2 files changed, 50 insertions, 69 deletions

diff --git a/net/core/dev.c b/net/core/dev.c
index 4ce07dc25573..dd6ce598de89 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -6045,8 +6045,7 @@ void *netdev_lower_dev_get_private(struct net_device *dev,
 EXPORT_SYMBOL(netdev_lower_dev_get_private);
 
 
-int dev_get_nest_level(struct net_device *dev,
-                       bool (*type_check)(const struct net_device *dev))
+int dev_get_nest_level(struct net_device *dev)
 {
         struct net_device *lower = NULL;
         struct list_head *iter;
@@ -6056,15 +6055,12 @@ int dev_get_nest_level(struct net_device *dev,
         ASSERT_RTNL();
 
         netdev_for_each_lower_dev(dev, lower, iter) {
-                nest = dev_get_nest_level(lower, type_check);
+                nest = dev_get_nest_level(lower);
                 if (max_nest < nest)
                         max_nest = nest;
         }
 
-        if (type_check(dev))
-                max_nest++;
-
-        return max_nest;
+        return max_nest + 1;
 }
 EXPORT_SYMBOL(dev_get_nest_level);
 
diff --git a/net/core/filter.c b/net/core/filter.c
index 5708999f8a79..cb06aceb512a 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -1355,56 +1355,47 @@ static inline int bpf_try_make_writable(struct sk_buff *skb,
 {
         int err;
 
-        if (!skb_cloned(skb))
-                return 0;
-        if (skb_clone_writable(skb, write_len))
-                return 0;
-        err = pskb_expand_head(skb, 0, 0, GFP_ATOMIC);
-        if (!err)
-                bpf_compute_data_end(skb);
+        err = skb_ensure_writable(skb, write_len);
+        bpf_compute_data_end(skb);
+
         return err;
 }
 
+static inline void bpf_push_mac_rcsum(struct sk_buff *skb)
+{
+        if (skb_at_tc_ingress(skb))
+                skb_postpush_rcsum(skb, skb_mac_header(skb), skb->mac_len);
+}
+
+static inline void bpf_pull_mac_rcsum(struct sk_buff *skb)
+{
+        if (skb_at_tc_ingress(skb))
+                skb_postpull_rcsum(skb, skb_mac_header(skb), skb->mac_len);
+}
+
 static u64 bpf_skb_store_bytes(u64 r1, u64 r2, u64 r3, u64 r4, u64 flags)
 {
-        struct bpf_scratchpad *sp = this_cpu_ptr(&bpf_sp);
         struct sk_buff *skb = (struct sk_buff *) (long) r1;
-        int offset = (int) r2;
+        unsigned int offset = (unsigned int) r2;
         void *from = (void *) (long) r3;
         unsigned int len = (unsigned int) r4;
         void *ptr;
 
         if (unlikely(flags & ~(BPF_F_RECOMPUTE_CSUM | BPF_F_INVALIDATE_HASH)))
                 return -EINVAL;
-
-        /* bpf verifier guarantees that:
-         * 'from' pointer points to bpf program stack
-         * 'len' bytes of it were initialized
-         * 'len' > 0
-         * 'skb' is a valid pointer to 'struct sk_buff'
-         *
-         * so check for invalid 'offset' and too large 'len'
-         */
-        if (unlikely((u32) offset > 0xffff || len > sizeof(sp->buff)))
+        if (unlikely(offset > 0xffff))
                 return -EFAULT;
         if (unlikely(bpf_try_make_writable(skb, offset + len)))
                 return -EFAULT;
 
-        ptr = skb_header_pointer(skb, offset, len, sp->buff);
-        if (unlikely(!ptr))
-                return -EFAULT;
-
+        ptr = skb->data + offset;
         if (flags & BPF_F_RECOMPUTE_CSUM)
-                skb_postpull_rcsum(skb, ptr, len);
+                __skb_postpull_rcsum(skb, ptr, len, offset);
 
         memcpy(ptr, from, len);
 
-        if (ptr == sp->buff)
-                /* skb_store_bits cannot return -EFAULT here */
-                skb_store_bits(skb, offset, ptr, len);
-
         if (flags & BPF_F_RECOMPUTE_CSUM)
-                skb_postpush_rcsum(skb, ptr, len);
+                __skb_postpush_rcsum(skb, ptr, len, offset);
         if (flags & BPF_F_INVALIDATE_HASH)
                 skb_clear_hash(skb);
 
