1
2
3
4
5
6
7
8
9
10
11
12#include <linux/bpf.h>
13#include <linux/bpf_trace.h>
14#include <linux/syscalls.h>
15#include <linux/slab.h>
16#include <linux/sched/signal.h>
17#include <linux/vmalloc.h>
18#include <linux/mmzone.h>
19#include <linux/anon_inodes.h>
20#include <linux/file.h>
21#include <linux/license.h>
22#include <linux/filter.h>
23#include <linux/version.h>
24#include <linux/kernel.h>
25#include <linux/idr.h>
26
27#define IS_FD_ARRAY(map) ((map)->map_type == BPF_MAP_TYPE_PROG_ARRAY || \
28 (map)->map_type == BPF_MAP_TYPE_PERF_EVENT_ARRAY || \
29 (map)->map_type == BPF_MAP_TYPE_CGROUP_ARRAY || \
30 (map)->map_type == BPF_MAP_TYPE_ARRAY_OF_MAPS)
31#define IS_FD_HASH(map) ((map)->map_type == BPF_MAP_TYPE_HASH_OF_MAPS)
32#define IS_FD_MAP(map) (IS_FD_ARRAY(map) || IS_FD_HASH(map))
33
34DEFINE_PER_CPU(int, bpf_prog_active);
35static DEFINE_IDR(prog_idr);
36static DEFINE_SPINLOCK(prog_idr_lock);
37static DEFINE_IDR(map_idr);
38static DEFINE_SPINLOCK(map_idr_lock);
39
40int sysctl_unprivileged_bpf_disabled __read_mostly;
41
42static const struct bpf_map_ops * const bpf_map_types[] = {
43#define BPF_PROG_TYPE(_id, _ops)
44#define BPF_MAP_TYPE(_id, _ops) \
45 [_id] = &_ops,
46#include <linux/bpf_types.h>
47#undef BPF_PROG_TYPE
48#undef BPF_MAP_TYPE
49};
50
51static struct bpf_map *find_and_alloc_map(union bpf_attr *attr)
52{
53 struct bpf_map *map;
54
55 if (attr->map_type >= ARRAY_SIZE(bpf_map_types) ||
56 !bpf_map_types[attr->map_type])
57 return ERR_PTR(-EINVAL);
58
59 map = bpf_map_types[attr->map_type]->map_alloc(attr);
60 if (IS_ERR(map))
61 return map;
62 map->ops = bpf_map_types[attr->map_type];
63 map->map_type = attr->map_type;
64 return map;
65}
66
67void *bpf_map_area_alloc(size_t size)
68{
69
70
71
72
73 const gfp_t flags = __GFP_NOWARN | __GFP_NORETRY | __GFP_ZERO;
74 void *area;
75
76 if (size <= (PAGE_SIZE << PAGE_ALLOC_COSTLY_ORDER)) {
77 area = kmalloc(size, GFP_USER | flags);
78 if (area != NULL)
79 return area;
80 }
81
82 return __vmalloc(size, GFP_KERNEL | flags, PAGE_KERNEL);
83}
84
85void bpf_map_area_free(void *area)
86{
87 kvfree(area);
88}
89
90int bpf_map_precharge_memlock(u32 pages)
91{
92 struct user_struct *user = get_current_user();
93 unsigned long memlock_limit, cur;
94
95 memlock_limit = rlimit(RLIMIT_MEMLOCK) >> PAGE_SHIFT;
96 cur = atomic_long_read(&user->locked_vm);
97 free_uid(user);
98 if (cur + pages > memlock_limit)
99 return -EPERM;
100 return 0;
101}
102
103static int bpf_map_charge_memlock(struct bpf_map *map)
104{
105 struct user_struct *user = get_current_user();
106 unsigned long memlock_limit;
107
108 memlock_limit = rlimit(RLIMIT_MEMLOCK) >> PAGE_SHIFT;
109
110 atomic_long_add(map->pages, &user->locked_vm);
111
112 if (atomic_long_read(&user->locked_vm) > memlock_limit) {
113 atomic_long_sub(map->pages, &user->locked_vm);
114 free_uid(user);
115 return -EPERM;
116 }
117 map->user = user;
118 return 0;
119}
120
121static void bpf_map_uncharge_memlock(struct bpf_map *map)
122{
123 struct user_struct *user = map->user;
124
125 atomic_long_sub(map->pages, &user->locked_vm);
126 free_uid(user);
127}
128
129static int bpf_map_alloc_id(struct bpf_map *map)
130{
131 int id;
132
133 spin_lock_bh(&map_idr_lock);
134 id = idr_alloc_cyclic(&map_idr, map, 1, INT_MAX, GFP_ATOMIC);
135 if (id > 0)
136 map->id = id;
137 spin_unlock_bh(&map_idr_lock);
138
139 if (WARN_ON_ONCE(!id))
140 return -ENOSPC;
141
142 return id > 0 ? 0 : id;
143}
144
145static void bpf_map_free_id(struct bpf_map *map, bool do_idr_lock)
146{
147 if (do_idr_lock)
148 spin_lock_bh(&map_idr_lock);
149 else
150 __acquire(&map_idr_lock);
151
152 idr_remove(&map_idr, map->id);
153
154 if (do_idr_lock)
155 spin_unlock_bh(&map_idr_lock);
156 else
157 __release(&map_idr_lock);
158}
159
160
161static void bpf_map_free_deferred(struct work_struct *work)
162{
163 struct bpf_map *map = container_of(work, struct bpf_map, work);
164
165 bpf_map_uncharge_memlock(map);
166
167 map->ops->map_free(map);
168}
169
170static void bpf_map_put_uref(struct bpf_map *map)
171{
172 if (atomic_dec_and_test(&map->usercnt)) {
173 if (map->map_type == BPF_MAP_TYPE_PROG_ARRAY)
174 bpf_fd_array_map_clear(map);
