bh(&prog_idr_lock);
	else
		__release(&prog_idr_lock);
1695 1696
}

1697
static void __bpf_prog_put_rcu(struct rcu_head *rcu)
1698 1699 1700
{
	struct bpf_prog_aux *aux = container_of(rcu, struct bpf_prog_aux, rcu);

1701
	kvfree(aux->func_info);
1702
	kfree(aux->func_info_aux);
1703
	free_uid(aux->user);
1704
	security_bpf_prog_free(aux);
1705 1706 1707
	bpf_prog_free(aux->prog);
}

1708 1709 1710 1711
static void __bpf_prog_put_noref(struct bpf_prog *prog, bool deferred)
{
	bpf_prog_kallsyms_del_all(prog);
	btf_put(prog->aux->btf);
1712 1713
	kvfree(prog->aux->jited_linfo);
	kvfree(prog->aux->linfo);
1714
	kfree(prog->aux->kfunc_tab);
1715 1716
	if (prog->aux->attach_btf)
		btf_put(prog->aux->attach_btf);
1717

1718 1719 1720 1721 1722 1723
	if (deferred) {
		if (prog->aux->sleepable)
			call_rcu_tasks_trace(&prog->aux->rcu, __bpf_prog_put_rcu);
		else
			call_rcu(&prog->aux->rcu, __bpf_prog_put_rcu);
	} else {
1724
		__bpf_prog_put_rcu(&prog->aux->rcu);
1725
	}
1726 1727
}

1728
static void __bpf_prog_put(struct bpf_prog *prog, bool do_idr_lock)
1729
{
1730
	if (atomic64_dec_and_test(&prog->aux->refcnt)) {
1731
		perf_event_bpf_event(prog, PERF_BPF_EVENT_PROG_UNLOAD, 0);
1732
		bpf_audit_prog(prog, BPF_AUDIT_UNLOAD);
1733
		/* bpf_prog_free_id() must be called first */
1734
		bpf_prog_free_id(prog, do_idr_lock);
1735
		__bpf_prog_put_noref(prog, true);
1736
	}
1737
}
1738 1739 1740 1741 1742

void bpf_prog_put(struct bpf_prog *prog)
{
	__bpf_prog_put(prog, true);
}
1743
EXPORT_SYMBOL_GPL(bpf_prog_put);
1744 1745 1746 1747 1748

static int bpf_prog_release(struct inode *inode, struct file *filp)
{
	struct bpf_prog *prog = filp->private_data;

1749
	bpf_prog_put(prog);
1750 1751 1752
	return 0;
}

1753 1754 1755
static void bpf_prog_get_stats(const struct bpf_prog *prog,
			       struct bpf_prog_stats *stats)
{
1756
	u64 nsecs = 0, cnt = 0, misses = 0;
1757 1758 1759 1760 1761
	int cpu;

	for_each_possible_cpu(cpu) {
		const struct bpf_prog_stats *st;
		unsigned int start;
1762
		u64 tnsecs, tcnt, tmisses;
1763

1764
		st = per_cpu_ptr(prog->stats, cpu);
1765 1766 1767 1768
		do {
			start = u64_stats_fetch_begin_irq(&st->syncp);
			tnsecs = st->nsecs;
			tcnt = st->cnt;
1769
			tmisses = st->misses;
1770 1771 1772
		} while (u64_stats_fetch_retry_irq(&st->syncp, start));
		nsecs += tnsecs;
		cnt += tcnt;
1773
		misses += tmisses;
1774 1775 1776
	}
	stats->nsecs = nsecs;
	stats->cnt = cnt;
1777
	stats->misses = misses;
1778 1779
}

1780 1781 1782 1783
#ifdef CONFIG_PROC_FS
static void bpf_prog_show_fdinfo(struct seq_file *m, struct file *filp)
{
	const struct bpf_prog *prog = filp->private_data;
1784
	char prog_tag[sizeof(prog->tag) * 2 + 1] = { };
1785
	struct bpf_prog_stats stats;
1786

1787
	bpf_prog_get_stats(prog, &stats);
1788
	bin2hex(prog_tag, prog->tag, sizeof(prog->tag));
1789 1790 1791
	seq_printf(m,
		   "prog_type:\t%u\n"
		   "prog_jited:\t%u\n"
1792
		   "prog_tag:\t%s\n"
1793
		   "memlock:\t%llu\n"
1794 1795
		   "prog_id:\t%u\n"
		   "run_time_ns:\t%llu\n"
1796 1797
		   "run_cnt:\t%llu\n"
		   "recursion_misses:\t%llu\n",
1798 1799
		   prog->type,
		   prog->jited,
1800
		   prog_tag,
1801
		   prog->pages * 1ULL << PAGE_SHIFT,
1802 1803
		   prog->aux->id,
		   stats.nsecs,
1804 1805
		   stats.cnt,
		   stats.misses);
1806 1807 1808
}
#endif

1809
const struct file_operations bpf_prog_fops = {
1810 1811 1812 1813
#ifdef CONFIG_PROC_FS
	.show_fdinfo	= bpf_prog_show_fdinfo,
#endif
	.release	= bpf_prog_release,
1814 1815
	.read		= bpf_dummy_read,
	.write		= bpf_dummy_write,
1816 1817
};

1818
int bpf_prog_new_fd(struct bpf_prog *prog)
1819
{
1820 1821 1822 1823 1824 1825
	int ret;

	ret = security_bpf_prog(prog);
	if (ret < 0)
		return ret;

1826 1827 1828 1829
	return anon_inode_getfd("bpf-prog", &bpf_prog_fops, prog,
				O_RDWR | O_CLOEXEC);
}

1830
static struct bpf_prog *____bpf_prog_get(struct fd f)
1831 1832 1833 1834 1835 1836 1837 1838
{
	if (!f.file)
		return ERR_PTR(-EBADF);
	if (f.file->f_op != &bpf_prog_fops) {
		fdput(f);
		return ERR_PTR(-EINVAL);
	}

1839
	return f.file->private_data;
1840 1841
}

1842
void bpf_prog_add(struct bpf_prog *prog, int i)
1843
{
1844
	atomic64_add(i, &prog->aux->refcnt);
1845
}
1846 1847
EXPORT_SYMBOL_GPL(bpf_prog_add);

1848 1849 1850 1851 1852 1853 1854
void bpf_prog_sub(struct bpf_prog *prog, int i)
{
	/* Only to be used for undoing previous bpf_prog_add() in some
	 * error path. We still know that another entity in our call
	 * path holds a reference to the program, thus atomic_sub() can
	 * be safely used in such cases!
	 */
1855
	WARN_ON(atomic64_sub_return(i, &prog->aux->refcnt) == 0);
1856 1857 1858
}
EXPORT_SYMBOL_GPL(bpf_prog_sub);

1859
void bpf_prog_inc(struct bpf_prog *prog)
1860
{
1861
	atomic64_inc(&prog->aux->refcnt);
1862
}
1863
EXPORT_SYMBOL_GPL(bpf_prog_inc);
1864

1865
/* prog_idr_lock should have been held */
1866
struct bpf_prog *bpf_prog_inc_not_zero(struct bpf_prog *prog)
1867 1868 1869
{
	int refold;

1870
	refold = atomic64_fetch_add_unless(&prog->aux->refcnt, 1, 0);
1871 1872 1873 1874 1875 1876

	if (!refold)
		return ERR_PTR(-ENOENT);

	return prog;
}
1877
EXPORT_SYMBOL_GPL(bpf_prog_inc_not_zero);
1878

1879
bool bpf_prog_get_ok(struct bpf_prog *prog,
1880
			    enum bpf_prog_type *attach_type, bool attach_drv)
1881
{
1882 1883 1884
	/* not an attachment, just a refcount inc, always allow */
	if (!attach_type)
		return true;
1885 1886 1887

	if (prog->type != *attach_type)
		return false;
1888
	if (bpf_prog_is_dev_bound(prog->aux) && !attach_drv)
1889 1890 1891 1892 1893 1894
		return false;

	return true;
}

static struct bpf_prog *__bpf_prog_get(u32 ufd, enum bpf_prog_type *attach_type,
1895
				       bool attach_drv)
1896 1897 1898 1899
{
	struct fd f = fdget(ufd);
	struct bpf_prog *prog;

1900
	prog = ____bpf_prog_get(f);
1901 1902
	if (IS_ERR(prog))
		return prog;
1903
	if (!bpf_prog_get_ok(prog, attach_type, attach_drv)) {
1904 1905 1906
		prog = ERR_PTR(-EINVAL);
		goto out;
	}
1907

1908
	bpf_prog_inc(prog);
1909
out:
1910 1911 1912
	fdput(f);
	return prog;
}
1913 1914 1915

struct bpf_prog *bpf_prog_get(u32 ufd)
{
1916
	return __bpf_prog_get(ufd, NULL, false);
1917 1918
}

1919
struct bpf_prog *bpf_prog_get_type_dev(u32 ufd, enum bpf_prog_type type,
1920
				       bool attach_drv)
1921
{
1922
	return __bpf_prog_get(ufd, &type, attach_drv);
1923
}
1924
EXPORT_SYMBOL_GPL(bpf_prog_get_type_dev);
1925

1926 1927 1928 1929 1930 1931 1932 1933 1934 1935 1936 1937 1938 1939 1940 1941 1942 1943 1944 1945 1946 1947 1948 1949 1950 1951
/* Initially all BPF programs could be loaded w/o specifying
 * expected_attach_type. Later for some of them specifying expected_attach_type
 * at load time became required so that program could be validated properly.
 * Programs of types that are allowed to be loaded both w/ and w/o (for
 * backward compatibility) expected_attach_type, should have the default attach
 * type assigned to expected_attach_type for the latter case, so that it can be
 * validated later at attach time.
 *
 * bpf_prog_load_fixup_attach_type() sets expected_attach_type in @attr if
 * prog type requires it but has some attach types that have to be backward
 * compatible.
 */
static void bpf_prog_load_fixup_attach_type(union bpf_attr *attr)
{
	switch (attr->prog_type) {
	case BPF_PROG_TYPE_CGROUP_SOCK:
		/* Unfortunately BPF_ATTACH_TYPE_UNSPEC enumeration doesn't
		 * exist so checking for non-zero is the way to go here.
		 */
		if (!attr->expected_attach_type)
			attr->expected_attach_type =
				BPF_CGROUP_INET_SOCK_CREATE;
		break;
	}
}

1952
static int
1953 1954
bpf_prog_load_check_attach(enum bpf_prog_type prog_type,
			   enum bpf_attach_type expected_attach_type,
1955 1956
			   struct btf *attach_btf, u32 btf_id,
			   struct bpf_prog *dst_prog)
1957
{
1958
	if (btf_id) {
1959 1960
		if (btf_id > BTF_MAX_TYPE)
			return -EINVAL;
1961

1962 1963 1964
		if (!attach_btf && !dst_prog)
			return -EINVAL;

1965 1966
		switch (prog_type) {
		case BPF_PROG_TYPE_TRACING:
1967
		case BPF_PROG_TYPE_LSM:
1968
		case BPF_PROG_TYPE_STRUCT_OPS:
1969
		case BPF_PROG_TYPE_EXT:
1970 1971
			break;
		default:
1972
			return -EINVAL;
1973
		}
1974 1975
	}

1976 1977 1978 1979
	if (attach_btf && (!btf_id || dst_prog))
		return -EINVAL;

	if (dst_prog && prog_type != BPF_PROG_TYPE_TRACING &&
1980
	    prog_type != BPF_PROG_TYPE_EXT)
1981 1982
		return -EINVAL;

Andrey Ignatov's avatar
Andrey Ignatov committed
1983
	switch (prog_type) {
1984 1985 1986
	case BPF_PROG_TYPE_CGROUP_SOCK:
		switch (expected_attach_type) {
		case BPF_CGROUP_INET_SOCK_CREATE:
1987
		case BPF_CGROUP_INET_SOCK_RELEASE:
1988 1989 1990 1991 1992 1993
		case BPF_CGROUP_INET4_POST_BIND:
		case BPF_CGROUP_INET6_POST_BIND:
			return 0;
		default:
			return -EINVAL;
		}
Andrey Ignatov's avatar
Andrey Ignatov committed
1994 1995 1996 1997
	case BPF_PROG_TYPE_CGROUP_SOCK_ADDR:
		switch (expected_attach_type) {
		case BPF_CGROUP_INET4_BIND:
		case BPF_CGROUP_INET6_BIND:
1998 1999
		case BPF_CGROUP_INET4_CONNECT:
		case BPF_CGROUP_INET6_CONNECT:
2000 2001 2002 2003
		case BPF_CGROUP_INET4_GETPEERNAME:
		case BPF_CGROUP_INET6_GETPEERNAME:
		case BPF_CGROUP_INET4_GETSOCKNAME:
		case BPF_CGROUP_INET6_GETSOCKNAME:
2004 2005
		case BPF_CGROUP_UDP4_SENDMSG:
		case BPF_CGROUP_UDP6_SENDMSG:
2006 2007
		case BPF_CGROUP_UDP4_RECVMSG:
		case BPF_CGROUP_UDP6_RECVMSG:
Andrey Ignatov's avatar
Andrey Ignatov committed
2008 2009 2010 2011
			return 0;
		default:
			return -EINVAL;
		}
2012 2013 2014 2015 2016 2017 2018 2019
	case BPF_PROG_TYPE_CGROUP_SKB:
		switch (expected_attach_type) {
		case BPF_CGROUP_INET_INGRESS:
		case BPF_CGROUP_INET_EGRESS:
			return 0;
		default:
			return -EINVAL;
		}
2020 2021 2022 2023 2024 2025 2026 2027
	case BPF_PROG_TYPE_CGROUP_SOCKOPT:
		switch (expected_attach_type) {
		case BPF_CGROUP_SETSOCKOPT:
		case BPF_CGROUP_GETSOCKOPT:
			return 0;
		default:
			return -EINVAL;
		}
2028 2029 2030 2031
	case BPF_PROG_TYPE_SK_LOOKUP:
		if (expected_attach_type == BPF_SK_LOOKUP)
			return 0;
		return -EINVAL;
2032
	case BPF_PROG_TYPE_SYSCALL:
2033 2034 2035
	case BPF_PROG_TYPE_EXT:
		if (expected_attach_type)
			return -EINVAL;
2036
		fallthrough;
Andrey Ignatov's avatar
Andrey Ignatov committed
2037 2038 2039
	default:
		return 0;
	}
2040 2041
}

