Merge branch 'next' into for-linus

Prepare input updates for 4.14 merge window.

3 files changed, 97 insertions, 12 deletions

diff --git a/tools/testing/selftests/bpf/bpf_endian.h b/tools/testing/selftests/bpf/bpf_endian.h
index 19d0604f8694..487cbfb89beb 100644
--- a/tools/testing/selftests/bpf/bpf_endian.h
+++ b/tools/testing/selftests/bpf/bpf_endian.h
@@ -1,23 +1,42 @@
 #ifndef __BPF_ENDIAN__
 #define __BPF_ENDIAN__
 
-#include <asm/byteorder.h>
+#include <linux/swab.h>
 
-#if __BYTE_ORDER == __LITTLE_ENDIAN
-# define __bpf_ntohs(x)         __builtin_bswap16(x)
-# define __bpf_htons(x)         __builtin_bswap16(x)
-#elif __BYTE_ORDER == __BIG_ENDIAN
-# define __bpf_ntohs(x)         (x)
-# define __bpf_htons(x)         (x)
+/* LLVM's BPF target selects the endianness of the CPU
+ * it compiles on, or the user specifies (bpfel/bpfeb),
+ * respectively. The used __BYTE_ORDER__ is defined by
+ * the compiler, we cannot rely on __BYTE_ORDER from
+ * libc headers, since it doesn't reflect the actual
+ * requested byte order.
+ *
+ * Note, LLVM's BPF target has different __builtin_bswapX()
+ * semantics. It does map to BPF_ALU | BPF_END | BPF_TO_BE
+ * in bpfel and bpfeb case, which means below, that we map
+ * to cpu_to_be16(). We could use it unconditionally in BPF
+ * case, but better not rely on it, so that this header here
+ * can be used from application and BPF program side, which
+ * use different targets.
+ */
+#if __BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__
+# define __bpf_ntohs(x)                 __builtin_bswap16(x)
+# define __bpf_htons(x)                 __builtin_bswap16(x)
+# define __bpf_constant_ntohs(x)        ___constant_swab16(x)
+# define __bpf_constant_htons(x)        ___constant_swab16(x)
+#elif __BYTE_ORDER__ == __ORDER_BIG_ENDIAN__
+# define __bpf_ntohs(x)                 (x)
+# define __bpf_htons(x)                 (x)
+# define __bpf_constant_ntohs(x)        (x)
+# define __bpf_constant_htons(x)        (x)
 #else
-# error "Fix your __BYTE_ORDER?!"
+# error "Fix your compiler's __BYTE_ORDER__?!"
 #endif
 
 #define bpf_htons(x)                            \
         (__builtin_constant_p(x) ?              \
-         __constant_htons(x) : __bpf_htons(x))
+         __bpf_constant_htons(x) : __bpf_htons(x))
 #define bpf_ntohs(x)                            \
         (__builtin_constant_p(x) ?              \
-         __constant_ntohs(x) : __bpf_ntohs(x))
+         __bpf_constant_ntohs(x) : __bpf_ntohs(x))
 
-#endif
+#endif /* __BPF_ENDIAN__ */
diff --git a/tools/testing/selftests/bpf/test_verifier.c b/tools/testing/selftests/bpf/test_verifier.c
index cabb19b1e371..0ff8c55c0464 100644
--- a/tools/testing/selftests/bpf/test_verifier.c
+++ b/tools/testing/selftests/bpf/test_verifier.c
@@ -3749,6 +3749,72 @@ static struct bpf_test tests[] = {
                 .errstr = "invalid bpf_context access",
         },
         {
+                "leak pointer into ctx 1",
+                .insns = {
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
+                                    offsetof(struct __sk_buff, cb[0])),
+                        BPF_LD_MAP_FD(BPF_REG_2, 0),
+                        BPF_STX_XADD(BPF_DW, BPF_REG_1, BPF_REG_2,
+                                      offsetof(struct __sk_buff, cb[0])),
+                        BPF_EXIT_INSN(),
+                },
+                .fixup_map1 = { 2 },
+                .errstr_unpriv = "R2 leaks addr into mem",
+                .result_unpriv = REJECT,
+                .result = ACCEPT,
+        },
+        {
+                "leak pointer into ctx 2",
+                .insns = {
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_0,
+                                    offsetof(struct __sk_buff, cb[0])),
+                        BPF_STX_XADD(BPF_DW, BPF_REG_1, BPF_REG_10,
+                                      offsetof(struct __sk_buff, cb[0])),
+                        BPF_EXIT_INSN(),
+                },
+                .errstr_unpriv = "R10 leaks addr into mem",
+                .result_unpriv = REJECT,
+                .result = ACCEPT,
+        },
+        {
+                "leak pointer into ctx 3",
+                .insns = {
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_LD_MAP_FD(BPF_REG_2, 0),
+                        BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2,
+                                      offsetof(struct __sk_buff, cb[0])),
+                        BPF_EXIT_INSN(),
+                },
+                .fixup_map1 = { 1 },
+                .errstr_unpriv = "R2 leaks addr into ctx",
+                .result_unpriv = REJECT,
+                .result = ACCEPT,
+        },
+        {
+                "leak pointer into map val",
+                .insns = {
+                        BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
+                        BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
+                        BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+                        BPF_LD_MAP_FD(BPF_REG_1, 0),
+                        BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
+                                     BPF_FUNC_map_lookup_elem),
+                        BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),
+                        BPF_MOV64_IMM(BPF_REG_3, 0),
+                        BPF_STX_MEM(BPF_DW, BPF_REG_0, BPF_REG_3, 0),
+                        BPF_STX_XADD(BPF_DW, BPF_REG_0, BPF_REG_6, 0),
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_EXIT_INSN(),
+                },
+                .fixup_map1 = { 4 },
+                .errstr_unpriv = "R6 leaks addr into mem",
+                .result_unpriv = REJECT,
+                .result = ACCEPT,
+        },
+        {
                 "helper access to map: full range",
                 .insns = {
                         BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
diff --git a/tools/testing/selftests/ntb/ntb_test.sh b/tools/testing/selftests/ntb/ntb_test.sh
index a676d3eefefb..13f5198ba0ee 100755
--- a/tools/testing/selftests/ntb/ntb_test.sh
+++ b/tools/testing/selftests/ntb/ntb_test.sh
@@ -305,7 +305,7 @@ function perf_test()
         echo "Running remote perf test $WITH DMA"
         write_file "" $REMOTE_PERF/run
         echo -n "  "
-        read_file $LOCAL_PERF/run
+        read_file $REMOTE_PERF/run
         echo "  Passed"
 
         _modprobe -r ntb_perf