175 }
176}
177
178
179
180
181static void __bpf_map_put(struct bpf_map *map, bool do_idr_lock)
182{
183 if (atomic_dec_and_test(&map->refcnt)) {
184
185 bpf_map_free_id(map, do_idr_lock);
186 INIT_WORK(&map->work, bpf_map_free_deferred);
187 schedule_work(&map->work);
188 }
189}
190
191void bpf_map_put(struct bpf_map *map)
192{
193 __bpf_map_put(map, true);
194}
195
196void bpf_map_put_with_uref(struct bpf_map *map)
197{
198 bpf_map_put_uref(map);
199 bpf_map_put(map);
200}
201
202static int bpf_map_release(struct inode *inode, struct file *filp)
203{
204 struct bpf_map *map = filp->private_data;
205
206 if (map->ops->map_release)
207 map->ops->map_release(map, filp);
208
209 bpf_map_put_with_uref(map);
210 return 0;
211}
212
213#ifdef CONFIG_PROC_FS
214static void bpf_map_show_fdinfo(struct seq_file *m, struct file *filp)
215{
216 const struct bpf_map *map = filp->private_data;
217 const struct bpf_array *array;
218 u32 owner_prog_type = 0;
219 u32 owner_jited = 0;
220
221 if (map->map_type == BPF_MAP_TYPE_PROG_ARRAY) {
222 array = container_of(map, struct bpf_array, map);
223 owner_prog_type = array->owner_prog_type;
224 owner_jited = array->owner_jited;
225 }
226
227 seq_printf(m,
228 "map_type:\t%u\n"
229 "key_size:\t%u\n"
230 "value_size:\t%u\n"
231 "max_entries:\t%u\n"
232 "map_flags:\t%#x\n"
233 "memlock:\t%llu\n",
234 map->map_type,
235 map->key_size,
236 map->value_size,
237 map->max_entries,
238 map->map_flags,
239 map->pages * 1ULL << PAGE_SHIFT);
240
241 if (owner_prog_type) {
242 seq_printf(m, "owner_prog_type:\t%u\n",
243 owner_prog_type);
244 seq_printf(m, "owner_jited:\t%u\n",
245 owner_jited);
246 }
247}
248#endif
249
250static const struct file_operations bpf_map_fops = {
251#ifdef CONFIG_PROC_FS
252 .show_fdinfo = bpf_map_show_fdinfo,
253#endif
254 .release = bpf_map_release,
255};
256
257int bpf_map_new_fd(struct bpf_map *map)
258{
259 return anon_inode_getfd("bpf-map", &bpf_map_fops, map,
260 O_RDWR | O_CLOEXEC);
261}
262
263
264#define CHECK_ATTR(CMD) \
265 memchr_inv((void *) &attr->CMD##_LAST_FIELD + \
266 sizeof(attr->CMD##_LAST_FIELD), 0, \
267 sizeof(*attr) - \
268 offsetof(union bpf_attr, CMD##_LAST_FIELD) - \
269 sizeof(attr->CMD##_LAST_FIELD)) != NULL
270
271#define BPF_MAP_CREATE_LAST_FIELD inner_map_fd
272
273static int map_create(union bpf_attr *attr)
274{
275 struct bpf_map *map;
276 int err;
277
278 err = CHECK_ATTR(BPF_MAP_CREATE);
279 if (err)
280 return -EINVAL;
281
282
283 map = find_and_alloc_map(attr);
284 if (IS_ERR(map))
285 return PTR_ERR(map);
286
287 atomic_set(&map->refcnt, 1);
288 atomic_set(&map->usercnt, 1);
289
290 err = bpf_map_charge_memlock(map);
291 if (err)
292 goto free_map_nouncharge;
293
294 err = bpf_map_alloc_id(map);
295 if (err)
296 goto free_map;
297
298 err = bpf_map_new_fd(map);
299 if (err < 0) {
300
301
302
303
304
305
306 bpf_map_put(map);
307 return err;
308 }
309
310 trace_bpf_map_create(map, err);
311 return err;
312
313free_map:
314 bpf_map_uncharge_memlock(map);
315free_map_nouncharge:
316 map->ops->map_free(map);
317 return err;
318}
319
320
321
322
323struct bpf_map *__bpf_map_get(struct fd f)
324{
325 if (!f.file)
326 return ERR_PTR(-EBADF);
327 if (f.file->f_op != &bpf_map_fops) {
328 fdput(f);
329 return ERR_PTR(-EINVAL);
330 }
331
332 return f.file->private_data;
333}
334
335
336#define BPF_MAX_REFCNT 32768
337
338struct bpf_map *bpf_map_inc(struct bpf_map *map, bool uref)
339{
340 if (atomic_inc_return(&map->refcnt) > BPF_MAX_REFCNT) {
341 atomic_dec(&map->refcnt);
342 return ERR_PTR(-EBUSY);
343 }
344 if (uref)
345 atomic_inc(&map->usercnt);
346 return map;
347}
348
349struct bpf_map *bpf_map_get_with_uref(u32 ufd)
350{
351 struct fd f = fdget(ufd);
352 struct bpf_map *map;
353
354 map = __bpf_map_get(f);
355 if (IS_ERR(map))
356 return map;
357
358 map = bpf_map_inc(map, true);
359 fdput(f);
360
361 return map;
362}
363
364
365static struct bpf_map *bpf_map_inc_not_zero(struct bpf_map *map,
366 bool uref)
367{
368 int refold;
369
370 refold = __atomic_add_unless(&map->refcnt, 1, 0);
371
372 if (refold >= BPF_MAX_REFCNT) {
373 __bpf_map_put(map, false);
374 return ERR_PTR(-EBUSY);
375 }
376
377 if (!refold)