2042 2043 2044 2045 2046 2047 2048 2049 2050 2051 2052 2053 2054 2055 2056 2057 2058 2059 2060 2061 2062 2063 2064 2065 2066 2067 2068 2069 2070 2071 2072 2073 2074 2075 2076 2077 2078 2079 2080 2081 2082 2083 2084 2085 2086 2087 2088 2089 2090
static bool is_net_admin_prog_type(enum bpf_prog_type prog_type)
{
	switch (prog_type) {
	case BPF_PROG_TYPE_SCHED_CLS:
	case BPF_PROG_TYPE_SCHED_ACT:
	case BPF_PROG_TYPE_XDP:
	case BPF_PROG_TYPE_LWT_IN:
	case BPF_PROG_TYPE_LWT_OUT:
	case BPF_PROG_TYPE_LWT_XMIT:
	case BPF_PROG_TYPE_LWT_SEG6LOCAL:
	case BPF_PROG_TYPE_SK_SKB:
	case BPF_PROG_TYPE_SK_MSG:
	case BPF_PROG_TYPE_LIRC_MODE2:
	case BPF_PROG_TYPE_FLOW_DISSECTOR:
	case BPF_PROG_TYPE_CGROUP_DEVICE:
	case BPF_PROG_TYPE_CGROUP_SOCK:
	case BPF_PROG_TYPE_CGROUP_SOCK_ADDR:
	case BPF_PROG_TYPE_CGROUP_SOCKOPT:
	case BPF_PROG_TYPE_CGROUP_SYSCTL:
	case BPF_PROG_TYPE_SOCK_OPS:
	case BPF_PROG_TYPE_EXT: /* extends any prog */
		return true;
	case BPF_PROG_TYPE_CGROUP_SKB:
		/* always unpriv */
	case BPF_PROG_TYPE_SK_REUSEPORT:
		/* equivalent to SOCKET_FILTER. need CAP_BPF only */
	default:
		return false;
	}
}

static bool is_perfmon_prog_type(enum bpf_prog_type prog_type)
{
	switch (prog_type) {
	case BPF_PROG_TYPE_KPROBE:
	case BPF_PROG_TYPE_TRACEPOINT:
	case BPF_PROG_TYPE_PERF_EVENT:
	case BPF_PROG_TYPE_RAW_TRACEPOINT:
	case BPF_PROG_TYPE_RAW_TRACEPOINT_WRITABLE:
	case BPF_PROG_TYPE_TRACING:
	case BPF_PROG_TYPE_LSM:
	case BPF_PROG_TYPE_STRUCT_OPS: /* has access to struct sock */
	case BPF_PROG_TYPE_EXT: /* extends any prog */
		return true;
	default:
		return false;
	}
}

2091
/* last field in 'union bpf_attr' used by this command */
Alexei Starovoitov's avatar
Alexei Starovoitov committed
2092
#define	BPF_PROG_LOAD_LAST_FIELD fd_array
2093

2094
static int bpf_prog_load(union bpf_attr *attr, bpfptr_t uattr)
2095 2096
{
	enum bpf_prog_type type = attr->prog_type;
2097 2098
	struct bpf_prog *prog, *dst_prog = NULL;
	struct btf *attach_btf = NULL;
2099 2100 2101 2102 2103 2104 2105
	int err;
	char license[128];
	bool is_gpl;

	if (CHECK_ATTR(BPF_PROG_LOAD))
		return -EINVAL;

2106 2107
	if (attr->prog_flags & ~(BPF_F_STRICT_ALIGNMENT |
				 BPF_F_ANY_ALIGNMENT |
2108
				 BPF_F_TEST_STATE_FREQ |
2109
				 BPF_F_SLEEPABLE |
2110
				 BPF_F_TEST_RND_HI32))
2111 2112
		return -EINVAL;

2113 2114
	if (!IS_ENABLED(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS) &&
	    (attr->prog_flags & BPF_F_ANY_ALIGNMENT) &&
2115
	    !bpf_capable())
2116 2117
		return -EPERM;

2118
	/* copy eBPF program license from user space */
2119 2120 2121
	if (strncpy_from_bpfptr(license,
				make_bpfptr(attr->license, uattr.is_kernel),
				sizeof(license) - 1) < 0)
2122 2123 2124 2125 2126 2127
		return -EFAULT;
	license[sizeof(license) - 1] = 0;

	/* eBPF programs must be GPL compatible to use GPL-ed functions */
	is_gpl = license_is_gpl_compatible(license);

2128
	if (attr->insn_cnt == 0 ||
2129
	    attr->insn_cnt > (bpf_capable() ? BPF_COMPLEXITY_LIMIT_INSNS : BPF_MAXINSNS))
2130
		return -E2BIG;
2131 2132
	if (type != BPF_PROG_TYPE_SOCKET_FILTER &&
	    type != BPF_PROG_TYPE_CGROUP_SKB &&
2133 2134 2135
	    !bpf_capable())
		return -EPERM;

2136
	if (is_net_admin_prog_type(type) && !capable(CAP_NET_ADMIN) && !capable(CAP_SYS_ADMIN))
2137 2138
		return -EPERM;
	if (is_perfmon_prog_type(type) && !perfmon_capable())
2139 2140
		return -EPERM;

2141 2142 2143 2144 2145 2146 2147 2148 2149 2150 2151
	/* attach_prog_fd/attach_btf_obj_fd can specify fd of either bpf_prog
	 * or btf, we need to check which one it is
	 */
	if (attr->attach_prog_fd) {
		dst_prog = bpf_prog_get(attr->attach_prog_fd);
		if (IS_ERR(dst_prog)) {
			dst_prog = NULL;
			attach_btf = btf_get_by_fd(attr->attach_btf_obj_fd);
			if (IS_ERR(attach_btf))
				return -EINVAL;
			if (!btf_is_kernel(attach_btf)) {
2152 2153 2154
				/* attaching through specifying bpf_prog's BTF
				 * objects directly might be supported eventually
				 */
2155
				btf_put(attach_btf);
2156
				return -ENOTSUPP;
2157 2158 2159 2160 2161 2162 2163 2164 2165 2166 2167 2168
			}
		}
	} else if (attr->attach_btf_id) {
		/* fall back to vmlinux BTF, if BTF type ID is specified */
		attach_btf = bpf_get_btf_vmlinux();
		if (IS_ERR(attach_btf))
			return PTR_ERR(attach_btf);
		if (!attach_btf)
			return -EINVAL;
		btf_get(attach_btf);
	}

2169
	bpf_prog_load_fixup_attach_type(attr);
2170
	if (bpf_prog_load_check_attach(type, attr->expected_attach_type,
2171 2172 2173 2174 2175 2176
				       attach_btf, attr->attach_btf_id,
				       dst_prog)) {
		if (dst_prog)
			bpf_prog_put(dst_prog);
		if (attach_btf)
			btf_put(attach_btf);
2177
		return -EINVAL;
2178
	}
2179

2180 2181
	/* plain bpf_prog allocation */
	prog = bpf_prog_alloc(bpf_prog_size(attr->insn_cnt), GFP_USER);
2182 2183 2184 2185 2186
	if (!prog) {
		if (dst_prog)
			bpf_prog_put(dst_prog);
		if (attach_btf)
			btf_put(attach_btf);
2187
		return -ENOMEM;
2188
	}
2189

2190
	prog->expected_attach_type = attr->expected_attach_type;
2191
	prog->aux->attach_btf = attach_btf;
2192
	prog->aux->attach_btf_id = attr->attach_btf_id;
2193
	prog->aux->dst_prog = dst_prog;
2194
	prog->aux->offload_requested = !!attr->prog_ifindex;
2195
	prog->aux->sleepable = attr->prog_flags & BPF_F_SLEEPABLE;
2196

2197
	err = security_bpf_prog_alloc(prog->aux);
2198
	if (err)
2199
		goto free_prog;
2200

2201
	prog->aux->user = get_current_user();
2202 2203 2204
	prog->len = attr->insn_cnt;

	err = -EFAULT;
2205 2206 2207
	if (copy_from_bpfptr(prog->insns,
			     make_bpfptr(attr->insns, uattr.is_kernel),
			     bpf_prog_insn_size(prog)) != 0)
2208
		goto free_prog_sec;
2209 2210

	prog->orig_prog = NULL;
2211
	prog->jited = 0;
2212

2213
	atomic64_set(&prog->aux->refcnt, 1);
2214
	prog->gpl_compatible = is_gpl ? 1 : 0;
2215

2216
	if (bpf_prog_is_dev_bound(prog->aux)) {
2217 2218
		err = bpf_prog_offload_init(prog, attr);
		if (err)
2219
			goto free_prog_sec;
2220 2221
	}

2222 2223 2224
	/* find program type: socket_filter vs tracing_filter */
	err = find_prog_type(type, prog);
	if (err < 0)
2225
		goto free_prog_sec;
2226

2227
	prog->aux->load_time = ktime_get_boottime_ns();
2228 2229 2230
	err = bpf_obj_name_cpy(prog->aux->name, attr->prog_name,
			       sizeof(attr->prog_name));
	if (err < 0)
2231
		goto free_prog_sec;
2232

2233
	/* run eBPF verifier */
2234
	err = bpf_check(&prog, attr, uattr);
2235 2236 2237
	if (err < 0)
		goto free_used_maps;

2238
	prog = bpf_prog_select_runtime(prog, &err);
2239 2240
	if (err < 0)
		goto free_used_maps;
2241

2242 2243 2244 2245
	err = bpf_prog_alloc_id(prog);
	if (err)
		goto free_used_maps;

2246 2247 2248 2249 2250 2251 2252 2253 2254 2255 2256 2257 2258 2259
	/* Upon success of bpf_prog_alloc_id(), the BPF prog is
	 * effectively publicly exposed. However, retrieving via
	 * bpf_prog_get_fd_by_id() will take another reference,
	 * therefore it cannot be gone underneath us.
	 *
	 * Only for the time /after/ successful bpf_prog_new_fd()
	 * and before returning to userspace, we might just hold
	 * one reference and any parallel close on that fd could
	 * rip everything out. Hence, below notifications must
	 * happen before bpf_prog_new_fd().
	 *
	 * Also, any failure handling from this point onwards must
	 * be using bpf_prog_put() given the program is exposed.
	 */
2260
	bpf_prog_kallsyms_add(prog);
2261
	perf_event_bpf_event(prog, PERF_BPF_EVENT_PROG_LOAD, 0);
2262
	bpf_audit_prog(prog, BPF_AUDIT_LOAD);
2263 2264 2265 2266

	err = bpf_prog_new_fd(prog);
	if (err < 0)
		bpf_prog_put(prog);
2267 2268 2269
	return err;

free_used_maps:
2270 2271 2272 2273 2274 2275
	/* In case we have subprogs, we need to wait for a grace
	 * period before we can tear down JIT memory since symbols
	 * are already exposed under kallsyms.
	 */
	__bpf_prog_put_noref(prog, prog->aux->func_cnt);
	return err;
2276
free_prog_sec:
2277
	free_uid(prog->aux->user);
2278
	security_bpf_prog_free(prog->aux);
2279
free_prog:
2280 2281
	if (prog->aux->attach_btf)
		btf_put(prog->aux->attach_btf);
2282 2283 2284 2285
	bpf_prog_free(prog);
	return err;
}

2286
#define BPF_OBJ_LAST_FIELD file_flags
2287 2288 2289

static int bpf_obj_pin(const union bpf_attr *attr)
{
2290
	if (CHECK_ATTR(BPF_OBJ) || attr->file_flags != 0)
2291 2292
		return -EINVAL;

2293
	return bpf_obj_pin_user(attr->bpf_fd, u64_to_user_ptr(attr->pathname));
2294 2295 2296 2297
}

static int bpf_obj_get(const union bpf_attr *attr)
{
2298 2299
	if (CHECK_ATTR(BPF_OBJ) || attr->bpf_fd != 0 ||
	    attr->file_flags & ~BPF_OBJ_FLAG_MASK)
2300 2301
		return -EINVAL;

2302 2303
	return bpf_obj_get_user(u64_to_user_ptr(attr->pathname),
				attr->file_flags);
2304 2305
}

2306
void bpf_link_init(struct bpf_link *link, enum bpf_link_type type,
2307
		   const struct bpf_link_ops *ops, struct bpf_prog *prog)
2308
{
2309
	atomic64_set(&link->refcnt, 1);
2310
	link->type = type;
2311
	link->id = 0;
2312 2313 2314 2315
	link->ops = ops;
	link->prog = prog;
}

2316 2317 2318 2319 2320 2321 2322 2323 2324 2325
static void bpf_link_free_id(int id)
{
	if (!id)
		return;

	spin_lock_bh(&link_idr_lock);
	idr_remove(&link_idr, id);
	spin_unlock_bh(&link_idr_lock);
}

2326 2327
/* Clean up bpf_link and corresponding anon_inode file and FD. After
 * anon_inode is created, bpf_link can't be just kfree()'d due to deferred
2328 2329 2330 2331
 * anon_inode's release() call. This helper marksbpf_link as
 * defunct, releases anon_inode file and puts reserved FD. bpf_prog's refcnt
 * is not decremented, it's the responsibility of a calling code that failed
 * to complete bpf_link initialization.
2332
 */
2333
void bpf_link_cleanup(struct bpf_link_primer *primer)
2334
{
2335 2336 2337 2338
	primer->link->prog = NULL;
	bpf_link_free_id(primer->id);
	fput(primer->file);
	put_unused_fd(primer->fd);
2339 2340
}

2341 2342 2343 2344 2345 2346 2347 2348
void bpf_link_inc(struct bpf_link *link)
{
	atomic64_inc(&link->refcnt);
}

/* bpf_link_free is guaranteed to be called from process context */
static void bpf_link_free(struct bpf_link *link)
{
2349
	bpf_link_free_id(link->id);
2350 2351 2352 2353 2354 2355 2356
	if (link->prog) {
		/* detach BPF program, clean up used resources */
		link->ops->release(link);
		bpf_prog_put(link->prog);
	}
	/* free bpf_link and its containing memory */
	link->ops->dealloc(link);
2357 2358 2359 2360 2361 2362 2363 2364 2365 2366 2367 2368 2369 2370 2371 2372 2373
}

static void bpf_link_put_deferred(struct work_struct *work)
{
	struct bpf_link *link = container_of(work, struct bpf_link, work);

	bpf_link_free(link);
}

/* bpf_link_put can be called from atomic context, but ensures that resources
 * are freed from process context
 */
void bpf_link_put(struct bpf_link *link)
{
	if (!atomic64_dec_and_test(&link->refcnt))
		return;

2374 2375 2376 2377 2378 2379
	if (in_atomic()) {
		INIT_WORK(&link->work, bpf_link_put_deferred);
		schedule_work(&link->work);
	} else {
		bpf_link_free(link);
	}
2380 2381 2382 2383 2384 2385 2386
}

static int bpf_link_release(struct inode *inode, struct file *filp)
{
	struct bpf_link *link = filp->private_data;

	bpf_link_put(link);
2387 2388 2389
	return 0;
}

2390
#ifdef CONFIG_PROC_FS
2391 2392 2393 2394 2395 2396 2397 2398 2399 2400
#define BPF_PROG_TYPE(_id, _name, prog_ctx_type, kern_ctx_type)
#define BPF_MAP_TYPE(_id, _ops)
#define BPF_LINK_TYPE(_id, _name) [_id] = #_name,
static const char *bpf_link_type_strs[] = {
	[BPF_LINK_TYPE_UNSPEC] = "<invalid>",
#include <linux/bpf_types.h>
};
#undef BPF_PROG_TYPE
#undef BPF_MAP_TYPE
#undef BPF_LINK_TYPE
2401 2402 2403 2404 2405 2406 2407 2408 2409 2410

static void bpf_link_show_fdinfo(struct seq_file *m, struct file *filp)
{
	const struct bpf_link *link = filp->private_data;
	const struct bpf_prog *prog = link->prog;
	char prog_tag[sizeof(prog->tag) * 2 + 1] = { };

	bin2hex(prog_tag, prog->tag, sizeof(prog->tag));
	seq_printf(m,
		   "link_type:\t%s\n"
2411
		   "link_id:\t%u\n"
2412 2413
		   "prog_tag:\t%s\n"
		   "prog_id:\t%u\n",
2414
		   bpf_link_type_strs[link->type],
2415
		   link->id,
2416 2417
		   prog_tag,
		   prog->aux->id);
2418 2419
	if (link->ops->show_fdinfo)
		link->ops->show_fdinfo(link, m);
2420 2421 2422
}
#endif

