1 files changed, 137 insertions, 23 deletions

diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index cf5040fd5434..0607db304def 100644
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -456,6 +456,7 @@ static int bpf_obj_name_cpy(char *dst, const char *src)
 }
 
 int map_check_no_btf(const struct bpf_map *map,
+                     const struct btf *btf,
                      const struct btf_type *key_type,
                      const struct btf_type *value_type)
 {
@@ -478,7 +479,7 @@ static int map_check_btf(const struct bpf_map *map, const struct btf *btf,
                 return -EINVAL;
 
         if (map->ops->map_check_btf)
-                ret = map->ops->map_check_btf(map, key_type, value_type);
+                ret = map->ops->map_check_btf(map, btf, key_type, value_type);
 
         return ret;
 }
@@ -1213,6 +1214,9 @@ static void __bpf_prog_put(struct bpf_prog *prog, bool do_idr_lock)
                 /* bpf_prog_free_id() must be called first */
                 bpf_prog_free_id(prog, do_idr_lock);
                 bpf_prog_kallsyms_del_all(prog);
+                btf_put(prog->aux->btf);
+                kvfree(prog->aux->func_info);
+                bpf_prog_free_linfo(prog);
 
                 call_rcu(&prog->aux->rcu, __bpf_prog_put_rcu);
         }
@@ -1437,9 +1441,9 @@ bpf_prog_load_check_attach_type(enum bpf_prog_type prog_type,
 }
 
 /* last field in 'union bpf_attr' used by this command */
-#define BPF_PROG_LOAD_LAST_FIELD expected_attach_type
+#define BPF_PROG_LOAD_LAST_FIELD line_info_cnt
 
-static int bpf_prog_load(union bpf_attr *attr)
+static int bpf_prog_load(union bpf_attr *attr, union bpf_attr __user *uattr)
 {
         enum bpf_prog_type type = attr->prog_type;
         struct bpf_prog *prog;
@@ -1450,9 +1454,14 @@ static int bpf_prog_load(union bpf_attr *attr)
         if (CHECK_ATTR(BPF_PROG_LOAD))
                 return -EINVAL;
 
-        if (attr->prog_flags & ~BPF_F_STRICT_ALIGNMENT)
+        if (attr->prog_flags & ~(BPF_F_STRICT_ALIGNMENT | BPF_F_ANY_ALIGNMENT))
                 return -EINVAL;
 
+        if (!IS_ENABLED(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS) &&
+            (attr->prog_flags & BPF_F_ANY_ALIGNMENT) &&
+            !capable(CAP_SYS_ADMIN))
+                return -EPERM;
+
         /* copy eBPF program license from user space */
         if (strncpy_from_user(license, u64_to_user_ptr(attr->license),
                               sizeof(license) - 1) < 0)
@@ -1464,11 +1473,6 @@ static int bpf_prog_load(union bpf_attr *attr)
 
         if (attr->insn_cnt == 0 || attr->insn_cnt > BPF_MAXINSNS)
                 return -E2BIG;
-
-        if (type == BPF_PROG_TYPE_KPROBE &&
-            attr->kern_version != LINUX_VERSION_CODE)
-                return -EINVAL;
-
         if (type != BPF_PROG_TYPE_SOCKET_FILTER &&
             type != BPF_PROG_TYPE_CGROUP_SKB &&
             !capable(CAP_SYS_ADMIN))
@@ -1525,7 +1529,7 @@ static int bpf_prog_load(union bpf_attr *attr)
                 goto free_prog;
 
         /* run eBPF verifier */
-        err = bpf_check(&prog, attr);
+        err = bpf_check(&prog, attr, uattr);
         if (err < 0)
                 goto free_used_maps;
 