378 return ERR_PTR(-ENOENT);
379
380 if (uref)
381 atomic_inc(&map->usercnt);
382
383 return map;
384}
385
386int __weak bpf_stackmap_copy(struct bpf_map *map, void *key, void *value)
387{
388 return -ENOTSUPP;
389}
390
391
392#define BPF_MAP_LOOKUP_ELEM_LAST_FIELD value
393
394static int map_lookup_elem(union bpf_attr *attr)
395{
396 void __user *ukey = u64_to_user_ptr(attr->key);
397 void __user *uvalue = u64_to_user_ptr(attr->value);
398 int ufd = attr->map_fd;
399 struct bpf_map *map;
400 void *key, *value, *ptr;
401 u32 value_size;
402 struct fd f;
403 int err;
404
405 if (CHECK_ATTR(BPF_MAP_LOOKUP_ELEM))
406 return -EINVAL;
407
408 f = fdget(ufd);
409 map = __bpf_map_get(f);
410 if (IS_ERR(map))
411 return PTR_ERR(map);
412
413 key = memdup_user(ukey, map->key_size);
414 if (IS_ERR(key)) {
415 err = PTR_ERR(key);
416 goto err_put;
417 }
418
419 if (map->map_type == BPF_MAP_TYPE_PERCPU_HASH ||
420 map->map_type == BPF_MAP_TYPE_LRU_PERCPU_HASH ||
421 map->map_type == BPF_MAP_TYPE_PERCPU_ARRAY)
422 value_size = round_up(map->value_size, 8) * num_possible_cpus();
423 else if (IS_FD_MAP(map))
424 value_size = sizeof(u32);
425 else
426 value_size = map->value_size;
427
428 err = -ENOMEM;
429 value = kmalloc(value_size, GFP_USER | __GFP_NOWARN);
430 if (!value)
431 goto free_key;
432
433 if (map->map_type == BPF_MAP_TYPE_PERCPU_HASH ||
434 map->map_type == BPF_MAP_TYPE_LRU_PERCPU_HASH) {
435 err = bpf_percpu_hash_copy(map, key, value);
436 } else if (map->map_type == BPF_MAP_TYPE_PERCPU_ARRAY) {
437 err = bpf_percpu_array_copy(map, key, value);
438 } else if (map->map_type == BPF_MAP_TYPE_STACK_TRACE) {
439 err = bpf_stackmap_copy(map, key, value);
440 } else if (IS_FD_ARRAY(map)) {
441 err = bpf_fd_array_map_lookup_elem(map, key, value);
442 } else if (IS_FD_HASH(map)) {
443 err = bpf_fd_htab_map_lookup_elem(map, key, value);
444 } else {
445 rcu_read_lock();
446 ptr = map->ops->map_lookup_elem(map, key);
447 if (ptr)
448 memcpy(value, ptr, value_size);
449 rcu_read_unlock();
450 err = ptr ? 0 : -ENOENT;
451 }
452
453 if (err)
454 goto free_value;
455
456 err = -EFAULT;
457 if (copy_to_user(uvalue, value, value_size) != 0)
458 goto free_value;
459
460 trace_bpf_map_lookup_elem(map, ufd, key, value);
461 err = 0;
462
463free_value:
464 kfree(value);
465free_key:
466 kfree(key);
467err_put:
468 fdput(f);
469 return err;
470}
471
472#define BPF_MAP_UPDATE_ELEM_LAST_FIELD flags
473
474static int map_update_elem(union bpf_attr *attr)
475{
476 void __user *ukey = u64_to_user_ptr(attr->key);
477 void __user *uvalue = u64_to_user_ptr(attr->value);
478 int ufd = attr->map_fd;
479 struct bpf_map *map;
480 void *key, *value;
481 u32 value_size;
482 struct fd f;
483 int err;
484
485 if (CHECK_ATTR(BPF_MAP_UPDATE_ELEM))
486 return -EINVAL;
487
488 f = fdget(ufd);
489 map = __bpf_map_get(f);
490 if (IS_ERR(map))
491 return PTR_ERR(map);
492
493 key = memdup_user(ukey, map->key_size);
494 if (IS_ERR(key)) {
495 err = PTR_ERR(key);
496 goto err_put;
497 }
498
499 if (map->map_type == BPF_MAP_TYPE_PERCPU_HASH ||
500 map->map_type == BPF_MAP_TYPE_LRU_PERCPU_HASH ||
501 map->map_type == BPF_MAP_TYPE_PERCPU_ARRAY)
502 value_size = round_up(map->value_size, 8) * num_possible_cpus();
503 else
504 value_size = map->value_size;
505
506 err = -ENOMEM;
507 value = kmalloc(value_size, GFP_USER | __GFP_NOWARN);
508 if (!value)
509 goto free_key;
510
511 err = -EFAULT;
512 if (copy_from_user(value, uvalue, value_size) != 0)
513 goto free_value;
514
515
516
517
518 preempt_disable();
519 __this_cpu_inc(bpf_prog_active);
520 if (map->map_type == BPF_MAP_TYPE_PERCPU_HASH ||
521 map->map_type == BPF_MAP_TYPE_LRU_PERCPU_HASH) {
522 err = bpf_percpu_hash_update(map, key, value, attr->flags);
523 } else if (map->map_type == BPF_MAP_TYPE_PERCPU_ARRAY) {
524 err = bpf_percpu_array_update(map, key, value, attr->flags);
525 } else if (map->map_type == BPF_MAP_TYPE_PERF_EVENT_ARRAY ||
526 map->map_type == BPF_MAP_TYPE_PROG_ARRAY ||
527 map->map_type == BPF_MAP_TYPE_CGROUP_ARRAY ||
528 map->map_type == BPF_MAP_TYPE_ARRAY_OF_MAPS) {
529 rcu_read_lock();
530 err = bpf_fd_array_map_update_elem(map, f.file, key, value,
531 attr->flags);