Zou Wei's avatar
Zou Wei committed
2423
static const struct file_operations bpf_link_fops = {
2424 2425 2426 2427
#ifdef CONFIG_PROC_FS
	.show_fdinfo	= bpf_link_show_fdinfo,
#endif
	.release	= bpf_link_release,
2428 2429 2430 2431
	.read		= bpf_dummy_read,
	.write		= bpf_dummy_write,
};

2432
static int bpf_link_alloc_id(struct bpf_link *link)
2433
{
2434
	int id;
2435

2436 2437 2438 2439 2440
	idr_preload(GFP_KERNEL);
	spin_lock_bh(&link_idr_lock);
	id = idr_alloc_cyclic(&link_idr, link, 1, INT_MAX, GFP_ATOMIC);
	spin_unlock_bh(&link_idr_lock);
	idr_preload_end();
2441

2442 2443 2444 2445 2446 2447 2448 2449 2450 2451 2452 2453 2454 2455 2456
	return id;
}

/* Prepare bpf_link to be exposed to user-space by allocating anon_inode file,
 * reserving unused FD and allocating ID from link_idr. This is to be paired
 * with bpf_link_settle() to install FD and ID and expose bpf_link to
 * user-space, if bpf_link is successfully attached. If not, bpf_link and
 * pre-allocated resources are to be freed with bpf_cleanup() call. All the
 * transient state is passed around in struct bpf_link_primer.
 * This is preferred way to create and initialize bpf_link, especially when
 * there are complicated and expensive operations inbetween creating bpf_link
 * itself and attaching it to BPF hook. By using bpf_link_prime() and
 * bpf_link_settle() kernel code using bpf_link doesn't have to perform
 * expensive (and potentially failing) roll back operations in a rare case
 * that file, FD, or ID can't be allocated.
2457
 */
2458
int bpf_link_prime(struct bpf_link *link, struct bpf_link_primer *primer)
2459 2460
{
	struct file *file;
2461
	int fd, id;
2462 2463 2464

	fd = get_unused_fd_flags(O_CLOEXEC);
	if (fd < 0)
2465
		return fd;
2466 2467


2468 2469 2470 2471 2472
	id = bpf_link_alloc_id(link);
	if (id < 0) {
		put_unused_fd(fd);
		return id;
	}
2473 2474 2475

	file = anon_inode_getfile("bpf_link", &bpf_link_fops, link, O_CLOEXEC);
	if (IS_ERR(file)) {
2476
		bpf_link_free_id(id);
2477
		put_unused_fd(fd);
2478
		return PTR_ERR(file);
2479 2480
	}

2481 2482 2483 2484 2485 2486 2487 2488 2489 2490 2491 2492 2493 2494 2495 2496 2497 2498 2499 2500 2501 2502
	primer->link = link;
	primer->file = file;
	primer->fd = fd;
	primer->id = id;
	return 0;
}

int bpf_link_settle(struct bpf_link_primer *primer)
{
	/* make bpf_link fetchable by ID */
	spin_lock_bh(&link_idr_lock);
	primer->link->id = primer->id;
	spin_unlock_bh(&link_idr_lock);
	/* make bpf_link fetchable by FD */
	fd_install(primer->fd, primer->file);
	/* pass through installed FD */
	return primer->fd;
}

int bpf_link_new_fd(struct bpf_link *link)
{
	return anon_inode_getfd("bpf-link", &bpf_link_fops, link, O_CLOEXEC);
2503 2504
}

2505 2506 2507 2508 2509 2510 2511 2512 2513 2514 2515 2516 2517 2518 2519 2520 2521 2522 2523 2524 2525
struct bpf_link *bpf_link_get_from_fd(u32 ufd)
{
	struct fd f = fdget(ufd);
	struct bpf_link *link;

	if (!f.file)
		return ERR_PTR(-EBADF);
	if (f.file->f_op != &bpf_link_fops) {
		fdput(f);
		return ERR_PTR(-EINVAL);
	}

	link = f.file->private_data;
	bpf_link_inc(link);
	fdput(f);

	return link;
}

struct bpf_tracing_link {
	struct bpf_link link;
2526
	enum bpf_attach_type attach_type;
2527 2528
	struct bpf_trampoline *trampoline;
	struct bpf_prog *tgt_prog;
2529 2530 2531
};

static void bpf_tracing_link_release(struct bpf_link *link)
2532
{
2533 2534 2535 2536 2537 2538 2539 2540 2541 2542 2543
	struct bpf_tracing_link *tr_link =
		container_of(link, struct bpf_tracing_link, link);

	WARN_ON_ONCE(bpf_trampoline_unlink_prog(link->prog,
						tr_link->trampoline));

	bpf_trampoline_put(tr_link->trampoline);

	/* tgt_prog is NULL if target is a kernel function */
	if (tr_link->tgt_prog)
		bpf_prog_put(tr_link->tgt_prog);
2544 2545 2546
}

static void bpf_tracing_link_dealloc(struct bpf_link *link)
2547 2548 2549 2550 2551 2552 2553
{
	struct bpf_tracing_link *tr_link =
		container_of(link, struct bpf_tracing_link, link);

	kfree(tr_link);
}

2554 2555 2556 2557 2558 2559 2560 2561 2562 2563 2564 2565 2566 2567 2568 2569 2570 2571
static void bpf_tracing_link_show_fdinfo(const struct bpf_link *link,
					 struct seq_file *seq)
{
	struct bpf_tracing_link *tr_link =
		container_of(link, struct bpf_tracing_link, link);

	seq_printf(seq,
		   "attach_type:\t%d\n",
		   tr_link->attach_type);
}

static int bpf_tracing_link_fill_link_info(const struct bpf_link *link,
					   struct bpf_link_info *info)
{
	struct bpf_tracing_link *tr_link =
		container_of(link, struct bpf_tracing_link, link);

	info->tracing.attach_type = tr_link->attach_type;
2572 2573 2574
	bpf_trampoline_unpack_key(tr_link->trampoline->key,
				  &info->tracing.target_obj_id,
				  &info->tracing.target_btf_id);
2575 2576 2577 2578

	return 0;
}

2579 2580
static const struct bpf_link_ops bpf_tracing_link_lops = {
	.release = bpf_tracing_link_release,
2581
	.dealloc = bpf_tracing_link_dealloc,
2582 2583
	.show_fdinfo = bpf_tracing_link_show_fdinfo,
	.fill_link_info = bpf_tracing_link_fill_link_info,
2584 2585
};

2586 2587 2588
static int bpf_tracing_prog_attach(struct bpf_prog *prog,
				   int tgt_prog_fd,
				   u32 btf_id)
2589
{
2590
	struct bpf_link_primer link_primer;
2591
	struct bpf_prog *tgt_prog = NULL;
2592
	struct bpf_trampoline *tr = NULL;
2593
	struct bpf_tracing_link *link;
2594
	u64 key = 0;
2595
	int err;
2596

2597 2598 2599 2600 2601 2602 2603 2604 2605 2606 2607 2608 2609 2610 2611 2612 2613 2614 2615 2616 2617 2618
	switch (prog->type) {
	case BPF_PROG_TYPE_TRACING:
		if (prog->expected_attach_type != BPF_TRACE_FENTRY &&
		    prog->expected_attach_type != BPF_TRACE_FEXIT &&
		    prog->expected_attach_type != BPF_MODIFY_RETURN) {
			err = -EINVAL;
			goto out_put_prog;
		}
		break;
	case BPF_PROG_TYPE_EXT:
		if (prog->expected_attach_type != 0) {
			err = -EINVAL;
			goto out_put_prog;
		}
		break;
	case BPF_PROG_TYPE_LSM:
		if (prog->expected_attach_type != BPF_LSM_MAC) {
			err = -EINVAL;
			goto out_put_prog;
		}
		break;
	default:
2619 2620 2621 2622
		err = -EINVAL;
		goto out_put_prog;
	}

2623 2624 2625 2626 2627 2628 2629 2630 2631 2632 2633 2634 2635 2636 2637 2638 2639 2640 2641
	if (!!tgt_prog_fd != !!btf_id) {
		err = -EINVAL;
		goto out_put_prog;
	}

	if (tgt_prog_fd) {
		/* For now we only allow new targets for BPF_PROG_TYPE_EXT */
		if (prog->type != BPF_PROG_TYPE_EXT) {
			err = -EINVAL;
			goto out_put_prog;
		}

		tgt_prog = bpf_prog_get(tgt_prog_fd);
		if (IS_ERR(tgt_prog)) {
			err = PTR_ERR(tgt_prog);
			tgt_prog = NULL;
			goto out_put_prog;
		}

2642
		key = bpf_trampoline_compute_key(tgt_prog, NULL, btf_id);
2643 2644
	}

2645 2646 2647 2648 2649
	link = kzalloc(sizeof(*link), GFP_USER);
	if (!link) {
		err = -ENOMEM;
		goto out_put_prog;
	}
2650 2651 2652
	bpf_link_init(&link->link, BPF_LINK_TYPE_TRACING,
		      &bpf_tracing_link_lops, prog);
	link->attach_type = prog->expected_attach_type;
2653

2654 2655
	mutex_lock(&prog->aux->dst_mutex);

2656 2657 2658 2659 2660 2661 2662 2663 2664 2665 2666 2667 2668
	/* There are a few possible cases here:
	 *
	 * - if prog->aux->dst_trampoline is set, the program was just loaded
	 *   and not yet attached to anything, so we can use the values stored
	 *   in prog->aux
	 *
	 * - if prog->aux->dst_trampoline is NULL, the program has already been
         *   attached to a target and its initial target was cleared (below)
	 *
	 * - if tgt_prog != NULL, the caller specified tgt_prog_fd +
	 *   target_btf_id using the link_create API.
	 *
	 * - if tgt_prog == NULL when this function was called using the old
2669 2670 2671 2672
	 *   raw_tracepoint_open API, and we need a target from prog->aux
	 *
	 * - if prog->aux->dst_trampoline and tgt_prog is NULL, the program
	 *   was detached and is going for re-attachment.
2673 2674
	 */
	if (!prog->aux->dst_trampoline && !tgt_prog) {
2675 2676 2677 2678 2679 2680 2681 2682 2683 2684 2685 2686 2687
		/*
		 * Allow re-attach for TRACING and LSM programs. If it's
		 * currently linked, bpf_trampoline_link_prog will fail.
		 * EXT programs need to specify tgt_prog_fd, so they
		 * re-attach in separate code path.
		 */
		if (prog->type != BPF_PROG_TYPE_TRACING &&
		    prog->type != BPF_PROG_TYPE_LSM) {
			err = -EINVAL;
			goto out_unlock;
		}
		btf_id = prog->aux->attach_btf_id;
		key = bpf_trampoline_compute_key(NULL, prog->aux->attach_btf, btf_id);
2688
	}
2689 2690 2691 2692 2693 2694 2695 2696 2697 2698 2699 2700 2701 2702 2703 2704 2705 2706 2707 2708 2709 2710 2711 2712 2713 2714 2715 2716 2717 2718

	if (!prog->aux->dst_trampoline ||
	    (key && key != prog->aux->dst_trampoline->key)) {
		/* If there is no saved target, or the specified target is
		 * different from the destination specified at load time, we
		 * need a new trampoline and a check for compatibility
		 */
		struct bpf_attach_target_info tgt_info = {};

		err = bpf_check_attach_target(NULL, prog, tgt_prog, btf_id,
					      &tgt_info);
		if (err)
			goto out_unlock;

		tr = bpf_trampoline_get(key, &tgt_info);
		if (!tr) {
			err = -ENOMEM;
			goto out_unlock;
		}
	} else {
		/* The caller didn't specify a target, or the target was the
		 * same as the destination supplied during program load. This
		 * means we can reuse the trampoline and reference from program
		 * load time, and there is no need to allocate a new one. This
		 * can only happen once for any program, as the saved values in
		 * prog->aux are cleared below.
		 */
		tr = prog->aux->dst_trampoline;
		tgt_prog = prog->aux->dst_prog;
	}
2719 2720 2721 2722

	err = bpf_link_prime(&link->link, &link_primer);
	if (err)
		goto out_unlock;
2723

2724
	err = bpf_trampoline_link_prog(prog, tr);
2725
	if (err) {
2726
		bpf_link_cleanup(&link_primer);
2727 2728
		link = NULL;
		goto out_unlock;
2729
	}
2730

2731 2732 2733
	link->tgt_prog = tgt_prog;
	link->trampoline = tr;

2734 2735 2736 2737 2738 2739 2740 2741 2742 2743 2744 2745
	/* Always clear the trampoline and target prog from prog->aux to make
	 * sure the original attach destination is not kept alive after a
	 * program is (re-)attached to another target.
	 */
	if (prog->aux->dst_prog &&
	    (tgt_prog_fd || tr != prog->aux->dst_trampoline))
		/* got extra prog ref from syscall, or attaching to different prog */
		bpf_prog_put(prog->aux->dst_prog);
	if (prog->aux->dst_trampoline && tr != prog->aux->dst_trampoline)
		/* we allocated a new trampoline, so free the old one */
		bpf_trampoline_put(prog->aux->dst_trampoline);

2746 2747 2748 2749
	prog->aux->dst_prog = NULL;
	prog->aux->dst_trampoline = NULL;
	mutex_unlock(&prog->aux->dst_mutex);

2750
	return bpf_link_settle(&link_primer);
2751
out_unlock:
2752 2753
	if (tr && tr != prog->aux->dst_trampoline)
		bpf_trampoline_put(tr);
2754 2755
	mutex_unlock(&prog->aux->dst_mutex);
	kfree(link);
2756
out_put_prog:
2757 2758
	if (tgt_prog_fd && tgt_prog)
		bpf_prog_put(tgt_prog);
2759 2760 2761
	return err;
}

2762 2763
struct bpf_raw_tp_link {
	struct bpf_link link;
2764 2765 2766
	struct bpf_raw_event_map *btp;
};

2767
static void bpf_raw_tp_link_release(struct bpf_link *link)
2768
{
2769 2770
	struct bpf_raw_tp_link *raw_tp =
		container_of(link, struct bpf_raw_tp_link, link);
2771