@@ -1553,6 +1557,9 @@ static int bpf_prog_load(union bpf_attr *attr)
         return err;
 
 free_used_maps:
+        bpf_prog_free_linfo(prog);
+        kvfree(prog->aux->func_info);
+        btf_put(prog->aux->btf);
         bpf_prog_kallsyms_del_subprogs(prog);
         free_used_maps(prog->aux);
 free_prog:
@@ -1597,6 +1604,7 @@ static int bpf_raw_tracepoint_release(struct inode *inode, struct file *filp)
                 bpf_probe_unregister(raw_tp->btp, raw_tp->prog);
                 bpf_prog_put(raw_tp->prog);
         }
+        bpf_put_raw_tracepoint(raw_tp->btp);
         kfree(raw_tp);
         return 0;
 }
@@ -1622,13 +1630,15 @@ static int bpf_raw_tracepoint_open(const union bpf_attr *attr)
                 return -EFAULT;
         tp_name[sizeof(tp_name) - 1] = 0;
 
-        btp = bpf_find_raw_tracepoint(tp_name);
+        btp = bpf_get_raw_tracepoint(tp_name);
         if (!btp)
                 return -ENOENT;
 
         raw_tp = kzalloc(sizeof(*raw_tp), GFP_USER);
-        if (!raw_tp)
-                return -ENOMEM;
+        if (!raw_tp) {
+                err = -ENOMEM;
+                goto out_put_btp;
+        }
         raw_tp->btp = btp;
 
         prog = bpf_prog_get_type(attr->raw_tracepoint.prog_fd,
@@ -1656,6 +1666,8 @@ out_put_prog:
         bpf_prog_put(prog);
 out_free_tp:
         kfree(raw_tp);
+out_put_btp:
+        bpf_put_raw_tracepoint(btp);
         return err;
 }
 
@@ -2020,18 +2032,42 @@ static struct bpf_insn *bpf_insn_prepare_dump(const struct bpf_prog *prog)
                         insns[i + 1].imm = 0;
                         continue;
                 }
-
-                if (!bpf_dump_raw_ok() &&
-                    imm == (unsigned long)prog->aux) {
-                        insns[i].imm = 0;
-                        insns[i + 1].imm = 0;
-                        continue;
-                }
         }
 
         return insns;
 }
 
+static int set_info_rec_size(struct bpf_prog_info *info)
+{
+        /*
+         * Ensure info.*_rec_size is the same as kernel expected size
+         *
+         * or
+         *
+         * Only allow zero *_rec_size if both _rec_size and _cnt are
+         * zero.  In this case, the kernel will set the expected
+         * _rec_size back to the info.
+         */
+
+        if ((info->nr_func_info || info->func_info_rec_size) &&
+            info->func_info_rec_size != sizeof(struct bpf_func_info))
+                return -EINVAL;
+
+        if ((info->nr_line_info || info->line_info_rec_size) &&
+            info->line_info_rec_size != sizeof(struct bpf_line_info))
+                return -EINVAL;
+
+        if ((info->nr_jited_line_info || info->jited_line_info_rec_size) &&
+            info->jited_line_info_rec_size != sizeof(__u64))
+                return -EINVAL;
+
+        info->func_info_rec_size = sizeof(struct bpf_func_info);
+        info->line_info_rec_size = sizeof(struct bpf_line_info);
+        info->jited_line_info_rec_size = sizeof(__u64);
+
+        return 0;
+}
+
 static int bpf_prog_get_info_by_fd(struct bpf_prog *prog,
                                    const union bpf_attr *attr,
                                    union bpf_attr __user *uattr)
@@ -2074,11 +2110,18 @@ static int bpf_prog_get_info_by_fd(struct bpf_prog *prog,
                                 return -EFAULT;
         }
 
+        err = set_info_rec_size(&info);
+        if (err)
+                return err;
+
         if (!capable(CAP_SYS_ADMIN)) {
                 info.jited_prog_len = 0;
                 info.xlated_prog_len = 0;
                 info.nr_jited_ksyms = 0;
                 info.nr_jited_func_lens = 0;
+                info.nr_func_info = 0;
+                info.nr_line_info = 0;
+                info.nr_jited_line_info = 0;
                 goto done;
         }
 