532 rcu_read_unlock();
533 } else if (map->map_type == BPF_MAP_TYPE_HASH_OF_MAPS) {
534 rcu_read_lock();
535 err = bpf_fd_htab_map_update_elem(map, f.file, key, value,
536 attr->flags);
537 rcu_read_unlock();
538 } else {
539 rcu_read_lock();
540 err = map->ops->map_update_elem(map, key, value, attr->flags);
541 rcu_read_unlock();
542 }
543 __this_cpu_dec(bpf_prog_active);
544 preempt_enable();
545
546 if (!err)
547 trace_bpf_map_update_elem(map, ufd, key, value);
548free_value:
549 kfree(value);
550free_key:
551 kfree(key);
552err_put:
553 fdput(f);
554 return err;
555}
556
557#define BPF_MAP_DELETE_ELEM_LAST_FIELD key
558
559static int map_delete_elem(union bpf_attr *attr)
560{
561 void __user *ukey = u64_to_user_ptr(attr->key);
562 int ufd = attr->map_fd;
563 struct bpf_map *map;
564 struct fd f;
565 void *key;
566 int err;
567
568 if (CHECK_ATTR(BPF_MAP_DELETE_ELEM))
569 return -EINVAL;
570
571 f = fdget(ufd);
572 map = __bpf_map_get(f);
573 if (IS_ERR(map))
574 return PTR_ERR(map);
575
576 key = memdup_user(ukey, map->key_size);
577 if (IS_ERR(key)) {
578 err = PTR_ERR(key);
579 goto err_put;
580 }
581
582 preempt_disable();
583 __this_cpu_inc(bpf_prog_active);
584 rcu_read_lock();
585 err = map->ops->map_delete_elem(map, key);
586 rcu_read_unlock();
587 __this_cpu_dec(bpf_prog_active);
588 preempt_enable();
589
590 if (!err)
591 trace_bpf_map_delete_elem(map, ufd, key);
592 kfree(key);
593err_put:
594 fdput(f);
595 return err;
596}
597
598
599#define BPF_MAP_GET_NEXT_KEY_LAST_FIELD next_key
600
601static int map_get_next_key(union bpf_attr *attr)
602{
603 void __user *ukey = u64_to_user_ptr(attr->key);
604 void __user *unext_key = u64_to_user_ptr(attr->next_key);
605 int ufd = attr->map_fd;
606 struct bpf_map *map;
607 void *key, *next_key;
608 struct fd f;
609 int err;
610
611 if (CHECK_ATTR(BPF_MAP_GET_NEXT_KEY))
612 return -EINVAL;
613
614 f = fdget(ufd);
615 map = __bpf_map_get(f);
616 if (IS_ERR(map))
617 return PTR_ERR(map);
618
619 if (ukey) {
620 key = memdup_user(ukey, map->key_size);
621 if (IS_ERR(key)) {
622 err = PTR_ERR(key);
623 goto err_put;
624 }
625 } else {
626 key = NULL;
627 }
628
629 err = -ENOMEM;
630 next_key = kmalloc(map->key_size, GFP_USER);
631 if (!next_key)
632 goto free_key;
633
634 rcu_read_lock();
635 err = map->ops->map_get_next_key(map, key, next_key);
636 rcu_read_unlock();
637 if (err)
638 goto free_next_key;
639
640 err = -EFAULT;
641 if (copy_to_user(unext_key, next_key, map->key_size) != 0)
642 goto free_next_key;
643
644 trace_bpf_map_next_key(map, ufd, key, next_key);
645 err = 0;
646
647free_next_key:
648 kfree(next_key);
649free_key:
650 kfree(key);
651err_put:
652 fdput(f);
653 return err;
654}
655
656static const struct bpf_verifier_ops * const bpf_prog_types[] = {
657#define BPF_PROG_TYPE(_id, _ops) \
658 [_id] = &_ops,
659#define BPF_MAP_TYPE(_id, _ops)
660#include <linux/bpf_types.h>
661#undef BPF_PROG_TYPE
662#undef BPF_MAP_TYPE
663};
664
665static int find_prog_type(enum bpf_prog_type type, struct bpf_prog *prog)
666{
667 if (type >= ARRAY_SIZE(bpf_prog_types) || !bpf_prog_types[type])
668 return -EINVAL;
669
670 prog->aux->ops = bpf_prog_types[type];
671 prog->type = type;
672 return 0;
673}
674
675
676static void free_used_maps(struct bpf_prog_aux *aux)
677{
678 int i;
679
680 for (i = 0; i < aux->used_map_cnt; i++)
681 bpf_map_put(aux->used_maps[i]);
682
683 kfree(aux->used_maps);
684}
685
686int __bpf_prog_charge(struct user_struct *user, u32 pages)
687{
688 unsigned long memlock_limit = rlimit(RLIMIT_MEMLOCK) >> PAGE_SHIFT;
689 unsigned long user_bufs;
690
691 if (user) {
692 user_bufs = atomic_long_add_return(pages, &user->locked_vm);
693 if (user_bufs > memlock_limit) {
694 atomic_long_sub(pages, &user->locked_vm);
695 return -EPERM;
696 }
697 }
698
699 return 0;
700}
701
702void __bpf_prog_uncharge(struct user_struct *user, u32 pages)
703{
704 if (user)
705 atomic_long_sub(pages, &user->locked_vm);
706}
707
708static int bpf_prog_charge_memlock(struct bpf_prog *prog)
709{
710 struct user_struct *user = get_current_user();
711 int ret;
712
713 ret = __bpf_prog_charge(user, prog->pages);
714 if (ret) {
715 free_uid(user);