2772
	bpf_probe_unregister(raw_tp->btp, raw_tp->link.prog);
2773
	bpf_put_raw_tracepoint(raw_tp->btp);
2774 2775 2776 2777 2778 2779 2780
}

static void bpf_raw_tp_link_dealloc(struct bpf_link *link)
{
	struct bpf_raw_tp_link *raw_tp =
		container_of(link, struct bpf_raw_tp_link, link);

2781 2782 2783
	kfree(raw_tp);
}

2784 2785 2786 2787 2788 2789 2790 2791 2792 2793 2794 2795 2796 2797 2798 2799 2800 2801 2802 2803 2804
static void bpf_raw_tp_link_show_fdinfo(const struct bpf_link *link,
					struct seq_file *seq)
{
	struct bpf_raw_tp_link *raw_tp_link =
		container_of(link, struct bpf_raw_tp_link, link);

	seq_printf(seq,
		   "tp_name:\t%s\n",
		   raw_tp_link->btp->tp->name);
}

static int bpf_raw_tp_link_fill_link_info(const struct bpf_link *link,
					  struct bpf_link_info *info)
{
	struct bpf_raw_tp_link *raw_tp_link =
		container_of(link, struct bpf_raw_tp_link, link);
	char __user *ubuf = u64_to_user_ptr(info->raw_tracepoint.tp_name);
	const char *tp_name = raw_tp_link->btp->tp->name;
	u32 ulen = info->raw_tracepoint.tp_name_len;
	size_t tp_len = strlen(tp_name);

2805
	if (!ulen ^ !ubuf)
2806 2807 2808 2809 2810 2811 2812 2813 2814 2815 2816 2817 2818 2819 2820 2821 2822 2823 2824 2825 2826 2827 2828
		return -EINVAL;

	info->raw_tracepoint.tp_name_len = tp_len + 1;

	if (!ubuf)
		return 0;

	if (ulen >= tp_len + 1) {
		if (copy_to_user(ubuf, tp_name, tp_len + 1))
			return -EFAULT;
	} else {
		char zero = '\0';

		if (copy_to_user(ubuf, tp_name, ulen - 1))
			return -EFAULT;
		if (put_user(zero, ubuf + ulen - 1))
			return -EFAULT;
		return -ENOSPC;
	}

	return 0;
}

2829
static const struct bpf_link_ops bpf_raw_tp_link_lops = {
2830
	.release = bpf_raw_tp_link_release,
2831
	.dealloc = bpf_raw_tp_link_dealloc,
2832 2833
	.show_fdinfo = bpf_raw_tp_link_show_fdinfo,
	.fill_link_info = bpf_raw_tp_link_fill_link_info,
2834 2835 2836 2837 2838 2839
};

#define BPF_RAW_TRACEPOINT_OPEN_LAST_FIELD raw_tracepoint.prog_fd

static int bpf_raw_tracepoint_open(const union bpf_attr *attr)
{
2840
	struct bpf_link_primer link_primer;
2841
	struct bpf_raw_tp_link *link;
2842 2843
	struct bpf_raw_event_map *btp;
	struct bpf_prog *prog;
2844 2845
	const char *tp_name;
	char buf[128];
2846
	int err;
2847

2848 2849 2850 2851 2852 2853 2854
	if (CHECK_ATTR(BPF_RAW_TRACEPOINT_OPEN))
		return -EINVAL;

	prog = bpf_prog_get(attr->raw_tracepoint.prog_fd);
	if (IS_ERR(prog))
		return PTR_ERR(prog);

2855 2856 2857 2858
	switch (prog->type) {
	case BPF_PROG_TYPE_TRACING:
	case BPF_PROG_TYPE_EXT:
	case BPF_PROG_TYPE_LSM:
2859
		if (attr->raw_tracepoint.name) {
2860 2861
			/* The attach point for this category of programs
			 * should be specified via btf_id during program load.
2862 2863 2864 2865
			 */
			err = -EINVAL;
			goto out_put_prog;
		}
2866 2867
		if (prog->type == BPF_PROG_TYPE_TRACING &&
		    prog->expected_attach_type == BPF_TRACE_RAW_TP) {
2868
			tp_name = prog->aux->attach_func_name;
2869 2870
			break;
		}
2871 2872 2873 2874
		err = bpf_tracing_prog_attach(prog, 0, 0);
		if (err >= 0)
			return err;
		goto out_put_prog;
2875 2876
	case BPF_PROG_TYPE_RAW_TRACEPOINT:
	case BPF_PROG_TYPE_RAW_TRACEPOINT_WRITABLE:
2877 2878 2879 2880 2881 2882 2883 2884
		if (strncpy_from_user(buf,
				      u64_to_user_ptr(attr->raw_tracepoint.name),
				      sizeof(buf) - 1) < 0) {
			err = -EFAULT;
			goto out_put_prog;
		}
		buf[sizeof(buf) - 1] = 0;
		tp_name = buf;
2885 2886 2887 2888
		break;
	default:
		err = -EINVAL;
		goto out_put_prog;
2889
	}
2890

2891
	btp = bpf_get_raw_tracepoint(tp_name);
2892 2893 2894 2895
	if (!btp) {
		err = -ENOENT;
		goto out_put_prog;
	}
2896

2897 2898
	link = kzalloc(sizeof(*link), GFP_USER);
	if (!link) {
2899 2900 2901
		err = -ENOMEM;
		goto out_put_btp;
	}
2902 2903
	bpf_link_init(&link->link, BPF_LINK_TYPE_RAW_TRACEPOINT,
		      &bpf_raw_tp_link_lops, prog);
2904
	link->btp = btp;
2905

2906 2907
	err = bpf_link_prime(&link->link, &link_primer);
	if (err) {
2908 2909 2910
		kfree(link);
		goto out_put_btp;
	}
2911

2912 2913
	err = bpf_probe_register(link->btp, prog);
	if (err) {
2914
		bpf_link_cleanup(&link_primer);
2915
		goto out_put_btp;
2916
	}
2917

2918
	return bpf_link_settle(&link_primer);
2919

2920 2921
out_put_btp:
	bpf_put_raw_tracepoint(btp);
2922 2923
out_put_prog:
	bpf_prog_put(prog);
2924 2925 2926
	return err;
}

2927 2928 2929 2930 2931 2932
static int bpf_prog_attach_check_attach_type(const struct bpf_prog *prog,
					     enum bpf_attach_type attach_type)
{
	switch (prog->type) {
	case BPF_PROG_TYPE_CGROUP_SOCK:
	case BPF_PROG_TYPE_CGROUP_SOCK_ADDR:
2933
	case BPF_PROG_TYPE_CGROUP_SOCKOPT:
2934
	case BPF_PROG_TYPE_SK_LOOKUP:
2935
		return attach_type == prog->expected_attach_type ? 0 : -EINVAL;
2936
	case BPF_PROG_TYPE_CGROUP_SKB:
2937 2938 2939 2940 2941
		if (!capable(CAP_NET_ADMIN))
			/* cg-skb progs can be loaded by unpriv user.
			 * check permissions at attach time.
			 */
			return -EPERM;
2942 2943 2944
		return prog->enforce_expected_attach_type &&
			prog->expected_attach_type != attach_type ?
			-EINVAL : 0;
2945 2946 2947 2948 2949
	default:
		return 0;
	}
}

2950 2951
static enum bpf_prog_type
attach_type_to_prog_type(enum bpf_attach_type attach_type)
2952
{
2953
	switch (attach_type) {
2954 2955
	case BPF_CGROUP_INET_INGRESS:
	case BPF_CGROUP_INET_EGRESS:
2956
		return BPF_PROG_TYPE_CGROUP_SKB;
2957
	case BPF_CGROUP_INET_SOCK_CREATE:
2958
	case BPF_CGROUP_INET_SOCK_RELEASE:
2959 2960
	case BPF_CGROUP_INET4_POST_BIND:
	case BPF_CGROUP_INET6_POST_BIND:
2961
		return BPF_PROG_TYPE_CGROUP_SOCK;
Andrey Ignatov's avatar
Andrey Ignatov committed
2962 2963
	case BPF_CGROUP_INET4_BIND:
	case BPF_CGROUP_INET6_BIND:
2964 2965
	case BPF_CGROUP_INET4_CONNECT:
	case BPF_CGROUP_INET6_CONNECT:
2966 2967 2968 2969
	case BPF_CGROUP_INET4_GETPEERNAME:
	case BPF_CGROUP_INET6_GETPEERNAME:
	case BPF_CGROUP_INET4_GETSOCKNAME:
	case BPF_CGROUP_INET6_GETSOCKNAME:
2970 2971
	case BPF_CGROUP_UDP4_SENDMSG:
	case BPF_CGROUP_UDP6_SENDMSG:
2972 2973
	case BPF_CGROUP_UDP4_RECVMSG:
	case BPF_CGROUP_UDP6_RECVMSG:
2974
		return BPF_PROG_TYPE_CGROUP_SOCK_ADDR;
2975
	case BPF_CGROUP_SOCK_OPS:
2976
		return BPF_PROG_TYPE_SOCK_OPS;
2977
	case BPF_CGROUP_DEVICE:
2978
		return BPF_PROG_TYPE_CGROUP_DEVICE;
2979
	case BPF_SK_MSG_VERDICT:
2980
		return BPF_PROG_TYPE_SK_MSG;
2981 2982
	case BPF_SK_SKB_STREAM_PARSER:
	case BPF_SK_SKB_STREAM_VERDICT:
2983
	case BPF_SK_SKB_VERDICT:
2984
		return BPF_PROG_TYPE_SK_SKB;
2985
	case BPF_LIRC_MODE2:
2986
		return BPF_PROG_TYPE_LIRC_MODE2;
2987
	case BPF_FLOW_DISSECTOR:
2988
		return BPF_PROG_TYPE_FLOW_DISSECTOR;
Andrey Ignatov's avatar
Andrey Ignatov committed
2989
	case BPF_CGROUP_SYSCTL:
2990
		return BPF_PROG_TYPE_CGROUP_SYSCTL;
2991 2992
	case BPF_CGROUP_GETSOCKOPT:
	case BPF_CGROUP_SETSOCKOPT:
2993
		return BPF_PROG_TYPE_CGROUP_SOCKOPT;
2994 2995
	case BPF_TRACE_ITER:
		return BPF_PROG_TYPE_TRACING;
2996 2997
	case BPF_SK_LOOKUP:
		return BPF_PROG_TYPE_SK_LOOKUP;
2998 2999
	case BPF_XDP:
		return BPF_PROG_TYPE_XDP;
3000
	default:
3001
		return BPF_PROG_TYPE_UNSPEC;
3002
	}
3003 3004 3005 3006 3007 3008 3009 3010 3011 3012 3013 3014 3015 3016 3017 3018 3019 3020 3021 3022 3023 3024
}

#define BPF_PROG_ATTACH_LAST_FIELD replace_bpf_fd

#define BPF_F_ATTACH_MASK \
	(BPF_F_ALLOW_OVERRIDE | BPF_F_ALLOW_MULTI | BPF_F_REPLACE)

static int bpf_prog_attach(const union bpf_attr *attr)
{
	enum bpf_prog_type ptype;
	struct bpf_prog *prog;
	int ret;

	if (CHECK_ATTR(BPF_PROG_ATTACH))
		return -EINVAL;

	if (attr->attach_flags & ~BPF_F_ATTACH_MASK)
		return -EINVAL;

	ptype = attach_type_to_prog_type(attr->attach_type);
	if (ptype == BPF_PROG_TYPE_UNSPEC)
		return -EINVAL;
3025

3026 3027 3028 3029
	prog = bpf_prog_get_type(attr->attach_bpf_fd, ptype);
	if (IS_ERR(prog))
		return PTR_ERR(prog);

3030 3031 3032 3033 3034
	if (bpf_prog_attach_check_attach_type(prog, attr->attach_type)) {
		bpf_prog_put(prog);
		return -EINVAL;
	}

3035 3036 3037
	switch (ptype) {
	case BPF_PROG_TYPE_SK_SKB:
	case BPF_PROG_TYPE_SK_MSG:
3038
		ret = sock_map_get_from_fd(attr, prog);
3039 3040 3041 3042
		break;
	case BPF_PROG_TYPE_LIRC_MODE2:
		ret = lirc_prog_attach(attr, prog);
		break;
3043
	case BPF_PROG_TYPE_FLOW_DISSECTOR:
3044
		ret = netns_bpf_prog_attach(attr, prog);
3045
		break;
3046 3047 3048 3049 3050 3051 3052
	case BPF_PROG_TYPE_CGROUP_DEVICE:
	case BPF_PROG_TYPE_CGROUP_SKB:
	case BPF_PROG_TYPE_CGROUP_SOCK:
	case BPF_PROG_TYPE_CGROUP_SOCK_ADDR:
	case BPF_PROG_TYPE_CGROUP_SOCKOPT:
	case BPF_PROG_TYPE_CGROUP_SYSCTL:
	case BPF_PROG_TYPE_SOCK_OPS:
3053
		ret = cgroup_bpf_prog_attach(attr, ptype, prog);
3054 3055 3056
		break;
	default:
		ret = -EINVAL;
3057 3058
	}

3059 3060 3061
	if (ret)
		bpf_prog_put(prog);
	return ret;
3062 3063 3064 3065 3066 3067
}

#define BPF_PROG_DETACH_LAST_FIELD attach_type

static int bpf_prog_detach(const union bpf_attr *attr)
{
3068
	enum bpf_prog_type ptype;
3069 3070 3071 3072

	if (CHECK_ATTR(BPF_PROG_DETACH))
		return -EINVAL;

3073 3074 3075 3076 3077
	ptype = attach_type_to_prog_type(attr->attach_type);

	switch (ptype) {
	case BPF_PROG_TYPE_SK_MSG:
	case BPF_PROG_TYPE_SK_SKB:
3078
		return sock_map_prog_detach(attr, ptype);
3079
	case BPF_PROG_TYPE_LIRC_MODE2:
3080
		return lirc_prog_detach(attr);
3081
	case BPF_PROG_TYPE_FLOW_DISSECTOR:
3082
		return netns_bpf_prog_detach(attr, ptype);
3083 3084 3085 3086 3087 3088 3089 3090
	case BPF_PROG_TYPE_CGROUP_DEVICE:
	case BPF_PROG_TYPE_CGROUP_SKB:
	case BPF_PROG_TYPE_CGROUP_SOCK:
	case BPF_PROG_TYPE_CGROUP_SOCK_ADDR:
	case BPF_PROG_TYPE_CGROUP_SOCKOPT:
	case BPF_PROG_TYPE_CGROUP_SYSCTL:
	case BPF_PROG_TYPE_SOCK_OPS:
		return cgroup_bpf_prog_detach(attr, ptype);
3091 3092 3093 3094
	default:
		return -EINVAL;
	}
}
3095