@@ -1425,12 +1416,12 @@ static const struct bpf_func_proto bpf_skb_store_bytes_proto = {
 static u64 bpf_skb_load_bytes(u64 r1, u64 r2, u64 r3, u64 r4, u64 r5)
 {
         const struct sk_buff *skb = (const struct sk_buff *)(unsigned long) r1;
-        int offset = (int) r2;
+        unsigned int offset = (unsigned int) r2;
         void *to = (void *)(unsigned long) r3;
         unsigned int len = (unsigned int) r4;
         void *ptr;
 
-        if (unlikely((u32) offset > 0xffff))
+        if (unlikely(offset > 0xffff))
                 goto err_clear;
 
         ptr = skb_header_pointer(skb, offset, len, to);
@@ -1458,20 +1449,17 @@ static const struct bpf_func_proto bpf_skb_load_bytes_proto = {
 static u64 bpf_l3_csum_replace(u64 r1, u64 r2, u64 from, u64 to, u64 flags)
 {
         struct sk_buff *skb = (struct sk_buff *) (long) r1;
-        int offset = (int) r2;
-        __sum16 sum, *ptr;
+        unsigned int offset = (unsigned int) r2;
+        __sum16 *ptr;
 
         if (unlikely(flags & ~(BPF_F_HDR_FIELD_MASK)))
                 return -EINVAL;
-        if (unlikely((u32) offset > 0xffff))
+        if (unlikely(offset > 0xffff || offset & 1))
                 return -EFAULT;
-        if (unlikely(bpf_try_make_writable(skb, offset + sizeof(sum))))
-                return -EFAULT;
-
-        ptr = skb_header_pointer(skb, offset, sizeof(sum), &sum);
-        if (unlikely(!ptr))
+        if (unlikely(bpf_try_make_writable(skb, offset + sizeof(*ptr))))
                 return -EFAULT;
 
+        ptr = (__sum16 *)(skb->data + offset);
         switch (flags & BPF_F_HDR_FIELD_MASK) {
         case 0:
                 if (unlikely(from != 0))
@@ -1489,10 +1477,6 @@ static u64 bpf_l3_csum_replace(u64 r1, u64 r2, u64 from, u64 to, u64 flags)
                 return -EINVAL;
         }
 
-        if (ptr == &sum)
-                /* skb_store_bits guaranteed to not return -EFAULT here */
-                skb_store_bits(skb, offset, ptr, sizeof(sum));
-
         return 0;
 }
 
@@ -1512,20 +1496,18 @@ static u64 bpf_l4_csum_replace(u64 r1, u64 r2, u64 from, u64 to, u64 flags)
         struct sk_buff *skb = (struct sk_buff *) (long) r1;
         bool is_pseudo = flags & BPF_F_PSEUDO_HDR;
         bool is_mmzero = flags & BPF_F_MARK_MANGLED_0;
-        int offset = (int) r2;
-        __sum16 sum, *ptr;
+        unsigned int offset = (unsigned int) r2;
+        __sum16 *ptr;
 
         if (unlikely(flags & ~(BPF_F_MARK_MANGLED_0 | BPF_F_PSEUDO_HDR |
                                BPF_F_HDR_FIELD_MASK)))
                 return -EINVAL;
-        if (unlikely((u32) offset > 0xffff))
+        if (unlikely(offset > 0xffff || offset & 1))
                 return -EFAULT;
-        if (unlikely(bpf_try_make_writable(skb, offset + sizeof(sum))))
+        if (unlikely(bpf_try_make_writable(skb, offset + sizeof(*ptr))))
                 return -EFAULT;
 
-        ptr = skb_header_pointer(skb, offset, sizeof(sum), &sum);
-        if (unlikely(!ptr))
-                return -EFAULT;
+        ptr = (__sum16 *)(skb->data + offset);
         if (is_mmzero && !*ptr)
                 return 0;
 
@@ -1548,10 +1530,6 @@ static u64 bpf_l4_csum_replace(u64 r1, u64 r2, u64 from, u64 to, u64 flags)
 
         if (is_mmzero && !*ptr)
                 *ptr = CSUM_MANGLED_0;
-        if (ptr == &sum)
-                /* skb_store_bits guaranteed to not return -EFAULT here */
-                skb_store_bits(skb, offset, ptr, sizeof(sum));
-
         return 0;
 }
 