@@ -2160,7 +2203,7 @@ static int bpf_prog_get_info_by_fd(struct bpf_prog *prog,
 
         ulen = info.nr_jited_ksyms;
         info.nr_jited_ksyms = prog->aux->func_cnt ? : 1;
-        if (info.nr_jited_ksyms && ulen) {
+        if (ulen) {
                 if (bpf_dump_raw_ok()) {
                         unsigned long ksym_addr;
                         u64 __user *user_ksyms;
@@ -2191,7 +2234,7 @@ static int bpf_prog_get_info_by_fd(struct bpf_prog *prog,
 
         ulen = info.nr_jited_func_lens;
         info.nr_jited_func_lens = prog->aux->func_cnt ? : 1;
-        if (info.nr_jited_func_lens && ulen) {
+        if (ulen) {
                 if (bpf_dump_raw_ok()) {
                         u32 __user *user_lens;
                         u32 func_len, i;
@@ -2216,6 +2259,77 @@ static int bpf_prog_get_info_by_fd(struct bpf_prog *prog,
                 }
         }
 
+        if (prog->aux->btf)
+                info.btf_id = btf_id(prog->aux->btf);
+
+        ulen = info.nr_func_info;
+        info.nr_func_info = prog->aux->func_info_cnt;
+        if (info.nr_func_info && ulen) {
+                char __user *user_finfo;
+
+                user_finfo = u64_to_user_ptr(info.func_info);
+                ulen = min_t(u32, info.nr_func_info, ulen);
+                if (copy_to_user(user_finfo, prog->aux->func_info,
+                                 info.func_info_rec_size * ulen))
+                        return -EFAULT;
+        }
+
+        ulen = info.nr_line_info;
+        info.nr_line_info = prog->aux->nr_linfo;
+        if (info.nr_line_info && ulen) {
+                __u8 __user *user_linfo;
+
+                user_linfo = u64_to_user_ptr(info.line_info);
+                ulen = min_t(u32, info.nr_line_info, ulen);
+                if (copy_to_user(user_linfo, prog->aux->linfo,
+                                 info.line_info_rec_size * ulen))
+                        return -EFAULT;
+        }
+
+        ulen = info.nr_jited_line_info;
+        if (prog->aux->jited_linfo)
+                info.nr_jited_line_info = prog->aux->nr_linfo;
+        else
+                info.nr_jited_line_info = 0;
+        if (info.nr_jited_line_info && ulen) {
+                if (bpf_dump_raw_ok()) {
+                        __u64 __user *user_linfo;
+                        u32 i;
+
+                        user_linfo = u64_to_user_ptr(info.jited_line_info);
+                        ulen = min_t(u32, info.nr_jited_line_info, ulen);
+                        for (i = 0; i < ulen; i++) {
+                                if (put_user((__u64)(long)prog->aux->jited_linfo[i],
+                                             &user_linfo[i]))
+                                        return -EFAULT;
+                        }
+                } else {
+                        info.jited_line_info = 0;
+                }
+        }
+
+        ulen = info.nr_prog_tags;
+        info.nr_prog_tags = prog->aux->func_cnt ? : 1;
+        if (ulen) {
+                __u8 __user (*user_prog_tags)[BPF_TAG_SIZE];
+                u32 i;
+
+                user_prog_tags = u64_to_user_ptr(info.prog_tags);
+                ulen = min_t(u32, info.nr_prog_tags, ulen);
+                if (prog->aux->func_cnt) {
+                        for (i = 0; i < ulen; i++) {
+                                if (copy_to_user(user_prog_tags[i],
+                                                 prog->aux->func[i]->tag,
+                                                 BPF_TAG_SIZE))
+                                        return -EFAULT;
+                        }
+                } else {
+                        if (copy_to_user(user_prog_tags[0],
+                                         prog->tag, BPF_TAG_SIZE))
+                                return -EFAULT;
+                }
+        }
+
 done:
         if (copy_to_user(uinfo, &info, info_len) ||
             put_user(info_len, &uattr->info.info_len))
@@ -2501,7 +2615,7 @@ SYSCALL_DEFINE3(bpf, int, cmd, union bpf_attr __user *, uattr, unsigned int, siz
                 err = map_get_next_key(&attr);
                 break;
         case BPF_PROG_LOAD:
-                err = bpf_prog_load(&attr);
+                err = bpf_prog_load(&attr, uattr);
                 break;
         case BPF_OBJ_PIN:
                 err = bpf_obj_pin(&attr);