3096 3097 3098 3099 3100 3101 3102 3103 3104 3105 3106 3107 3108 3109 3110 3111
#define BPF_PROG_QUERY_LAST_FIELD query.prog_cnt

static int bpf_prog_query(const union bpf_attr *attr,
			  union bpf_attr __user *uattr)
{
	if (!capable(CAP_NET_ADMIN))
		return -EPERM;
	if (CHECK_ATTR(BPF_PROG_QUERY))
		return -EINVAL;
	if (attr->query.query_flags & ~BPF_F_QUERY_EFFECTIVE)
		return -EINVAL;

	switch (attr->query.attach_type) {
	case BPF_CGROUP_INET_INGRESS:
	case BPF_CGROUP_INET_EGRESS:
	case BPF_CGROUP_INET_SOCK_CREATE:
3112
	case BPF_CGROUP_INET_SOCK_RELEASE:
Andrey Ignatov's avatar
Andrey Ignatov committed
3113 3114
	case BPF_CGROUP_INET4_BIND:
	case BPF_CGROUP_INET6_BIND:
3115 3116
	case BPF_CGROUP_INET4_POST_BIND:
	case BPF_CGROUP_INET6_POST_BIND:
3117 3118
	case BPF_CGROUP_INET4_CONNECT:
	case BPF_CGROUP_INET6_CONNECT:
3119 3120 3121 3122
	case BPF_CGROUP_INET4_GETPEERNAME:
	case BPF_CGROUP_INET6_GETPEERNAME:
	case BPF_CGROUP_INET4_GETSOCKNAME:
	case BPF_CGROUP_INET6_GETSOCKNAME:
3123 3124
	case BPF_CGROUP_UDP4_SENDMSG:
	case BPF_CGROUP_UDP6_SENDMSG:
3125 3126
	case BPF_CGROUP_UDP4_RECVMSG:
	case BPF_CGROUP_UDP6_RECVMSG:
3127
	case BPF_CGROUP_SOCK_OPS:
3128
	case BPF_CGROUP_DEVICE:
Andrey Ignatov's avatar
Andrey Ignatov committed
3129
	case BPF_CGROUP_SYSCTL:
3130 3131
	case BPF_CGROUP_GETSOCKOPT:
	case BPF_CGROUP_SETSOCKOPT:
3132
		return cgroup_bpf_prog_query(attr, uattr);
3133 3134
	case BPF_LIRC_MODE2:
		return lirc_prog_query(attr, uattr);
3135
	case BPF_FLOW_DISSECTOR:
3136
	case BPF_SK_LOOKUP:
3137
		return netns_bpf_prog_query(attr, uattr);
3138 3139 3140 3141
	default:
		return -EINVAL;
	}
}
3142

3143
#define BPF_PROG_TEST_RUN_LAST_FIELD test.cpu
3144 3145 3146 3147 3148 3149 3150 3151 3152 3153

static int bpf_prog_test_run(const union bpf_attr *attr,
			     union bpf_attr __user *uattr)
{
	struct bpf_prog *prog;
	int ret = -ENOTSUPP;

	if (CHECK_ATTR(BPF_PROG_TEST_RUN))
		return -EINVAL;

3154 3155 3156 3157 3158 3159 3160 3161
	if ((attr->test.ctx_size_in && !attr->test.ctx_in) ||
	    (!attr->test.ctx_size_in && attr->test.ctx_in))
		return -EINVAL;

	if ((attr->test.ctx_size_out && !attr->test.ctx_out) ||
	    (!attr->test.ctx_size_out && attr->test.ctx_out))
		return -EINVAL;

3162 3163 3164 3165 3166 3167 3168 3169 3170 3171 3172
	prog = bpf_prog_get(attr->test.prog_fd);
	if (IS_ERR(prog))
		return PTR_ERR(prog);

	if (prog->aux->ops->test_run)
		ret = prog->aux->ops->test_run(prog, attr, uattr);

	bpf_prog_put(prog);
	return ret;
}

3173 3174 3175 3176 3177 3178 3179 3180 3181 3182 3183 3184 3185 3186 3187 3188 3189 3190 3191 3192 3193 3194 3195 3196 3197 3198 3199 3200
#define BPF_OBJ_GET_NEXT_ID_LAST_FIELD next_id

static int bpf_obj_get_next_id(const union bpf_attr *attr,
			       union bpf_attr __user *uattr,
			       struct idr *idr,
			       spinlock_t *lock)
{
	u32 next_id = attr->start_id;
	int err = 0;

	if (CHECK_ATTR(BPF_OBJ_GET_NEXT_ID) || next_id >= INT_MAX)
		return -EINVAL;

	if (!capable(CAP_SYS_ADMIN))
		return -EPERM;

	next_id++;
	spin_lock_bh(lock);
	if (!idr_get_next(idr, &next_id))
		err = -ENOENT;
	spin_unlock_bh(lock);

	if (!err)
		err = put_user(next_id, &uattr->next_id);

	return err;
}

Yonghong Song's avatar
Yonghong Song committed
3201 3202 3203 3204 3205 3206 3207 3208 3209 3210 3211 3212 3213 3214 3215 3216 3217 3218 3219
struct bpf_map *bpf_map_get_curr_or_next(u32 *id)
{
	struct bpf_map *map;

	spin_lock_bh(&map_idr_lock);
again:
	map = idr_get_next(&map_idr, id);
	if (map) {
		map = __bpf_map_inc_not_zero(map, false);
		if (IS_ERR(map)) {
			(*id)++;
			goto again;
		}
	}
	spin_unlock_bh(&map_idr_lock);

	return map;
}

3220 3221 3222 3223 3224 3225 3226 3227 3228 3229 3230 3231 3232 3233 3234 3235 3236 3237 3238
struct bpf_prog *bpf_prog_get_curr_or_next(u32 *id)
{
	struct bpf_prog *prog;

	spin_lock_bh(&prog_idr_lock);
again:
	prog = idr_get_next(&prog_idr, id);
	if (prog) {
		prog = bpf_prog_inc_not_zero(prog);
		if (IS_ERR(prog)) {
			(*id)++;
			goto again;
		}
	}
	spin_unlock_bh(&prog_idr_lock);

	return prog;
}

3239 3240
#define BPF_PROG_GET_FD_BY_ID_LAST_FIELD prog_id

3241
struct bpf_prog *bpf_prog_by_id(u32 id)
3242 3243 3244
{
	struct bpf_prog *prog;

3245 3246
	if (!id)
		return ERR_PTR(-ENOENT);
3247 3248 3249 3250 3251 3252 3253 3254

	spin_lock_bh(&prog_idr_lock);
	prog = idr_find(&prog_idr, id);
	if (prog)
		prog = bpf_prog_inc_not_zero(prog);
	else
		prog = ERR_PTR(-ENOENT);
	spin_unlock_bh(&prog_idr_lock);
3255 3256 3257 3258 3259 3260 3261 3262 3263 3264 3265 3266 3267 3268
	return prog;
}

static int bpf_prog_get_fd_by_id(const union bpf_attr *attr)
{
	struct bpf_prog *prog;
	u32 id = attr->prog_id;
	int fd;

	if (CHECK_ATTR(BPF_PROG_GET_FD_BY_ID))
		return -EINVAL;

	if (!capable(CAP_SYS_ADMIN))
		return -EPERM;
3269

3270
	prog = bpf_prog_by_id(id);
3271 3272 3273 3274 3275 3276 3277 3278 3279 3280
	if (IS_ERR(prog))
		return PTR_ERR(prog);

	fd = bpf_prog_new_fd(prog);
	if (fd < 0)
		bpf_prog_put(prog);

	return fd;
}

3281
#define BPF_MAP_GET_FD_BY_ID_LAST_FIELD open_flags
3282 3283 3284 3285 3286

static int bpf_map_get_fd_by_id(const union bpf_attr *attr)
{
	struct bpf_map *map;
	u32 id = attr->map_id;
3287
	int f_flags;
3288 3289
	int fd;

3290 3291
	if (CHECK_ATTR(BPF_MAP_GET_FD_BY_ID) ||
	    attr->open_flags & ~BPF_OBJ_FLAG_MASK)
3292 3293 3294 3295 3296
		return -EINVAL;

	if (!capable(CAP_SYS_ADMIN))
		return -EPERM;

3297 3298 3299 3300
	f_flags = bpf_get_file_flag(attr->open_flags);
	if (f_flags < 0)
		return f_flags;

3301 3302 3303
	spin_lock_bh(&map_idr_lock);
	map = idr_find(&map_idr, id);
	if (map)
3304
		map = __bpf_map_inc_not_zero(map, true);
3305 3306 3307 3308 3309 3310 3311
	else
		map = ERR_PTR(-ENOENT);
	spin_unlock_bh(&map_idr_lock);

	if (IS_ERR(map))
		return PTR_ERR(map);

3312
	fd = bpf_map_new_fd(map, f_flags);
3313
	if (fd < 0)
3314
		bpf_map_put_with_uref(map);
3315 3316 3317 3318

	return fd;
}

3319
static const struct bpf_map *bpf_map_from_imm(const struct bpf_prog *prog,
3320 3321
					      unsigned long addr, u32 *off,
					      u32 *type)
3322
{
3323
	const struct bpf_map *map;
3324 3325
	int i;

3326
	mutex_lock(&prog->aux->used_maps_mutex);
3327 3328 3329 3330
	for (i = 0, *off = 0; i < prog->aux->used_map_cnt; i++) {
		map = prog->aux->used_maps[i];
		if (map == (void *)addr) {
			*type = BPF_PSEUDO_MAP_FD;
3331
			goto out;
3332 3333 3334 3335 3336
		}
		if (!map->ops->map_direct_value_meta)
			continue;
		if (!map->ops->map_direct_value_meta(map, addr, off)) {
			*type = BPF_PSEUDO_MAP_VALUE;
3337
			goto out;
3338 3339
		}
	}
3340
	map = NULL;
3341

3342 3343 3344
out:
	mutex_unlock(&prog->aux->used_maps_mutex);
	return map;
3345 3346
}

3347 3348
static struct bpf_insn *bpf_insn_prepare_dump(const struct bpf_prog *prog,
					      const struct cred *f_cred)
3349 3350 3351
{
	const struct bpf_map *map;
	struct bpf_insn *insns;
3352
	u32 off, type;
3353
	u64 imm;
3354
	u8 code;
3355 3356 3357 3358 3359 3360 3361 3362
	int i;

	insns = kmemdup(prog->insnsi, bpf_prog_insn_size(prog),
			GFP_USER);
	if (!insns)
		return insns;

	for (i = 0; i < prog->len; i++) {
3363 3364 3365
		code = insns[i].code;

		if (code == (BPF_JMP | BPF_TAIL_CALL)) {
3366 3367 3368 3369
			insns[i].code = BPF_JMP | BPF_CALL;
			insns[i].imm = BPF_FUNC_tail_call;
			/* fall-through */
		}
3370 3371 3372
		if (code == (BPF_JMP | BPF_CALL) ||
		    code == (BPF_JMP | BPF_CALL_ARGS)) {
			if (code == (BPF_JMP | BPF_CALL_ARGS))
3373
				insns[i].code = BPF_JMP | BPF_CALL;
3374
			if (!bpf_dump_raw_ok(f_cred))
3375 3376 3377
				insns[i].imm = 0;
			continue;
		}
3378 3379 3380 3381
		if (BPF_CLASS(code) == BPF_LDX && BPF_MODE(code) == BPF_PROBE_MEM) {
			insns[i].code = BPF_LDX | BPF_SIZE(code) | BPF_MEM;
			continue;
		}
3382

3383
		if (code != (BPF_LD | BPF_IMM | BPF_DW))
3384 3385 3386
			continue;

		imm = ((u64)insns[i + 1].imm << 32) | (u32)insns[i].imm;
3387
		map = bpf_map_from_imm(prog, imm, &off, &type);
3388
		if (map) {
3389
			insns[i].src_reg = type;
3390
			insns[i].imm = map->id;
3391
			insns[i + 1].imm = off;
3392 3393 3394 3395 3396 3397 3398
			continue;
		}
	}

	return insns;
}

3399 3400 3401 3402 3403 3404 3405 3406 3407 3408 3409 3410
static int set_info_rec_size(struct bpf_prog_info *info)
{
	/*
	 * Ensure info.*_rec_size is the same as kernel expected size
	 *
	 * or
	 *
	 * Only allow zero *_rec_size if both _rec_size and _cnt are
	 * zero.  In this case, the kernel will set the expected
	 * _rec_size back to the info.
	 */

3411
	if ((info->nr_func_info || info->func_info_rec_size) &&
3412 3413 3414
	    info->func_info_rec_size != sizeof(struct bpf_func_info))
		return -EINVAL;

3415
	if ((info->nr_line_info || info->line_info_rec_size) &&
3416 3417 3418
	    info->line_info_rec_size != sizeof(struct bpf_line_info))
		return -EINVAL;

3419
	if ((info->nr_jited_line_info || info->jited_line_info_rec_size) &&
3420 3421 3422 3423 3424 3425 3426 3427 3428 3429
	    info->jited_line_info_rec_size != sizeof(__u64))
		return -EINVAL;

	info->func_info_rec_size = sizeof(struct bpf_func_info);
	info->line_info_rec_size = sizeof(struct bpf_line_info);
	info->jited_line_info_rec_size = sizeof(__u64);

	return 0;
}

3430 3431
static int bpf_prog_get_info_by_fd(struct file *file,
				   struct bpf_prog *prog,
3432 3433 3434 3435
				   const union bpf_attr *attr,
				   union bpf_attr __user *uattr)
{
	struct bpf_prog_info __user *uinfo = u64_to_user_ptr(attr->info.info);
3436
	struct bpf_prog_info info;
3437
	u32 info_len = attr->info.info_len;
3438
	struct bpf_prog_stats stats;
3439 3440 3441 3442
	char __user *uinsns;
	u32 ulen;
	int err;

3443
	err = bpf_check_uarg_tail_zero(USER_BPFPTR(uinfo), sizeof(info), info_len);
3444 3445 3446 3447
	if (err)
		return err;
	info_len = min_t(u32, sizeof(info), info_len);

3448
	memset(&info, 0, sizeof(info));
3449
	if (copy_from_user(&info, uinfo, info_len))
3450
		return -EFAULT;
3451 3452 3453

	info.type = prog->type;
	info.id = prog->aux->id;
3454 3455 3456
	info.load_time = prog->aux->load_time;
	info.created_by_uid = from_kuid_munged(current_user_ns(),
					       prog->aux->user->uid);
3457
	info.gpl_compatible = prog->gpl_compatible;
3458 3459

	memcpy(info.tag, prog->tag, sizeof(prog->tag));
3460 3461
	memcpy(info.name, prog->aux->name, sizeof(prog->aux->name));

3462
	mutex_lock(&prog->aux->used_maps_mutex);
3463 3464 3465 3466
	ulen = info.nr_map_ids;
	info.nr_map_ids = prog->aux->used_map_cnt;
	ulen = min_t(u32, info.nr_map_ids, ulen);
	if (ulen) {
3467
		u32 __user *user_map_ids = u64_to_user_ptr(info.map_ids);
3468 3469 3470 3471
		u32 i;

		for (i = 0; i < ulen; i++)
			if (put_user(prog->aux->used_maps[i]->id,
3472 3473
				     &user_map_ids[i])) {
				mutex_unlock(&prog->aux->used_maps_mutex);
3474
				return -EFAULT;
3475
			}
3476
	}
3477
	mutex_unlock(&prog->aux->used_maps_mutex);
3478