@@ -1607,9 +1585,6 @@ static const struct bpf_func_proto bpf_csum_diff_proto = {
 
 static inline int __bpf_rx_skb(struct net_device *dev, struct sk_buff *skb)
 {
-        if (skb_at_tc_ingress(skb))
-                skb_postpush_rcsum(skb, skb_mac_header(skb), skb->mac_len);
-
         return dev_forward_skb(dev, skb);
 }
 
@@ -1648,6 +1623,8 @@ static u64 bpf_clone_redirect(u64 r1, u64 ifindex, u64 flags, u64 r4, u64 r5)
         if (unlikely(!skb))
                 return -ENOMEM;
 
+        bpf_push_mac_rcsum(skb);
+
         return flags & BPF_F_INGRESS ?
                __bpf_rx_skb(dev, skb) : __bpf_tx_skb(dev, skb);
 }
@@ -1693,6 +1670,8 @@ int skb_do_redirect(struct sk_buff *skb)
                 return -EINVAL;
         }
 
+        bpf_push_mac_rcsum(skb);
+
         return ri->flags & BPF_F_INGRESS ?
                __bpf_rx_skb(dev, skb) : __bpf_tx_skb(dev, skb);
 }
@@ -1756,7 +1735,10 @@ static u64 bpf_skb_vlan_push(u64 r1, u64 r2, u64 vlan_tci, u64 r4, u64 r5)
                      vlan_proto != htons(ETH_P_8021AD)))
                 vlan_proto = htons(ETH_P_8021Q);
 
+        bpf_push_mac_rcsum(skb);
         ret = skb_vlan_push(skb, vlan_proto, vlan_tci);
+        bpf_pull_mac_rcsum(skb);
+
         bpf_compute_data_end(skb);
         return ret;
 }
@@ -1776,7 +1758,10 @@ static u64 bpf_skb_vlan_pop(u64 r1, u64 r2, u64 r3, u64 r4, u64 r5)
         struct sk_buff *skb = (struct sk_buff *) (long) r1;
         int ret;
 
+        bpf_push_mac_rcsum(skb);
         ret = skb_vlan_pop(skb);
+        bpf_pull_mac_rcsum(skb);
+
         bpf_compute_data_end(skb);
         return ret;
 }
@@ -2298,7 +2283,7 @@ bpf_get_skb_set_tunnel_proto(enum bpf_func_id which)
 }
 
 #ifdef CONFIG_SOCK_CGROUP_DATA
-static u64 bpf_skb_in_cgroup(u64 r1, u64 r2, u64 r3, u64 r4, u64 r5)
+static u64 bpf_skb_under_cgroup(u64 r1, u64 r2, u64 r3, u64 r4, u64 r5)
 {
         struct sk_buff *skb = (struct sk_buff *)(long)r1;
         struct bpf_map *map = (struct bpf_map *)(long)r2;
@@ -2321,8 +2306,8 @@ static u64 bpf_skb_in_cgroup(u64 r1, u64 r2, u64 r3, u64 r4, u64 r5)
         return cgroup_is_descendant(sock_cgroup_ptr(&sk->sk_cgrp_data), cgrp);
 }
 
-static const struct bpf_func_proto bpf_skb_in_cgroup_proto = {
-        .func           = bpf_skb_in_cgroup,
+static const struct bpf_func_proto bpf_skb_under_cgroup_proto = {
+        .func           = bpf_skb_under_cgroup,
         .gpl_only       = false,
         .ret_type       = RET_INTEGER,
         .arg1_type      = ARG_PTR_TO_CTX,
@@ -2402,8 +2387,8 @@ tc_cls_act_func_proto(enum bpf_func_id func_id)
         case BPF_FUNC_get_smp_processor_id:
                 return &bpf_get_smp_processor_id_proto;
 #ifdef CONFIG_SOCK_CGROUP_DATA
-        case BPF_FUNC_skb_in_cgroup:
-                return &bpf_skb_in_cgroup_proto;
+        case BPF_FUNC_skb_under_cgroup:
+                return &bpf_skb_under_cgroup_proto;
 #endif
         default:
                 return sk_filter_func_proto(func_id);