Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf

Alexei Starovoitov says:

====================
pull-request: bpf 2018-12-05

The following pull-request contains BPF updates for your *net* tree.

The main changes are:

1) fix bpf uapi pointers for 32-bit architectures, from Daniel.

2) improve verifer ability to handle progs with a lot of branches, from Alexei.

3) strict btf checks, from Yonghong.

4) bpf_sk_lookup api cleanup, from Joe.

5) other misc fixes
====================

Signed-off-by: David S. Miller <davem@davemloft.net>

2 files changed, 29 insertions, 19 deletions

diff --git a/net/bpf/test_run.c b/net/bpf/test_run.c
index c89c22c49015..25001913d03b 100644
--- a/net/bpf/test_run.c
+++ b/net/bpf/test_run.c
@@ -28,12 +28,13 @@ static __always_inline u32 bpf_test_run_one(struct bpf_prog *prog, void *ctx,
         return ret;
 }
 
-static u32 bpf_test_run(struct bpf_prog *prog, void *ctx, u32 repeat, u32 *time)
+static int bpf_test_run(struct bpf_prog *prog, void *ctx, u32 repeat, u32 *ret,
+                        u32 *time)
 {
         struct bpf_cgroup_storage *storage[MAX_BPF_CGROUP_STORAGE_TYPE] = { 0 };
         enum bpf_cgroup_storage_type stype;
         u64 time_start, time_spent = 0;
-        u32 ret = 0, i;
+        u32 i;
 
         for_each_cgroup_storage_type(stype) {
                 storage[stype] = bpf_cgroup_storage_alloc(prog, stype);
@@ -49,7 +50,7 @@ static u32 bpf_test_run(struct bpf_prog *prog, void *ctx, u32 repeat, u32 *time)
                 repeat = 1;
         time_start = ktime_get_ns();
         for (i = 0; i < repeat; i++) {
-                ret = bpf_test_run_one(prog, ctx, storage);
+                *ret = bpf_test_run_one(prog, ctx, storage);
                 if (need_resched()) {
                         if (signal_pending(current))
                                 break;
@@ -65,7 +66,7 @@ static u32 bpf_test_run(struct bpf_prog *prog, void *ctx, u32 repeat, u32 *time)
         for_each_cgroup_storage_type(stype)
                 bpf_cgroup_storage_free(storage[stype]);
 
-        return ret;
+        return 0;
 }
 
 static int bpf_test_finish(const union bpf_attr *kattr,
@@ -165,7 +166,12 @@ int bpf_prog_test_run_skb(struct bpf_prog *prog, const union bpf_attr *kattr,
                 __skb_push(skb, hh_len);
         if (is_direct_pkt_access)
                 bpf_compute_data_pointers(skb);
-        retval = bpf_test_run(prog, skb, repeat, &duration);
+        ret = bpf_test_run(prog, skb, repeat, &retval, &duration);
+        if (ret) {
+                kfree_skb(skb);
+                kfree(sk);
+                return ret;
+        }
         if (!is_l2) {
                 if (skb_headroom(skb) < hh_len) {
                         int nhead = HH_DATA_ALIGN(hh_len - skb_headroom(skb));
@@ -212,11 +218,14 @@ int bpf_prog_test_run_xdp(struct bpf_prog *prog, const union bpf_attr *kattr,
         rxqueue = __netif_get_rx_queue(current->nsproxy->net_ns->loopback_dev, 0);
         xdp.rxq = &rxqueue->xdp_rxq;
 
-        retval = bpf_test_run(prog, &xdp, repeat, &duration);
+        ret = bpf_test_run(prog, &xdp, repeat, &retval, &duration);
+        if (ret)
+                goto out;
         if (xdp.data != data + XDP_PACKET_HEADROOM + NET_IP_ALIGN ||
             xdp.data_end != xdp.data + size)
                 size = xdp.data_end - xdp.data;
         ret = bpf_test_finish(kattr, uattr, xdp.data, size, retval, duration);
+out:
         kfree(data);
         return ret;
 }
diff --git a/net/core/filter.c b/net/core/filter.c
index 9a1327eb25fa..8d2c629501e2 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -4890,22 +4890,23 @@ bpf_sk_lookup(struct sk_buff *skb, struct bpf_sock_tuple *tuple, u32 len,
         struct net *net;
 