3479 3480 3481
	err = set_info_rec_size(&info);
	if (err)
		return err;
3482

3483 3484 3485
	bpf_prog_get_stats(prog, &stats);
	info.run_time_ns = stats.nsecs;
	info.run_cnt = stats.cnt;
3486
	info.recursion_misses = stats.misses;
3487

3488
	if (!bpf_capable()) {
3489 3490
		info.jited_prog_len = 0;
		info.xlated_prog_len = 0;
3491
		info.nr_jited_ksyms = 0;
3492
		info.nr_jited_func_lens = 0;
3493 3494 3495
		info.nr_func_info = 0;
		info.nr_line_info = 0;
		info.nr_jited_line_info = 0;
3496 3497 3498 3499
		goto done;
	}

	ulen = info.xlated_prog_len;
3500
	info.xlated_prog_len = bpf_prog_insn_size(prog);
3501
	if (info.xlated_prog_len && ulen) {
3502 3503 3504
		struct bpf_insn *insns_sanitized;
		bool fault;

3505
		if (prog->blinded && !bpf_dump_raw_ok(file->f_cred)) {
3506 3507 3508
			info.xlated_prog_insns = 0;
			goto done;
		}
3509
		insns_sanitized = bpf_insn_prepare_dump(prog, file->f_cred);
3510 3511
		if (!insns_sanitized)
			return -ENOMEM;
3512 3513
		uinsns = u64_to_user_ptr(info.xlated_prog_insns);
		ulen = min_t(u32, info.xlated_prog_len, ulen);
3514 3515 3516
		fault = copy_to_user(uinsns, insns_sanitized, ulen);
		kfree(insns_sanitized);
		if (fault)
3517 3518 3519
			return -EFAULT;
	}

3520 3521 3522 3523
	if (bpf_prog_is_dev_bound(prog->aux)) {
		err = bpf_prog_offload_info_fill(&info, prog);
		if (err)
			return err;
3524 3525 3526 3527 3528 3529 3530 3531
		goto done;
	}

	/* NOTE: the following code is supposed to be skipped for offload.
	 * bpf_prog_offload_info_fill() is the place to fill similar fields
	 * for offload.
	 */
	ulen = info.jited_prog_len;
3532 3533 3534 3535 3536 3537 3538 3539 3540 3541
	if (prog->aux->func_cnt) {
		u32 i;

		info.jited_prog_len = 0;
		for (i = 0; i < prog->aux->func_cnt; i++)
			info.jited_prog_len += prog->aux->func[i]->jited_len;
	} else {
		info.jited_prog_len = prog->jited_len;
	}

3542
	if (info.jited_prog_len && ulen) {
3543
		if (bpf_dump_raw_ok(file->f_cred)) {
3544 3545
			uinsns = u64_to_user_ptr(info.jited_prog_insns);
			ulen = min_t(u32, info.jited_prog_len, ulen);
3546 3547 3548 3549 3550 3551 3552 3553 3554 3555 3556 3557 3558 3559 3560 3561 3562 3563 3564 3565 3566 3567 3568 3569

			/* for multi-function programs, copy the JITed
			 * instructions for all the functions
			 */
			if (prog->aux->func_cnt) {
				u32 len, free, i;
				u8 *img;

				free = ulen;
				for (i = 0; i < prog->aux->func_cnt; i++) {
					len = prog->aux->func[i]->jited_len;
					len = min_t(u32, len, free);
					img = (u8 *) prog->aux->func[i]->bpf_func;
					if (copy_to_user(uinsns, img, len))
						return -EFAULT;
					uinsns += len;
					free -= len;
					if (!free)
						break;
				}
			} else {
				if (copy_to_user(uinsns, prog->bpf_func, ulen))
					return -EFAULT;
			}
3570 3571 3572
		} else {
			info.jited_prog_insns = 0;
		}
3573 3574
	}

3575
	ulen = info.nr_jited_ksyms;
3576
	info.nr_jited_ksyms = prog->aux->func_cnt ? : 1;
3577
	if (ulen) {
3578
		if (bpf_dump_raw_ok(file->f_cred)) {
3579
			unsigned long ksym_addr;
3580 3581 3582 3583 3584 3585 3586 3587
			u64 __user *user_ksyms;
			u32 i;

			/* copy the address of the kernel symbol
			 * corresponding to each function
			 */
			ulen = min_t(u32, info.nr_jited_ksyms, ulen);
			user_ksyms = u64_to_user_ptr(info.jited_ksyms);
3588 3589 3590 3591 3592 3593 3594 3595 3596 3597 3598
			if (prog->aux->func_cnt) {
				for (i = 0; i < ulen; i++) {
					ksym_addr = (unsigned long)
						prog->aux->func[i]->bpf_func;
					if (put_user((u64) ksym_addr,
						     &user_ksyms[i]))
						return -EFAULT;
				}
			} else {
				ksym_addr = (unsigned long) prog->bpf_func;
				if (put_user((u64) ksym_addr, &user_ksyms[0]))
3599 3600 3601 3602 3603 3604 3605
					return -EFAULT;
			}
		} else {
			info.jited_ksyms = 0;
		}
	}

3606
	ulen = info.nr_jited_func_lens;
3607
	info.nr_jited_func_lens = prog->aux->func_cnt ? : 1;
3608
	if (ulen) {
3609
		if (bpf_dump_raw_ok(file->f_cred)) {
3610 3611 3612 3613 3614 3615
			u32 __user *user_lens;
			u32 func_len, i;

			/* copy the JITed image lengths for each function */
			ulen = min_t(u32, info.nr_jited_func_lens, ulen);
			user_lens = u64_to_user_ptr(info.jited_func_lens);
3616 3617 3618 3619 3620 3621 3622 3623 3624 3625
			if (prog->aux->func_cnt) {
				for (i = 0; i < ulen; i++) {
					func_len =
						prog->aux->func[i]->jited_len;
					if (put_user(func_len, &user_lens[i]))
						return -EFAULT;
				}
			} else {
				func_len = prog->jited_len;
				if (put_user(func_len, &user_lens[0]))
3626 3627 3628 3629 3630 3631 3632
					return -EFAULT;
			}
		} else {
			info.jited_func_lens = 0;
		}
	}

3633
	if (prog->aux->btf)
3634
		info.btf_id = btf_obj_id(prog->aux->btf);
3635

3636 3637 3638
	ulen = info.nr_func_info;
	info.nr_func_info = prog->aux->func_info_cnt;
	if (info.nr_func_info && ulen) {
3639
		char __user *user_finfo;
3640

3641 3642 3643 3644 3645
		user_finfo = u64_to_user_ptr(info.func_info);
		ulen = min_t(u32, info.nr_func_info, ulen);
		if (copy_to_user(user_finfo, prog->aux->func_info,
				 info.func_info_rec_size * ulen))
			return -EFAULT;
3646 3647
	}

3648 3649 3650
	ulen = info.nr_line_info;
	info.nr_line_info = prog->aux->nr_linfo;
	if (info.nr_line_info && ulen) {
3651
		__u8 __user *user_linfo;
3652

3653 3654 3655 3656 3657
		user_linfo = u64_to_user_ptr(info.line_info);
		ulen = min_t(u32, info.nr_line_info, ulen);
		if (copy_to_user(user_linfo, prog->aux->linfo,
				 info.line_info_rec_size * ulen))
			return -EFAULT;
3658 3659
	}

3660
	ulen = info.nr_jited_line_info;
3661
	if (prog->aux->jited_linfo)
3662
		info.nr_jited_line_info = prog->aux->nr_linfo;
3663
	else
3664 3665
		info.nr_jited_line_info = 0;
	if (info.nr_jited_line_info && ulen) {
3666
		if (bpf_dump_raw_ok(file->f_cred)) {
3667 3668 3669 3670
			__u64 __user *user_linfo;
			u32 i;

			user_linfo = u64_to_user_ptr(info.jited_line_info);
3671
			ulen = min_t(u32, info.nr_jited_line_info, ulen);
3672 3673 3674 3675 3676 3677 3678 3679 3680 3681
			for (i = 0; i < ulen; i++) {
				if (put_user((__u64)(long)prog->aux->jited_linfo[i],
					     &user_linfo[i]))
					return -EFAULT;
			}
		} else {
			info.jited_line_info = 0;
		}
	}

3682 3683 3684 3685 3686 3687 3688 3689 3690 3691 3692 3693 3694 3695 3696 3697 3698 3699 3700 3701 3702 3703
	ulen = info.nr_prog_tags;
	info.nr_prog_tags = prog->aux->func_cnt ? : 1;
	if (ulen) {
		__u8 __user (*user_prog_tags)[BPF_TAG_SIZE];
		u32 i;

		user_prog_tags = u64_to_user_ptr(info.prog_tags);
		ulen = min_t(u32, info.nr_prog_tags, ulen);
		if (prog->aux->func_cnt) {
			for (i = 0; i < ulen; i++) {
				if (copy_to_user(user_prog_tags[i],
						 prog->aux->func[i]->tag,
						 BPF_TAG_SIZE))
					return -EFAULT;
			}
		} else {
			if (copy_to_user(user_prog_tags[0],
					 prog->tag, BPF_TAG_SIZE))
				return -EFAULT;
		}
	}

3704 3705 3706 3707 3708 3709 3710 3711
done:
	if (copy_to_user(uinfo, &info, info_len) ||
	    put_user(info_len, &uattr->info.info_len))
		return -EFAULT;

	return 0;
}

3712 3713
static int bpf_map_get_info_by_fd(struct file *file,
				  struct bpf_map *map,
3714 3715 3716 3717
				  const union bpf_attr *attr,
				  union bpf_attr __user *uattr)
{
	struct bpf_map_info __user *uinfo = u64_to_user_ptr(attr->info.info);
3718
	struct bpf_map_info info;
3719 3720 3721
	u32 info_len = attr->info.info_len;
	int err;

3722
	err = bpf_check_uarg_tail_zero(USER_BPFPTR(uinfo), sizeof(info), info_len);
3723 3724 3725 3726
	if (err)
		return err;
	info_len = min_t(u32, sizeof(info), info_len);

3727
	memset(&info, 0, sizeof(info));
3728 3729 3730 3731 3732 3733
	info.type = map->map_type;
	info.id = map->id;
	info.key_size = map->key_size;
	info.value_size = map->value_size;
	info.max_entries = map->max_entries;
	info.map_flags = map->map_flags;
3734
	memcpy(info.name, map->name, sizeof(map->name));
3735

3736
	if (map->btf) {
3737
		info.btf_id = btf_obj_id(map->btf);
3738 3739
		info.btf_key_type_id = map->btf_key_type_id;
		info.btf_value_type_id = map->btf_value_type_id;
3740
	}
3741
	info.btf_vmlinux_value_type_id = map->btf_vmlinux_value_type_id;
3742

3743 3744 3745 3746 3747 3748
	if (bpf_map_is_dev_bound(map)) {
		err = bpf_map_offload_info_fill(&info, map);
		if (err)
			return err;
	}

3749 3750 3751 3752 3753 3754 3755
	if (copy_to_user(uinfo, &info, info_len) ||
	    put_user(info_len, &uattr->info.info_len))
		return -EFAULT;

	return 0;
}

3756 3757
static int bpf_btf_get_info_by_fd(struct file *file,
				  struct btf *btf,
3758 3759 3760 3761 3762 3763 3764
				  const union bpf_attr *attr,
				  union bpf_attr __user *uattr)
{
	struct bpf_btf_info __user *uinfo = u64_to_user_ptr(attr->info.info);
	u32 info_len = attr->info.info_len;
	int err;

3765
	err = bpf_check_uarg_tail_zero(USER_BPFPTR(uinfo), sizeof(*uinfo), info_len);
3766 3767 3768 3769 3770 3771
	if (err)
		return err;

	return btf_get_info_by_fd(btf, attr, uattr);
}

3772 3773
static int bpf_link_get_info_by_fd(struct file *file,
				  struct bpf_link *link,
3774 3775 3776 3777 3778 3779 3780 3781
				  const union bpf_attr *attr,
				  union bpf_attr __user *uattr)
{
	struct bpf_link_info __user *uinfo = u64_to_user_ptr(attr->info.info);
	struct bpf_link_info info;
	u32 info_len = attr->info.info_len;
	int err;

3782
	err = bpf_check_uarg_tail_zero(USER_BPFPTR(uinfo), sizeof(info), info_len);
3783 3784 3785 3786 3787 3788 3789 3790 3791 3792 3793 3794 3795 3796 3797 3798 3799 3800 3801 3802 3803 3804 3805 3806 3807 3808
	if (err)
		return err;
	info_len = min_t(u32, sizeof(info), info_len);

	memset(&info, 0, sizeof(info));
	if (copy_from_user(&info, uinfo, info_len))
		return -EFAULT;

	info.type = link->type;
	info.id = link->id;
	info.prog_id = link->prog->aux->id;

	if (link->ops->fill_link_info) {
		err = link->ops->fill_link_info(link, &info);
		if (err)
			return err;
	}

	if (copy_to_user(uinfo, &info, info_len) ||
	    put_user(info_len, &uattr->info.info_len))
		return -EFAULT;

	return 0;
}


3809 3810 3811 3812 3813 3814 3815 3816 3817 3818 3819 3820 3821 3822 3823 3824 3825
#define BPF_OBJ_GET_INFO_BY_FD_LAST_FIELD info.info

static int bpf_obj_get_info_by_fd(const union bpf_attr *attr,
				  union bpf_attr __user *uattr)
{
	int ufd = attr->info.bpf_fd;
	struct fd f;
	int err;

	if (CHECK_ATTR(BPF_OBJ_GET_INFO_BY_FD))
		return -EINVAL;

	f = fdget(ufd);
	if (!f.file)
		return -EBADFD;

	if (f.file->f_op == &bpf_prog_fops)
3826
		err = bpf_prog_get_info_by_fd(f.file, f.file->private_data, attr,
3827 3828
					      uattr);
	else if (f.file->f_op == &bpf_map_fops)
3829
		err = bpf_map_get_info_by_fd(f.file, f.file->private_data, attr,
3830
					     uattr);
3831
	else if (f.file->f_op == &btf_fops)
3832
		err = bpf_btf_get_info_by_fd(f.file, f.file->private_data, attr, uattr);
3833
	else if (f.file->f_op == &bpf_link_fops)
3834
		err = bpf_link_get_info_by_fd(f.file, f.file->private_data,
3835
					      attr, uattr);
3836 3837 3838 3839 3840 3841 3842
	else
		err = -EINVAL;

	fdput(f);
	return err;
}

3843 3844
#define BPF_BTF_LOAD_LAST_FIELD btf_log_level

3845
static int bpf_btf_load(const union bpf_attr *attr, bpfptr_t uattr)
3846 3847 3848 3849
{
	if (CHECK_ATTR(BPF_BTF_LOAD))
		return -EINVAL;