716 return ret;
717 }
718
719 prog->aux->user = user;
720 return 0;
721}
722
723static void bpf_prog_uncharge_memlock(struct bpf_prog *prog)
724{
725 struct user_struct *user = prog->aux->user;
726
727 __bpf_prog_uncharge(user, prog->pages);
728 free_uid(user);
729}
730
731static int bpf_prog_alloc_id(struct bpf_prog *prog)
732{
733 int id;
734
735 spin_lock_bh(&prog_idr_lock);
736 id = idr_alloc_cyclic(&prog_idr, prog, 1, INT_MAX, GFP_ATOMIC);
737 if (id > 0)
738 prog->aux->id = id;
739 spin_unlock_bh(&prog_idr_lock);
740
741
742 if (WARN_ON_ONCE(!id))
743 return -ENOSPC;
744
745 return id > 0 ? 0 : id;
746}
747
748static void bpf_prog_free_id(struct bpf_prog *prog, bool do_idr_lock)
749{
750
751 if (!prog->aux->id)
752 return;
753
754 if (do_idr_lock)
755 spin_lock_bh(&prog_idr_lock);
756 else
757 __acquire(&prog_idr_lock);
758
759 idr_remove(&prog_idr, prog->aux->id);
760
761 if (do_idr_lock)
762 spin_unlock_bh(&prog_idr_lock);
763 else
764 __release(&prog_idr_lock);
765}
766
767static void __bpf_prog_put_rcu(struct rcu_head *rcu)
768{
769 struct bpf_prog_aux *aux = container_of(rcu, struct bpf_prog_aux, rcu);
770
771 free_used_maps(aux);
772 bpf_prog_uncharge_memlock(aux->prog);
773 bpf_prog_free(aux->prog);
774}
775
776static void __bpf_prog_put(struct bpf_prog *prog, bool do_idr_lock)
777{
778 if (atomic_dec_and_test(&prog->aux->refcnt)) {
779 trace_bpf_prog_put_rcu(prog);
780
781 bpf_prog_free_id(prog, do_idr_lock);
782 bpf_prog_kallsyms_del(prog);
783 call_rcu(&prog->aux->rcu, __bpf_prog_put_rcu);
784 }
785}
786
787void bpf_prog_put(struct bpf_prog *prog)
788{
789 __bpf_prog_put(prog, true);
790}
791EXPORT_SYMBOL_GPL(bpf_prog_put);
792
793static int bpf_prog_release(struct inode *inode, struct file *filp)
794{
795 struct bpf_prog *prog = filp->private_data;
796
797 bpf_prog_put(prog);
798 return 0;
799}
800
801#ifdef CONFIG_PROC_FS
802static void bpf_prog_show_fdinfo(struct seq_file *m, struct file *filp)
803{
804 const struct bpf_prog *prog = filp->private_data;
805 char prog_tag[sizeof(prog->tag) * 2 + 1] = { };
806
807 bin2hex(prog_tag, prog->tag, sizeof(prog->tag));
808 seq_printf(m,
809 "prog_type:\t%u\n"
810 "prog_jited:\t%u\n"
811 "prog_tag:\t%s\n"
812 "memlock:\t%llu\n",
813 prog->type,
814 prog->jited,
815 prog_tag,
816 prog->pages * 1ULL << PAGE_SHIFT);
817}
818#endif
819
820static const struct file_operations bpf_prog_fops = {
821#ifdef CONFIG_PROC_FS
822 .show_fdinfo = bpf_prog_show_fdinfo,
823#endif
824 .release = bpf_prog_release,
825};
826
827int bpf_prog_new_fd(struct bpf_prog *prog)
828{
829 return anon_inode_getfd("bpf-prog", &bpf_prog_fops, prog,
830 O_RDWR | O_CLOEXEC);
831}
832
833static struct bpf_prog *____bpf_prog_get(struct fd f)
834{
835 if (!f.file)
836 return ERR_PTR(-EBADF);
837 if (f.file->f_op != &bpf_prog_fops) {
838 fdput(f);
839 return ERR_PTR(-EINVAL);
840 }
841
842 return f.file->private_data;
843}
844
845struct bpf_prog *bpf_prog_add(struct bpf_prog *prog, int i)
846{
847 if (atomic_add_return(i, &prog->aux->refcnt) > BPF_MAX_REFCNT) {
848 atomic_sub(i, &prog->aux->refcnt);
849 return ERR_PTR(-EBUSY);
850 }
851 return prog;
852}
853EXPORT_SYMBOL_GPL(bpf_prog_add);
854
855void bpf_prog_sub(struct bpf_prog *prog, int i)
856{
857
858
859
860
861
862 WARN_ON(atomic_sub_return(i, &prog->aux->refcnt) == 0);
863}
864EXPORT_SYMBOL_GPL(bpf_prog_sub);
865
866struct bpf_prog *bpf_prog_inc(struct bpf_prog *prog)
867{
868 return bpf_prog_add(prog, 1);
869}
870EXPORT_SYMBOL_GPL(bpf_prog_inc);
871
872
873static struct bpf_prog *bpf_prog_inc_not_zero(struct bpf_prog *prog)
874{
875 int refold;
876
877 refold = __atomic_add_unless(&prog->aux->refcnt, 1, 0);
878
879 if (refold >= BPF_MAX_REFCNT) {
880 __bpf_prog_put(prog, false);
881 return ERR_PTR(-EBUSY);
882 }
883
884 if (!refold)
885 return ERR_PTR(-ENOENT);
886
887 return prog;
888}
889
890static struct bpf_prog *__bpf_prog_get(u32 ufd, enum bpf_prog_type *type)
891{
892 struct fd f = fdget(ufd);
893 struct bpf_prog *prog;
894
895 prog = ____bpf_prog_get(f);
896 if (IS_ERR(prog))
897 return prog;
898 if (type && prog->type != *type) {
899 prog = ERR_PTR(-EINVAL);
900 goto out;
901 }
902
