Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

Pull networking fixes from David Miller:

 1) GRO overflow entries are not unlinked properly, resulting in list
    poison pointers being dereferenced.

 2) Fix bridge build with ipv6 disabled, from Nikolay Aleksandrov.

 3) Direct packet access and other fixes in BPF from Daniel Borkmann.

 4) gred_change_table_def() gets passed the wrong pointer, a pointer to
    a set of unparsed attributes instead of the attribute itself. From
    Jakub Kicinski.

 5) Allow macsec device to be brought up even if it's lowerdev is down,
    from Sabrina Dubroca.

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net:
  net: diag: document swapped src/dst in udp_dump_one.
  macsec: let the administrator set UP state even if lowerdev is down
  macsec: update operstate when lower device changes
  net: sched: gred: pass the right attribute to gred_change_table_def()
  ptp: drop redundant kasprintf() to create worker name
  net: bridge: remove ipv6 zero address check in mcast queries
  net: Properly unlink GRO packets on overflow.
  bpf: fix wrong helper enablement in cgroup local storage
  bpf: add bpf_jit_limit knob to restrict unpriv allocations
  bpf: make direct packet write unclone more robust
  bpf: fix leaking uninitialized memory on pop/peek helpers
  bpf: fix direct packet write into pop/peek helpers
  bpf: fix cg_skb types to hint access type in may_access_direct_pkt_data
  bpf: fix direct packet access for flow dissector progs
  bpf: disallow direct packet access for unpriv in cg_skb
  bpf: fix test suite to enable all unpriv program types
  bpf, btf: fix a missing check bug in btf_parse
  selftests/bpf: add config fragments BPF_STREAM_PARSER and XDP_SOCKETS
  bpf: devmap: fix wrong interface selection in notifier_call

1 files changed, 46 insertions, 3 deletions

diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
index 7c7eeea8cffc..6377225b2082 100644
--- a/kernel/bpf/core.c
+++ b/kernel/bpf/core.c
@@ -365,10 +365,13 @@ void bpf_prog_kallsyms_del_all(struct bpf_prog *fp)
 }
 
 #ifdef CONFIG_BPF_JIT
+# define BPF_JIT_LIMIT_DEFAULT  (PAGE_SIZE * 40000)
+
 /* All BPF JIT sysctl knobs here. */
 int bpf_jit_enable   __read_mostly = IS_BUILTIN(CONFIG_BPF_JIT_ALWAYS_ON);
 int bpf_jit_harden   __read_mostly;
 int bpf_jit_kallsyms __read_mostly;
+int bpf_jit_limit    __read_mostly = BPF_JIT_LIMIT_DEFAULT;
 
 static __always_inline void
 bpf_get_prog_addr_region(const struct bpf_prog *prog,
@@ -577,27 +580,64 @@ int bpf_get_kallsym(unsigned int symnum, unsigned long *value, char *type,
         return ret;
 }
 
+static atomic_long_t bpf_jit_current;
+
+#if defined(MODULES_VADDR)
+static int __init bpf_jit_charge_init(void)
+{
+        /* Only used as heuristic here to derive limit. */
+        bpf_jit_limit = min_t(u64, round_up((MODULES_END - MODULES_VADDR) >> 2,
+                                            PAGE_SIZE), INT_MAX);
+        return 0;
+}
+pure_initcall(bpf_jit_charge_init);
+#endif
+
+static int bpf_jit_charge_modmem(u32 pages)
+{
+        if (atomic_long_add_return(pages, &bpf_jit_current) >
+            (bpf_jit_limit >> PAGE_SHIFT)) {
+                if (!capable(CAP_SYS_ADMIN)) {
+                        atomic_long_sub(pages, &bpf_jit_current);
+                        return -EPERM;
+                }
+        }
+
+        return 0;
+}
+
+static void bpf_jit_uncharge_modmem(u32 pages)
+{
+        atomic_long_sub(pages, &bpf_jit_current);
+}
+
 struct bpf_binary_header *
 bpf_jit_binary_alloc(unsigned int proglen, u8 **image_ptr,
                      unsigned int alignment,
                      bpf_jit_fill_hole_t bpf_fill_ill_insns)
 {
         struct bpf_binary_header *hdr;
-        unsigned int size, hole, start;
+        u32 size, hole, start, pages;
 
         /* Most of BPF filters are really small, but if some of them
          * fill a page, allow at least 128 extra bytes to insert a
          * random section of illegal instructions.
          */
         size = round_up(proglen + sizeof(*hdr) + 128, PAGE_SIZE);
+        pages = size / PAGE_SIZE;
+
+        if (bpf_jit_charge_modmem(pages))
+                return NULL;
         hdr = module_alloc(size);
-        if (hdr == NULL)
+        if (!hdr) {
+                bpf_jit_uncharge_modmem(pages);
                 return NULL;
+        }
 
         /* Fill space with illegal/arch-dep instructions. */
         bpf_fill_ill_insns(hdr, size);
 
-        hdr->pages = size / PAGE_SIZE;
+        hdr->pages = pages;
         hole = min_t(unsigned int, size - (proglen + sizeof(*hdr)),
                      PAGE_SIZE - sizeof(*hdr));
         start = (get_random_int() % hole) & ~(alignment - 1);
@@ -610,7 +650,10 @@ bpf_jit_binary_alloc(unsigned int proglen, u8 **image_ptr,
 
 void bpf_jit_binary_free(struct bpf_binary_header *hdr)
 {
+        u32 pages = hdr->pages;
+
         module_memfree(hdr);
+        bpf_jit_uncharge_modmem(pages);
 }
 
 /* This symbol is only overridden by archs that have different