3850
	if (!bpf_capable())
3851 3852
		return -EPERM;

3853
	return btf_new_fd(attr, uattr);
3854 3855
}

3856 3857 3858 3859 3860 3861 3862 3863 3864 3865 3866 3867 3868
#define BPF_BTF_GET_FD_BY_ID_LAST_FIELD btf_id

static int bpf_btf_get_fd_by_id(const union bpf_attr *attr)
{
	if (CHECK_ATTR(BPF_BTF_GET_FD_BY_ID))
		return -EINVAL;

	if (!capable(CAP_SYS_ADMIN))
		return -EPERM;

	return btf_get_fd_by_id(attr->btf_id);
}

3869 3870 3871 3872 3873 3874 3875 3876 3877 3878 3879 3880 3881 3882 3883 3884 3885 3886 3887 3888 3889 3890 3891 3892 3893 3894 3895 3896 3897 3898 3899 3900 3901 3902 3903 3904 3905 3906 3907 3908 3909 3910 3911 3912 3913 3914 3915 3916 3917 3918 3919 3920 3921 3922 3923 3924 3925 3926 3927 3928 3929 3930 3931 3932 3933 3934 3935 3936 3937 3938 3939 3940 3941
static int bpf_task_fd_query_copy(const union bpf_attr *attr,
				    union bpf_attr __user *uattr,
				    u32 prog_id, u32 fd_type,
				    const char *buf, u64 probe_offset,
				    u64 probe_addr)
{
	char __user *ubuf = u64_to_user_ptr(attr->task_fd_query.buf);
	u32 len = buf ? strlen(buf) : 0, input_len;
	int err = 0;

	if (put_user(len, &uattr->task_fd_query.buf_len))
		return -EFAULT;
	input_len = attr->task_fd_query.buf_len;
	if (input_len && ubuf) {
		if (!len) {
			/* nothing to copy, just make ubuf NULL terminated */
			char zero = '\0';

			if (put_user(zero, ubuf))
				return -EFAULT;
		} else if (input_len >= len + 1) {
			/* ubuf can hold the string with NULL terminator */
			if (copy_to_user(ubuf, buf, len + 1))
				return -EFAULT;
		} else {
			/* ubuf cannot hold the string with NULL terminator,
			 * do a partial copy with NULL terminator.
			 */
			char zero = '\0';

			err = -ENOSPC;
			if (copy_to_user(ubuf, buf, input_len - 1))
				return -EFAULT;
			if (put_user(zero, ubuf + input_len - 1))
				return -EFAULT;
		}
	}

	if (put_user(prog_id, &uattr->task_fd_query.prog_id) ||
	    put_user(fd_type, &uattr->task_fd_query.fd_type) ||
	    put_user(probe_offset, &uattr->task_fd_query.probe_offset) ||
	    put_user(probe_addr, &uattr->task_fd_query.probe_addr))
		return -EFAULT;

	return err;
}

#define BPF_TASK_FD_QUERY_LAST_FIELD task_fd_query.probe_addr

static int bpf_task_fd_query(const union bpf_attr *attr,
			     union bpf_attr __user *uattr)
{
	pid_t pid = attr->task_fd_query.pid;
	u32 fd = attr->task_fd_query.fd;
	const struct perf_event *event;
	struct task_struct *task;
	struct file *file;
	int err;

	if (CHECK_ATTR(BPF_TASK_FD_QUERY))
		return -EINVAL;

	if (!capable(CAP_SYS_ADMIN))
		return -EPERM;

	if (attr->task_fd_query.flags != 0)
		return -EINVAL;

	task = get_pid_task(find_vpid(pid), PIDTYPE_PID);
	if (!task)
		return -ENOENT;

	err = 0;
3942 3943
	file = fget_task(task, fd);
	put_task_struct(task);
3944
	if (!file)
3945
		return -EBADF;
3946

3947 3948
	if (file->f_op == &bpf_link_fops) {
		struct bpf_link *link = file->private_data;
3949

3950
		if (link->ops == &bpf_raw_tp_link_lops) {
3951 3952 3953 3954 3955 3956 3957 3958 3959 3960 3961
			struct bpf_raw_tp_link *raw_tp =
				container_of(link, struct bpf_raw_tp_link, link);
			struct bpf_raw_event_map *btp = raw_tp->btp;

			err = bpf_task_fd_query_copy(attr, uattr,
						     raw_tp->link.prog->aux->id,
						     BPF_FD_TYPE_RAW_TRACEPOINT,
						     btp->tp->name, 0, 0);
			goto put_file;
		}
		goto out_not_supp;
3962 3963 3964 3965 3966 3967 3968 3969 3970 3971 3972 3973 3974 3975 3976 3977 3978 3979 3980
	}

	event = perf_get_event(file);
	if (!IS_ERR(event)) {
		u64 probe_offset, probe_addr;
		u32 prog_id, fd_type;
		const char *buf;

		err = bpf_get_perf_event_info(event, &prog_id, &fd_type,
					      &buf, &probe_offset,
					      &probe_addr);
		if (!err)
			err = bpf_task_fd_query_copy(attr, uattr, prog_id,
						     fd_type, buf,
						     probe_offset,
						     probe_addr);
		goto put_file;
	}

3981
out_not_supp:
3982 3983 3984 3985 3986 3987
	err = -ENOTSUPP;
put_file:
	fput(file);
	return err;
}

3988 3989 3990 3991 3992 3993 3994 3995 3996 3997 3998 3999 4000 4001 4002 4003 4004 4005 4006 4007 4008 4009 4010 4011 4012 4013 4014 4015
#define BPF_MAP_BATCH_LAST_FIELD batch.flags

#define BPF_DO_BATCH(fn)			\
	do {					\
		if (!fn) {			\
			err = -ENOTSUPP;	\
			goto err_put;		\
		}				\
		err = fn(map, attr, uattr);	\
	} while (0)

static int bpf_map_do_batch(const union bpf_attr *attr,
			    union bpf_attr __user *uattr,
			    int cmd)
{
	struct bpf_map *map;
	int err, ufd;
	struct fd f;

	if (CHECK_ATTR(BPF_MAP_BATCH))
		return -EINVAL;

	ufd = attr->batch.map_fd;
	f = fdget(ufd);
	map = __bpf_map_get(f);
	if (IS_ERR(map))
		return PTR_ERR(map);

4016 4017
	if ((cmd == BPF_MAP_LOOKUP_BATCH ||
	     cmd == BPF_MAP_LOOKUP_AND_DELETE_BATCH) &&
4018 4019 4020 4021 4022 4023 4024 4025 4026 4027 4028 4029 4030
	    !(map_get_sys_perms(map, f) & FMODE_CAN_READ)) {
		err = -EPERM;
		goto err_put;
	}

	if (cmd != BPF_MAP_LOOKUP_BATCH &&
	    !(map_get_sys_perms(map, f) & FMODE_CAN_WRITE)) {
		err = -EPERM;
		goto err_put;
	}

	if (cmd == BPF_MAP_LOOKUP_BATCH)
		BPF_DO_BATCH(map->ops->map_lookup_batch);
4031 4032
	else if (cmd == BPF_MAP_LOOKUP_AND_DELETE_BATCH)
		BPF_DO_BATCH(map->ops->map_lookup_and_delete_batch);
4033 4034 4035 4036
	else if (cmd == BPF_MAP_UPDATE_BATCH)
		BPF_DO_BATCH(map->ops->map_update_batch);
	else
		BPF_DO_BATCH(map->ops->map_delete_batch);
4037 4038 4039 4040 4041 4042

err_put:
	fdput(f);
	return err;
}

4043 4044
static int tracing_bpf_link_attach(const union bpf_attr *attr, bpfptr_t uattr,
				   struct bpf_prog *prog)
4045
{
4046 4047
	if (attr->link_create.attach_type != prog->expected_attach_type)
		return -EINVAL;
4048

4049
	if (prog->expected_attach_type == BPF_TRACE_ITER)
4050
		return bpf_iter_link_attach(attr, uattr, prog);
4051 4052 4053 4054
	else if (prog->type == BPF_PROG_TYPE_EXT)
		return bpf_tracing_prog_attach(prog,
					       attr->link_create.target_fd,
					       attr->link_create.target_btf_id);
4055 4056 4057
	return -EINVAL;
}

4058
#define BPF_LINK_CREATE_LAST_FIELD link_create.iter_info_len
4059
static int link_create(union bpf_attr *attr, bpfptr_t uattr)
4060 4061 4062 4063 4064 4065 4066 4067
{
	enum bpf_prog_type ptype;
	struct bpf_prog *prog;
	int ret;

	if (CHECK_ATTR(BPF_LINK_CREATE))
		return -EINVAL;

4068
	prog = bpf_prog_get(attr->link_create.prog_fd);
4069 4070 4071 4072 4073 4074
	if (IS_ERR(prog))
		return PTR_ERR(prog);

	ret = bpf_prog_attach_check_attach_type(prog,
						attr->link_create.attach_type);
	if (ret)
4075 4076 4077
		goto out;

	if (prog->type == BPF_PROG_TYPE_EXT) {
4078
		ret = tracing_bpf_link_attach(attr, uattr, prog);
4079 4080 4081 4082 4083 4084 4085 4086
		goto out;
	}

	ptype = attach_type_to_prog_type(attr->link_create.attach_type);
	if (ptype == BPF_PROG_TYPE_UNSPEC || ptype != prog->type) {
		ret = -EINVAL;
		goto out;
	}
4087 4088 4089 4090 4091 4092 4093 4094 4095 4096 4097

	switch (ptype) {
	case BPF_PROG_TYPE_CGROUP_SKB:
	case BPF_PROG_TYPE_CGROUP_SOCK:
	case BPF_PROG_TYPE_CGROUP_SOCK_ADDR:
	case BPF_PROG_TYPE_SOCK_OPS:
	case BPF_PROG_TYPE_CGROUP_DEVICE:
	case BPF_PROG_TYPE_CGROUP_SYSCTL:
	case BPF_PROG_TYPE_CGROUP_SOCKOPT:
		ret = cgroup_bpf_link_attach(attr, prog);
		break;
4098
	case BPF_PROG_TYPE_TRACING:
4099
		ret = tracing_bpf_link_attach(attr, uattr, prog);
4100
		break;
4101
	case BPF_PROG_TYPE_FLOW_DISSECTOR:
4102
	case BPF_PROG_TYPE_SK_LOOKUP:
4103 4104
		ret = netns_bpf_link_create(attr, prog);
		break;
4105
#ifdef CONFIG_NET
4106 4107 4108
	case BPF_PROG_TYPE_XDP:
		ret = bpf_xdp_link_attach(attr, prog);
		break;
4109
#endif
4110 4111 4112 4113
	default:
		ret = -EINVAL;
	}

4114
out:
4115 4116 4117 4118 4119
	if (ret < 0)
		bpf_prog_put(prog);
	return ret;
}

4120 4121 4122 4123 4124 4125 4126 4127 4128 4129 4130 4131 4132 4133 4134 4135 4136 4137 4138 4139 4140
#define BPF_LINK_UPDATE_LAST_FIELD link_update.old_prog_fd

static int link_update(union bpf_attr *attr)
{
	struct bpf_prog *old_prog = NULL, *new_prog;
	struct bpf_link *link;
	u32 flags;
	int ret;

	if (CHECK_ATTR(BPF_LINK_UPDATE))
		return -EINVAL;

	flags = attr->link_update.flags;
	if (flags & ~BPF_F_REPLACE)
		return -EINVAL;

	link = bpf_link_get_from_fd(attr->link_update.link_fd);
	if (IS_ERR(link))
		return PTR_ERR(link);

	new_prog = bpf_prog_get(attr->link_update.new_prog_fd);
4141 4142 4143 4144
	if (IS_ERR(new_prog)) {
		ret = PTR_ERR(new_prog);
		goto out_put_link;
	}
4145 4146 4147 4148 4149 4150 4151 4152

	if (flags & BPF_F_REPLACE) {
		old_prog = bpf_prog_get(attr->link_update.old_prog_fd);
		if (IS_ERR(old_prog)) {
			ret = PTR_ERR(old_prog);
			old_prog = NULL;
			goto out_put_progs;
		}
4153 4154 4155
	} else if (attr->link_update.old_prog_fd) {
		ret = -EINVAL;
		goto out_put_progs;
4156 4157
	}

4158 4159 4160
	if (link->ops->update_prog)
		ret = link->ops->update_prog(link, new_prog, old_prog);
	else
4161
		ret = -EINVAL;
4162 4163 4164 4165 4166 4167

out_put_progs:
	if (old_prog)
		bpf_prog_put(old_prog);
	if (ret)
		bpf_prog_put(new_prog);
4168 4169
out_put_link:
	bpf_link_put(link);
4170 4171 4172
	return ret;
}

4173 4174 4175 4176 4177 4178 4179 4180 4181 4182 4183 4184 4185 4186 4187 4188 4189 4190 4191 4192 4193 4194 4195
#define BPF_LINK_DETACH_LAST_FIELD link_detach.link_fd

static int link_detach(union bpf_attr *attr)
{
	struct bpf_link *link;
	int ret;

	if (CHECK_ATTR(BPF_LINK_DETACH))
		return -EINVAL;

	link = bpf_link_get_from_fd(attr->link_detach.link_fd);
	if (IS_ERR(link))
		return PTR_ERR(link);

	if (link->ops->detach)
		ret = link->ops->detach(link);
	else
		ret = -EOPNOTSUPP;

	bpf_link_put(link);
	return ret;
}

4196
static struct bpf_link *bpf_link_inc_not_zero(struct bpf_link *link)
4197
{
4198
	return atomic64_fetch_add_unless(&link->refcnt, 1, 0) ? link : ERR_PTR(-ENOENT);
4199 4200
}

4201
struct bpf_link *bpf_link_by_id(u32 id)
4202 4203 4204
{
	struct bpf_link *link;

4205 4206
	if (!id)
		return ERR_PTR(-ENOENT);
4207 4208 4209

	spin_lock_bh(&link_idr_lock);
	/* before link is "settled", ID is 0, pretend it doesn't exist yet */
4210
	link = idr_find(&link_idr, id);
4211 4212
	if (link) {
		if (link->id)
4213
			link = bpf_link_inc_not_zero(link);
4214
		else
4215
			link = ERR_PTR(-EAGAIN);
4216
	} else {
4217
		link = ERR_PTR(-ENOENT);
4218 4219
	}
	spin_unlock_bh(&link_idr_lock);
4220 4221
	return link;
}
4222