903 prog = bpf_prog_inc(prog);
904out:
905 fdput(f);
906 return prog;
907}
908
909struct bpf_prog *bpf_prog_get(u32 ufd)
910{
911 return __bpf_prog_get(ufd, NULL);
912}
913
914struct bpf_prog *bpf_prog_get_type(u32 ufd, enum bpf_prog_type type)
915{
916 struct bpf_prog *prog = __bpf_prog_get(ufd, &type);
917
918 if (!IS_ERR(prog))
919 trace_bpf_prog_get_type(prog);
920 return prog;
921}
922EXPORT_SYMBOL_GPL(bpf_prog_get_type);
923
924
925#define BPF_PROG_LOAD_LAST_FIELD prog_flags
926
927static int bpf_prog_load(union bpf_attr *attr)
928{
929 enum bpf_prog_type type = attr->prog_type;
930 struct bpf_prog *prog;
931 int err;
932 char license[128];
933 bool is_gpl;
934
935 if (CHECK_ATTR(BPF_PROG_LOAD))
936 return -EINVAL;
937
938 if (attr->prog_flags & ~BPF_F_STRICT_ALIGNMENT)
939 return -EINVAL;
940
941
942 if (strncpy_from_user(license, u64_to_user_ptr(attr->license),
943 sizeof(license) - 1) < 0)
944 return -EFAULT;
945 license[sizeof(license) - 1] = 0;
946
947
948 is_gpl = license_is_gpl_compatible(license);
949
950 if (attr->insn_cnt == 0 || attr->insn_cnt > BPF_MAXINSNS)
951 return -E2BIG;
952
953 if (type == BPF_PROG_TYPE_KPROBE &&
954 attr->kern_version != LINUX_VERSION_CODE)
955 return -EINVAL;
956
957 if (type != BPF_PROG_TYPE_SOCKET_FILTER &&
958 type != BPF_PROG_TYPE_CGROUP_SKB &&
959 !capable(CAP_SYS_ADMIN))
960 return -EPERM;
961
962
963 prog = bpf_prog_alloc(bpf_prog_size(attr->insn_cnt), GFP_USER);
964 if (!prog)
965 return -ENOMEM;
966
967 err = bpf_prog_charge_memlock(prog);
968 if (err)
969 goto free_prog_nouncharge;
970
971 prog->len = attr->insn_cnt;
972
973 err = -EFAULT;
974 if (copy_from_user(prog->insns, u64_to_user_ptr(attr->insns),
975 bpf_prog_insn_size(prog)) != 0)
976 goto free_prog;
977
978 prog->orig_prog = NULL;
979 prog->jited = 0;
980
981 atomic_set(&prog->aux->refcnt, 1);
982 prog->gpl_compatible = is_gpl ? 1 : 0;
983
984
985 err = find_prog_type(type, prog);
986 if (err < 0)
987 goto free_prog;
988
989
990 err = bpf_check(&prog, attr);
991 if (err < 0)
992 goto free_used_maps;
993
994
995 prog = bpf_prog_select_runtime(prog, &err);
996 if (err < 0)
997 goto free_used_maps;
998
999 err = bpf_prog_alloc_id(prog);
1000 if (err)
1001 goto free_used_maps;
1002
1003 err = bpf_prog_new_fd(prog);
1004 if (err < 0) {
1005
1006
1007
1008
1009
1010
1011 bpf_prog_put(prog);
1012 return err;
1013 }
1014
1015 bpf_prog_kallsyms_add(prog);
1016 trace_bpf_prog_load(prog, err);
1017 return err;
1018
1019free_used_maps:
1020 free_used_maps(prog->aux);
1021free_prog:
1022 bpf_prog_uncharge_memlock(prog);
1023free_prog_nouncharge:
1024 bpf_prog_free(prog);
1025 return err;
1026}
1027
1028#define BPF_OBJ_LAST_FIELD bpf_fd
1029
1030static int bpf_obj_pin(const union bpf_attr *attr)
1031{
1032 if (CHECK_ATTR(BPF_OBJ))
1033 return -EINVAL;
1034
1035 return bpf_obj_pin_user(attr->bpf_fd, u64_to_user_ptr(attr->pathname));
1036}
1037
1038static int bpf_obj_get(const union bpf_attr *attr)
1039{
1040 if (CHECK_ATTR(BPF_OBJ) || attr->bpf_fd != 0)
1041 return -EINVAL;
1042
1043 return bpf_obj_get_user(u64_to_user_ptr(attr->pathname));
1044}
1045
1046#ifdef CONFIG_CGROUP_BPF
1047
1048#define BPF_PROG_ATTACH_LAST_FIELD attach_flags
1049
1050static int bpf_prog_attach(const union bpf_attr *attr)
1051{
1052 enum bpf_prog_type ptype;
1053 struct bpf_prog *prog;
1054 struct cgroup *cgrp;
1055 int ret;
1056
1057 if (!capable(CAP_NET_ADMIN))
1058 return -EPERM;
1059
1060 if (CHECK_ATTR(BPF_PROG_ATTACH))
1061 return -EINVAL;
1062
1063 if (attr->attach_flags & ~BPF_F_ALLOW_OVERRIDE)
1064 return -EINVAL;
1065
1066 switch (attr->attach_type) {
1067 case BPF_CGROUP_INET_INGRESS:
1068 case BPF_CGROUP_INET_EGRESS:
1069 ptype = BPF_PROG_TYPE_CGROUP_SKB;
1070 break;
1071 case BPF_CGROUP_INET_SOCK_CREATE:
1072 ptype = BPF_PROG_TYPE_CGROUP_SOCK;
1073 break;
1074 case BPF_CGROUP_SOCK_OPS:
1075 ptype = BPF_PROG_TYPE_SOCK_OPS;
1076 break;
1077 default:
1078 return -EINVAL;
1079 }
1080
1081 prog = bpf_prog_get_type(attr->attach_bpf_fd, ptype);
1082 if (IS_ERR(prog))
1083 return PTR_ERR(prog);
1084
1085 cgrp = cgroup_get_from_fd(attr->target_fd);
1086 if (IS_ERR(cgrp)) {
1087 bpf_prog_put(prog);
1088 return PTR_ERR(cgrp);