         family = len == sizeof(tuple->ipv4) ? AF_INET : AF_INET6;
-        if (unlikely(family == AF_UNSPEC || netns_id > U32_MAX || flags))
+        if (unlikely(family == AF_UNSPEC || flags ||
+                     !((s32)netns_id < 0 || netns_id <= S32_MAX)))
                 goto out;
 
         if (skb->dev)
                 caller_net = dev_net(skb->dev);
         else
                 caller_net = sock_net(skb->sk);
-        if (netns_id) {
+        if ((s32)netns_id < 0) {
+                net = caller_net;
+                sk = sk_lookup(net, tuple, skb, family, proto);
+        } else {
                 net = get_net_ns_by_id(caller_net, netns_id);
                 if (unlikely(!net))
                         goto out;
                 sk = sk_lookup(net, tuple, skb, family, proto);
                 put_net(net);
-        } else {
-                net = caller_net;
-                sk = sk_lookup(net, tuple, skb, family, proto);
         }
 
         if (sk)
@@ -5435,8 +5436,8 @@ static bool bpf_skb_is_valid_access(int off, int size, enum bpf_access_type type
                 if (size != size_default)
                         return false;
                 break;
-        case bpf_ctx_range(struct __sk_buff, flow_keys):
-                if (size != sizeof(struct bpf_flow_keys *))
+        case bpf_ctx_range_ptr(struct __sk_buff, flow_keys):
+                if (size != sizeof(__u64))
                         return false;
                 break;
         default:
@@ -5464,7 +5465,7 @@ static bool sk_filter_is_valid_access(int off, int size,
         case bpf_ctx_range(struct __sk_buff, data):
         case bpf_ctx_range(struct __sk_buff, data_meta):
         case bpf_ctx_range(struct __sk_buff, data_end):
-        case bpf_ctx_range(struct __sk_buff, flow_keys):
+        case bpf_ctx_range_ptr(struct __sk_buff, flow_keys):
         case bpf_ctx_range_till(struct __sk_buff, family, local_port):
                 return false;
         }
@@ -5489,7 +5490,7 @@ static bool cg_skb_is_valid_access(int off, int size,
         switch (off) {
         case bpf_ctx_range(struct __sk_buff, tc_classid):
         case bpf_ctx_range(struct __sk_buff, data_meta):
-        case bpf_ctx_range(struct __sk_buff, flow_keys):
+        case bpf_ctx_range_ptr(struct __sk_buff, flow_keys):
                 return false;
         case bpf_ctx_range(struct __sk_buff, data):
         case bpf_ctx_range(struct __sk_buff, data_end):
@@ -5530,7 +5531,7 @@ static bool lwt_is_valid_access(int off, int size,
         case bpf_ctx_range(struct __sk_buff, tc_classid):
         case bpf_ctx_range_till(struct __sk_buff, family, local_port):
         case bpf_ctx_range(struct __sk_buff, data_meta):
-        case bpf_ctx_range(struct __sk_buff, flow_keys):
+        case bpf_ctx_range_ptr(struct __sk_buff, flow_keys):
                 return false;
         }
 
@@ -5756,7 +5757,7 @@ static bool tc_cls_act_is_valid_access(int off, int size,
         case bpf_ctx_range(struct __sk_buff, data_end):
                 info->reg_type = PTR_TO_PACKET_END;
                 break;
-        case bpf_ctx_range(struct __sk_buff, flow_keys):
+        case bpf_ctx_range_ptr(struct __sk_buff, flow_keys):
         case bpf_ctx_range_till(struct __sk_buff, family, local_port):
                 return false;
         }
@@ -5958,7 +5959,7 @@ static bool sk_skb_is_valid_access(int off, int size,
         switch (off) {
         case bpf_ctx_range(struct __sk_buff, tc_classid):
         case bpf_ctx_range(struct __sk_buff, data_meta):
-        case bpf_ctx_range(struct __sk_buff, flow_keys):
+        case bpf_ctx_range_ptr(struct __sk_buff, flow_keys):
                 return false;
         }
 
@@ -6039,7 +6040,7 @@ static bool flow_dissector_is_valid_access(int off, int size,
         case bpf_ctx_range(struct __sk_buff, data_end):
                 info->reg_type = PTR_TO_PACKET_END;
                 break;
-        case bpf_ctx_range(struct __sk_buff, flow_keys):
+        case bpf_ctx_range_ptr(struct __sk_buff, flow_keys):
                 info->reg_type = PTR_TO_FLOW_KEYS;
                 break;
         case bpf_ctx_range(struct __sk_buff, tc_classid):