4223 4224 4225 4226 4227 4228 4229 4230 4231 4232 4233 4234 4235 4236 4237 4238 4239
#define BPF_LINK_GET_FD_BY_ID_LAST_FIELD link_id

static int bpf_link_get_fd_by_id(const union bpf_attr *attr)
{
	struct bpf_link *link;
	u32 id = attr->link_id;
	int fd;

	if (CHECK_ATTR(BPF_LINK_GET_FD_BY_ID))
		return -EINVAL;

	if (!capable(CAP_SYS_ADMIN))
		return -EPERM;

	link = bpf_link_by_id(id);
	if (IS_ERR(link))
		return PTR_ERR(link);
4240 4241 4242 4243 4244 4245 4246 4247

	fd = bpf_link_new_fd(link);
	if (fd < 0)
		bpf_link_put(link);

	return fd;
}

4248 4249 4250 4251 4252 4253 4254 4255 4256 4257 4258 4259 4260 4261 4262 4263 4264 4265 4266 4267 4268 4269 4270 4271 4272 4273 4274 4275 4276 4277 4278 4279 4280 4281 4282 4283 4284 4285 4286 4287 4288 4289 4290 4291 4292 4293 4294 4295 4296 4297 4298 4299 4300 4301
DEFINE_MUTEX(bpf_stats_enabled_mutex);

static int bpf_stats_release(struct inode *inode, struct file *file)
{
	mutex_lock(&bpf_stats_enabled_mutex);
	static_key_slow_dec(&bpf_stats_enabled_key.key);
	mutex_unlock(&bpf_stats_enabled_mutex);
	return 0;
}

static const struct file_operations bpf_stats_fops = {
	.release = bpf_stats_release,
};

static int bpf_enable_runtime_stats(void)
{
	int fd;

	mutex_lock(&bpf_stats_enabled_mutex);

	/* Set a very high limit to avoid overflow */
	if (static_key_count(&bpf_stats_enabled_key.key) > INT_MAX / 2) {
		mutex_unlock(&bpf_stats_enabled_mutex);
		return -EBUSY;
	}

	fd = anon_inode_getfd("bpf-stats", &bpf_stats_fops, NULL, O_CLOEXEC);
	if (fd >= 0)
		static_key_slow_inc(&bpf_stats_enabled_key.key);

	mutex_unlock(&bpf_stats_enabled_mutex);
	return fd;
}

#define BPF_ENABLE_STATS_LAST_FIELD enable_stats.type

static int bpf_enable_stats(union bpf_attr *attr)
{

	if (CHECK_ATTR(BPF_ENABLE_STATS))
		return -EINVAL;

	if (!capable(CAP_SYS_ADMIN))
		return -EPERM;

	switch (attr->enable_stats.type) {
	case BPF_STATS_RUN_TIME:
		return bpf_enable_runtime_stats();
	default:
		break;
	}
	return -EINVAL;
}

4302 4303 4304 4305 4306 4307 4308 4309 4310 4311 4312 4313 4314 4315 4316 4317 4318 4319 4320 4321 4322 4323 4324
#define BPF_ITER_CREATE_LAST_FIELD iter_create.flags

static int bpf_iter_create(union bpf_attr *attr)
{
	struct bpf_link *link;
	int err;

	if (CHECK_ATTR(BPF_ITER_CREATE))
		return -EINVAL;

	if (attr->iter_create.flags)
		return -EINVAL;

	link = bpf_link_get_from_fd(attr->iter_create.link_fd);
	if (IS_ERR(link))
		return PTR_ERR(link);

	err = bpf_iter_new_fd(link);
	bpf_link_put(link);

	return err;
}

4325 4326 4327 4328 4329 4330 4331 4332 4333 4334 4335 4336 4337 4338 4339 4340 4341 4342 4343 4344 4345 4346 4347 4348 4349 4350 4351 4352 4353 4354
#define BPF_PROG_BIND_MAP_LAST_FIELD prog_bind_map.flags

static int bpf_prog_bind_map(union bpf_attr *attr)
{
	struct bpf_prog *prog;
	struct bpf_map *map;
	struct bpf_map **used_maps_old, **used_maps_new;
	int i, ret = 0;

	if (CHECK_ATTR(BPF_PROG_BIND_MAP))
		return -EINVAL;

	if (attr->prog_bind_map.flags)
		return -EINVAL;

	prog = bpf_prog_get(attr->prog_bind_map.prog_fd);
	if (IS_ERR(prog))
		return PTR_ERR(prog);

	map = bpf_map_get(attr->prog_bind_map.map_fd);
	if (IS_ERR(map)) {
		ret = PTR_ERR(map);
		goto out_prog_put;
	}

	mutex_lock(&prog->aux->used_maps_mutex);

	used_maps_old = prog->aux->used_maps;

	for (i = 0; i < prog->aux->used_map_cnt; i++)
4355 4356
		if (used_maps_old[i] == map) {
			bpf_map_put(map);
4357
			goto out_unlock;
4358
		}
4359 4360 4361 4362 4363 4364 4365 4366 4367 4368 4369 4370 4371 4372 4373 4374 4375 4376 4377 4378 4379 4380 4381 4382 4383 4384 4385 4386

	used_maps_new = kmalloc_array(prog->aux->used_map_cnt + 1,
				      sizeof(used_maps_new[0]),
				      GFP_KERNEL);
	if (!used_maps_new) {
		ret = -ENOMEM;
		goto out_unlock;
	}

	memcpy(used_maps_new, used_maps_old,
	       sizeof(used_maps_old[0]) * prog->aux->used_map_cnt);
	used_maps_new[prog->aux->used_map_cnt] = map;

	prog->aux->used_map_cnt++;
	prog->aux->used_maps = used_maps_new;

	kfree(used_maps_old);

out_unlock:
	mutex_unlock(&prog->aux->used_maps_mutex);

	if (ret)
		bpf_map_put(map);
out_prog_put:
	bpf_prog_put(prog);
	return ret;
}

4387
static int __sys_bpf(int cmd, bpfptr_t uattr, unsigned int size)
4388
{
4389
	union bpf_attr attr;
4390 4391
	int err;

4392
	if (sysctl_unprivileged_bpf_disabled && !bpf_capable())
4393 4394
		return -EPERM;

4395
	err = bpf_check_uarg_tail_zero(uattr, sizeof(attr), size);
4396 4397 4398
	if (err)
		return err;
	size = min_t(u32, size, sizeof(attr));
4399 4400

	/* copy attributes from user space, may be less than sizeof(bpf_attr) */
4401
	memset(&attr, 0, sizeof(attr));
4402
	if (copy_from_bpfptr(&attr, uattr, size) != 0)
4403 4404
		return -EFAULT;

4405 4406 4407 4408
	err = security_bpf(cmd, &attr, size);
	if (err < 0)
		return err;

4409 4410 4411 4412
	switch (cmd) {
	case BPF_MAP_CREATE:
		err = map_create(&attr);
		break;
4413 4414 4415 4416
	case BPF_MAP_LOOKUP_ELEM:
		err = map_lookup_elem(&attr);
		break;
	case BPF_MAP_UPDATE_ELEM:
4417
		err = map_update_elem(&attr, uattr);
4418 4419 4420 4421 4422 4423 4424
		break;
	case BPF_MAP_DELETE_ELEM:
		err = map_delete_elem(&attr);
		break;
	case BPF_MAP_GET_NEXT_KEY:
		err = map_get_next_key(&attr);
		break;
4425 4426 4427
	case BPF_MAP_FREEZE:
		err = map_freeze(&attr);
		break;
4428
	case BPF_PROG_LOAD:
4429
		err = bpf_prog_load(&attr, uattr);
4430
		break;
4431 4432 4433 4434 4435 4436
	case BPF_OBJ_PIN:
		err = bpf_obj_pin(&attr);
		break;
	case BPF_OBJ_GET:
		err = bpf_obj_get(&attr);
		break;
4437 4438 4439 4440 4441 4442
	case BPF_PROG_ATTACH:
		err = bpf_prog_attach(&attr);
		break;
	case BPF_PROG_DETACH:
		err = bpf_prog_detach(&attr);
		break;
4443
	case BPF_PROG_QUERY:
4444
		err = bpf_prog_query(&attr, uattr.user);
4445
		break;
4446
	case BPF_PROG_TEST_RUN:
4447
		err = bpf_prog_test_run(&attr, uattr.user);
4448
		break;
4449
	case BPF_PROG_GET_NEXT_ID:
4450
		err = bpf_obj_get_next_id(&attr, uattr.user,
4451 4452 4453
					  &prog_idr, &prog_idr_lock);
		break;
	case BPF_MAP_GET_NEXT_ID:
4454
		err = bpf_obj_get_next_id(&attr, uattr.user,
4455 4456
					  &map_idr, &map_idr_lock);
		break;
4457
	case BPF_BTF_GET_NEXT_ID:
4458
		err = bpf_obj_get_next_id(&attr, uattr.user,
4459 4460
					  &btf_idr, &btf_idr_lock);
		break;
4461 4462 4463
	case BPF_PROG_GET_FD_BY_ID:
		err = bpf_prog_get_fd_by_id(&attr);
		break;
4464 4465 4466
	case BPF_MAP_GET_FD_BY_ID:
		err = bpf_map_get_fd_by_id(&attr);
		break;
4467
	case BPF_OBJ_GET_INFO_BY_FD:
4468
		err = bpf_obj_get_info_by_fd(&attr, uattr.user);
4469
		break;
4470 4471 4472
	case BPF_RAW_TRACEPOINT_OPEN:
		err = bpf_raw_tracepoint_open(&attr);
		break;
4473
	case BPF_BTF_LOAD:
4474
		err = bpf_btf_load(&attr, uattr);
4475
		break;
4476 4477 4478
	case BPF_BTF_GET_FD_BY_ID:
		err = bpf_btf_get_fd_by_id(&attr);
		break;
4479
	case BPF_TASK_FD_QUERY:
4480
		err = bpf_task_fd_query(&attr, uattr.user);
4481
		break;
4482 4483 4484
	case BPF_MAP_LOOKUP_AND_DELETE_ELEM:
		err = map_lookup_and_delete_elem(&attr);
		break;
4485
	case BPF_MAP_LOOKUP_BATCH:
4486
		err = bpf_map_do_batch(&attr, uattr.user, BPF_MAP_LOOKUP_BATCH);
4487
		break;
4488
	case BPF_MAP_LOOKUP_AND_DELETE_BATCH:
4489
		err = bpf_map_do_batch(&attr, uattr.user,
4490 4491
				       BPF_MAP_LOOKUP_AND_DELETE_BATCH);
		break;
4492
	case BPF_MAP_UPDATE_BATCH:
4493
		err = bpf_map_do_batch(&attr, uattr.user, BPF_MAP_UPDATE_BATCH);
4494 4495
		break;
	case BPF_MAP_DELETE_BATCH:
4496
		err = bpf_map_do_batch(&attr, uattr.user, BPF_MAP_DELETE_BATCH);
4497
		break;
4498
	case BPF_LINK_CREATE:
4499
		err = link_create(&attr, uattr);
4500
		break;
4501 4502 4503
	case BPF_LINK_UPDATE:
		err = link_update(&attr);
		break;
4504 4505 4506 4507
	case BPF_LINK_GET_FD_BY_ID:
		err = bpf_link_get_fd_by_id(&attr);
		break;
	case BPF_LINK_GET_NEXT_ID:
4508
		err = bpf_obj_get_next_id(&attr, uattr.user,
4509 4510
					  &link_idr, &link_idr_lock);
		break;
4511 4512 4513
	case BPF_ENABLE_STATS:
		err = bpf_enable_stats(&attr);
		break;
4514 4515 4516
	case BPF_ITER_CREATE:
		err = bpf_iter_create(&attr);
		break;
4517 4518 4519
	case BPF_LINK_DETACH:
		err = link_detach(&attr);
		break;
4520 4521 4522
	case BPF_PROG_BIND_MAP:
		err = bpf_prog_bind_map(&attr);
		break;
4523 4524 4525 4526 4527 4528 4529
	default:
		err = -EINVAL;
		break;
	}

	return err;
}
4530

4531 4532 4533 4534 4535
SYSCALL_DEFINE3(bpf, int, cmd, union bpf_attr __user *, uattr, unsigned int, size)
{
	return __sys_bpf(cmd, USER_BPFPTR(uattr), size);
}

4536 4537 4538 4539 4540 4541 4542 4543 4544 4545 4546 4547 4548 4549
static bool syscall_prog_is_valid_access(int off, int size,
					 enum bpf_access_type type,
					 const struct bpf_prog *prog,
					 struct bpf_insn_access_aux *info)
{
	if (off < 0 || off >= U16_MAX)
		return false;
	if (off % size != 0)
		return false;
	return true;
}

BPF_CALL_3(bpf_sys_bpf, int, cmd, void *, attr, u32, attr_size)
{
4550 4551 4552 4553 4554
	switch (cmd) {
	case BPF_MAP_CREATE:
	case BPF_MAP_UPDATE_ELEM:
	case BPF_MAP_FREEZE:
	case BPF_PROG_LOAD:
4555
	case BPF_BTF_LOAD:
4556 4557 4558 4559 4560 4561 4562 4563
		break;
	/* case BPF_PROG_TEST_RUN:
	 * is not part of this list to prevent recursive test_run
	 */
	default:
		return -EINVAL;
	}
	return __sys_bpf(cmd, KERNEL_BPFPTR(attr), attr_size);
4564 4565 4566 4567 4568 4569 4570 4571 4572 4573 4574 4575 4576 4577 4578 4579 4580
}

const struct bpf_func_proto bpf_sys_bpf_proto = {
	.func		= bpf_sys_bpf,
	.gpl_only	= false,
	.ret_type	= RET_INTEGER,
	.arg1_type	= ARG_ANYTHING,
	.arg2_type	= ARG_PTR_TO_MEM,
	.arg3_type	= ARG_CONST_SIZE,
};

const struct bpf_func_proto * __weak
tracing_prog_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
{
	return bpf_base_func_proto(func_id);
}

4581 4582 4583 4584 4585 4586 4587 4588 4589 4590 4591 4592 4593 4594 4595 4596 4597
BPF_CALL_1(bpf_sys_close, u32, fd)
{
	/* When bpf program calls this helper there should not be
	 * an fdget() without matching completed fdput().
	 * This helper is allowed in the following callchain only:
	 * sys_bpf->prog_test_run->bpf_prog->bpf_sys_close
	 */
	return close_fd(fd);
}

const struct bpf_func_proto bpf_sys_close_proto = {
	.func		= bpf_sys_close,
	.gpl_only	= false,
	.ret_type	= RET_INTEGER,
	.arg1_type	= ARG_ANYTHING,
};

4598 4599 4600 4601 4602 4603
static const struct bpf_func_proto *
syscall_prog_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
{
	switch (func_id) {
	case BPF_FUNC_sys_bpf:
		return &bpf_sys_bpf_proto;
4604 4605
	case BPF_FUNC_btf_find_by_name_kind:
		return &bpf_btf_find_by_name_kind_proto;
4606 4607
	case BPF_FUNC_sys_close:
		return &bpf_sys_close_proto;
4608 4609 4610 4611 4612 4613 4614 4615 4616 4617 4618 4619 4620
	default:
		return tracing_prog_func_proto(func_id, prog);
	}
}

const struct bpf_verifier_ops bpf_syscall_verifier_ops = {
	.get_func_proto  = syscall_prog_func_proto,
	.is_valid_access = syscall_prog_is_valid_access,
};

const struct bpf_prog_ops bpf_syscall_prog_ops = {
	.test_run = bpf_prog_test_run_syscall,
};