1089 }
1090
1091 ret = cgroup_bpf_update(cgrp, prog, attr->attach_type,
1092 attr->attach_flags & BPF_F_ALLOW_OVERRIDE);
1093 if (ret)
1094 bpf_prog_put(prog);
1095 cgroup_put(cgrp);
1096
1097 return ret;
1098}
1099
1100#define BPF_PROG_DETACH_LAST_FIELD attach_type
1101
1102static int bpf_prog_detach(const union bpf_attr *attr)
1103{
1104 struct cgroup *cgrp;
1105 int ret;
1106
1107 if (!capable(CAP_NET_ADMIN))
1108 return -EPERM;
1109
1110 if (CHECK_ATTR(BPF_PROG_DETACH))
1111 return -EINVAL;
1112
1113 switch (attr->attach_type) {
1114 case BPF_CGROUP_INET_INGRESS:
1115 case BPF_CGROUP_INET_EGRESS:
1116 case BPF_CGROUP_INET_SOCK_CREATE:
1117 case BPF_CGROUP_SOCK_OPS:
1118 cgrp = cgroup_get_from_fd(attr->target_fd);
1119 if (IS_ERR(cgrp))
1120 return PTR_ERR(cgrp);
1121
1122 ret = cgroup_bpf_update(cgrp, NULL, attr->attach_type, false);
1123 cgroup_put(cgrp);
1124 break;
1125
1126 default:
1127 return -EINVAL;
1128 }
1129
1130 return ret;
1131}
1132
1133#endif
1134
1135#define BPF_PROG_TEST_RUN_LAST_FIELD test.duration
1136
1137static int bpf_prog_test_run(const union bpf_attr *attr,
1138 union bpf_attr __user *uattr)
1139{
1140 struct bpf_prog *prog;
1141 int ret = -ENOTSUPP;
1142
1143 if (CHECK_ATTR(BPF_PROG_TEST_RUN))
1144 return -EINVAL;
1145
1146 prog = bpf_prog_get(attr->test.prog_fd);
1147 if (IS_ERR(prog))
1148 return PTR_ERR(prog);
1149
1150 if (prog->aux->ops->test_run)
1151 ret = prog->aux->ops->test_run(prog, attr, uattr);
1152
1153 bpf_prog_put(prog);
1154 return ret;
1155}
1156
1157#define BPF_OBJ_GET_NEXT_ID_LAST_FIELD next_id
1158
1159static int bpf_obj_get_next_id(const union bpf_attr *attr,
1160 union bpf_attr __user *uattr,
1161 struct idr *idr,
1162 spinlock_t *lock)
1163{
1164 u32 next_id = attr->start_id;
1165 int err = 0;
1166
1167 if (CHECK_ATTR(BPF_OBJ_GET_NEXT_ID) || next_id >= INT_MAX)
1168 return -EINVAL;
1169
1170 if (!capable(CAP_SYS_ADMIN))
1171 return -EPERM;
1172
1173 next_id++;
1174 spin_lock_bh(lock);
1175 if (!idr_get_next(idr, &next_id))
1176 err = -ENOENT;
1177 spin_unlock_bh(lock);
1178
1179 if (!err)
1180 err = put_user(next_id, &uattr->next_id);
1181
1182 return err;
1183}
1184
1185#define BPF_PROG_GET_FD_BY_ID_LAST_FIELD prog_id
1186
1187static int bpf_prog_get_fd_by_id(const union bpf_attr *attr)
1188{
1189 struct bpf_prog *prog;
1190 u32 id = attr->prog_id;
1191 int fd;
1192
1193 if (CHECK_ATTR(BPF_PROG_GET_FD_BY_ID))
1194 return -EINVAL;
1195
1196 if (!capable(CAP_SYS_ADMIN))
1197 return -EPERM;
1198
1199 spin_lock_bh(&prog_idr_lock);
1200 prog = idr_find(&prog_idr, id);
1201 if (prog)
1202 prog = bpf_prog_inc_not_zero(prog);
1203 else
1204 prog = ERR_PTR(-ENOENT);
1205 spin_unlock_bh(&prog_idr_lock);
1206
1207 if (IS_ERR(prog))
1208 return PTR_ERR(prog);
1209
1210 fd = bpf_prog_new_fd(prog);
1211 if (fd < 0)
1212 bpf_prog_put(prog);
1213
1214 return fd;
1215}
1216
1217#define BPF_MAP_GET_FD_BY_ID_LAST_FIELD map_id
1218
1219static int bpf_map_get_fd_by_id(const union bpf_attr *attr)
1220{
1221 struct bpf_map *map;
1222 u32 id = attr->map_id;
1223 int fd;
1224
1225 if (CHECK_ATTR(BPF_MAP_GET_FD_BY_ID))
1226 return -EINVAL;
1227
1228 if (!capable(CAP_SYS_ADMIN))
1229 return -EPERM;
1230
1231 spin_lock_bh(&map_idr_lock);
1232 map = idr_find(&map_idr, id);
1233 if (map)
1234 map = bpf_map_inc_not_zero(map, true);
1235 else
1236 map = ERR_PTR(-ENOENT);
1237 spin_unlock_bh(&map_idr_lock);
1238
1239 if (IS_ERR(map))
1240 return PTR_ERR(map);
1241
1242 fd = bpf_map_new_fd(map);
1243 if (fd < 0)
1244 bpf_map_put(map);
1245
1246 return fd;
1247}
1248
1249static int check_uarg_tail_zero(void __user *uaddr,
1250 size_t expected_size,
1251 size_t actual_size)
1252{
1253 unsigned char __user *addr;
1254 unsigned char __user *end;
1255 unsigned char val;
1256 int err;
1257
1258 if (actual_size <= expected_size)
1259 return 0;
1260
1261 addr = uaddr + expected_size;
1262 end = uaddr + actual_size;
1263
1264 for (; addr < end; addr++) {
1265 err = get_user(val, addr);
1266 if (err)
1267 return err;
1268 if (val)
1269 return -E2BIG;
1270 }
1271
1272 return 0;
1273}
1274
1275static int bpf_prog_get_info_by_fd(struct bpf_prog *prog,
1276 const union bpf_attr *attr,
