Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf

Daniel Borkmann says:

====================
pull-request: bpf 2019-10-27

The following pull-request contains BPF updates for your *net* tree.

We've added 7 non-merge commits during the last 11 day(s) which contain
a total of 7 files changed, 66 insertions(+), 16 deletions(-).

The main changes are:

1) Fix two use-after-free bugs in relation to RCU in jited symbol exposure to
   kallsyms, from Daniel Borkmann.

2) Fix NULL pointer dereference in AF_XDP rx-only sockets, from Magnus Karlsson.

3) Fix hang in netdev unregister for hash based devmap as well as another overflow
   bug on 32 bit archs in memlock cost calculation, from Toke Høiland-Jørgensen.

4) Fix wrong memory access in LWT BPF programs on reroute due to invalid dst.
   Also fix BPF selftests to use more compatible nc options, from Jiri Benc.
====================

Signed-off-by: David S. Miller <davem@davemloft.net>

1 files changed, 32 insertions, 1 deletions

diff --git a/kernel/bpf/devmap.c b/kernel/bpf/devmap.c
index d27f3b60ff6d..3867864cdc2f 100644
--- a/kernel/bpf/devmap.c
+++ b/kernel/bpf/devmap.c
@@ -128,7 +128,7 @@ static int dev_map_init_map(struct bpf_dtab *dtab, union bpf_attr *attr)
 
                 if (!dtab->n_buckets) /* Overflow check */
                         return -EINVAL;
-                cost += sizeof(struct hlist_head) * dtab->n_buckets;
+                cost += (u64) sizeof(struct hlist_head) * dtab->n_buckets;
         }
 
         /* if map size is larger than memlock limit, reject it */
@@ -719,6 +719,32 @@ const struct bpf_map_ops dev_map_hash_ops = {
         .map_check_btf = map_check_no_btf,
 };
 
+static void dev_map_hash_remove_netdev(struct bpf_dtab *dtab,
+                                       struct net_device *netdev)
+{
+        unsigned long flags;
+        u32 i;
+
+        spin_lock_irqsave(&dtab->index_lock, flags);
+        for (i = 0; i < dtab->n_buckets; i++) {
+                struct bpf_dtab_netdev *dev;
+                struct hlist_head *head;
+                struct hlist_node *next;
+
+                head = dev_map_index_hash(dtab, i);
+
+                hlist_for_each_entry_safe(dev, next, head, index_hlist) {
+                        if (netdev != dev->dev)
+                                continue;
+
+                        dtab->items--;
+                        hlist_del_rcu(&dev->index_hlist);
+                        call_rcu(&dev->rcu, __dev_map_entry_free);
+                }
+        }
+        spin_unlock_irqrestore(&dtab->index_lock, flags);
+}
+
 static int dev_map_notification(struct notifier_block *notifier,
                                 ulong event, void *ptr)
 {
@@ -735,6 +761,11 @@ static int dev_map_notification(struct notifier_block *notifier,
                  */
                 rcu_read_lock();
                 list_for_each_entry_rcu(dtab, &dev_map_list, list) {
+                        if (dtab->map.map_type == BPF_MAP_TYPE_DEVMAP_HASH) {
+                                dev_map_hash_remove_netdev(dtab, netdev);
+                                continue;
+                        }
+
                         for (i = 0; i < dtab->map.max_entries; i++) {
                                 struct bpf_dtab_netdev *dev, *odev;