1277 union bpf_attr __user *uattr)
1278{
1279 struct bpf_prog_info __user *uinfo = u64_to_user_ptr(attr->info.info);
1280 struct bpf_prog_info info = {};
1281 u32 info_len = attr->info.info_len;
1282 char __user *uinsns;
1283 u32 ulen;
1284 int err;
1285
1286 err = check_uarg_tail_zero(uinfo, sizeof(info), info_len);
1287 if (err)
1288 return err;
1289 info_len = min_t(u32, sizeof(info), info_len);
1290
1291 if (copy_from_user(&info, uinfo, info_len))
1292 return -EFAULT;
1293
1294 info.type = prog->type;
1295 info.id = prog->aux->id;
1296
1297 memcpy(info.tag, prog->tag, sizeof(prog->tag));
1298
1299 if (!capable(CAP_SYS_ADMIN)) {
1300 info.jited_prog_len = 0;
1301 info.xlated_prog_len = 0;
1302 goto done;
1303 }
1304
1305 ulen = info.jited_prog_len;
1306 info.jited_prog_len = prog->jited_len;
1307 if (info.jited_prog_len && ulen) {
1308 uinsns = u64_to_user_ptr(info.jited_prog_insns);
1309 ulen = min_t(u32, info.jited_prog_len, ulen);
1310 if (copy_to_user(uinsns, prog->bpf_func, ulen))
1311 return -EFAULT;
1312 }
1313
1314 ulen = info.xlated_prog_len;
1315 info.xlated_prog_len = bpf_prog_insn_size(prog);
1316 if (info.xlated_prog_len && ulen) {
1317 uinsns = u64_to_user_ptr(info.xlated_prog_insns);
1318 ulen = min_t(u32, info.xlated_prog_len, ulen);
1319 if (copy_to_user(uinsns, prog->insnsi, ulen))
1320 return -EFAULT;
1321 }
1322
1323done:
1324 if (copy_to_user(uinfo, &info, info_len) ||
1325 put_user(info_len, &uattr->info.info_len))
1326 return -EFAULT;
1327
1328 return 0;
1329}
1330
1331static int bpf_map_get_info_by_fd(struct bpf_map *map,
1332 const union bpf_attr *attr,
1333 union bpf_attr __user *uattr)
1334{
1335 struct bpf_map_info __user *uinfo = u64_to_user_ptr(attr->info.info);
1336 struct bpf_map_info info = {};
1337 u32 info_len = attr->info.info_len;
1338 int err;
1339
1340 err = check_uarg_tail_zero(uinfo, sizeof(info), info_len);
1341 if (err)
1342 return err;
1343 info_len = min_t(u32, sizeof(info), info_len);
1344
1345 info.type = map->map_type;
1346 info.id = map->id;
1347 info.key_size = map->key_size;
1348 info.value_size = map->value_size;
1349 info.max_entries = map->max_entries;
1350 info.map_flags = map->map_flags;
1351
1352 if (copy_to_user(uinfo, &info, info_len) ||
1353 put_user(info_len, &uattr->info.info_len))
1354 return -EFAULT;
1355
1356 return 0;
1357}
1358
1359#define BPF_OBJ_GET_INFO_BY_FD_LAST_FIELD info.info
1360
1361static int bpf_obj_get_info_by_fd(const union bpf_attr *attr,
1362 union bpf_attr __user *uattr)
1363{
1364 int ufd = attr->info.bpf_fd;
1365 struct fd f;
1366 int err;
1367
1368 if (CHECK_ATTR(BPF_OBJ_GET_INFO_BY_FD))
1369 return -EINVAL;
1370
1371 f = fdget(ufd);
1372 if (!f.file)
1373 return -EBADFD;
1374
1375 if (f.file->f_op == &bpf_prog_fops)
1376 err = bpf_prog_get_info_by_fd(f.file->private_data, attr,
1377 uattr);
1378 else if (f.file->f_op == &bpf_map_fops)
1379 err = bpf_map_get_info_by_fd(f.file->private_data, attr,
1380 uattr);
1381 else
1382 err = -EINVAL;
1383
1384 fdput(f);
1385 return err;
1386}
1387
1388SYSCALL_DEFINE3(bpf, int, cmd, union bpf_attr __user *, uattr, unsigned int, size)
1389{
1390 union bpf_attr attr = {};
1391 int err;
1392
1393 if (!capable(CAP_SYS_ADMIN) && sysctl_unprivileged_bpf_disabled)
1394 return -EPERM;
1395
1396 if (!access_ok(VERIFY_READ, uattr, 1))
1397 return -EFAULT;
1398
1399 if (size > PAGE_SIZE)
1400 return -E2BIG;
1401
1402
1403
1404
1405
1406
1407 err = check_uarg_tail_zero(uattr, sizeof(attr), size);
1408 if (err)
1409 return err;
1410 size = min_t(u32, size, sizeof(attr));
1411
1412
1413 if (copy_from_user(&attr, uattr, size) != 0)
1414 return -EFAULT;
1415
1416 switch (cmd) {
1417 case BPF_MAP_CREATE:
1418 err = map_create(&attr);
1419 break;
1420 case BPF_MAP_LOOKUP_ELEM:
1421 err = map_lookup_elem(&attr);
1422 break;
1423 case BPF_MAP_UPDATE_ELEM:
1424 err = map_update_elem(&attr);
1425 break;
1426 case BPF_MAP_DELETE_ELEM:
1427 err = map_delete_elem(&attr);
1428 break;
1429 case BPF_MAP_GET_NEXT_KEY:
1430 err = map_get_next_key(&attr);
1431 break;
1432 case BPF_PROG_LOAD:
1433 err = bpf_prog_load(&attr);
1434 break;
1435 case BPF_OBJ_PIN:
1436 err = bpf_obj_pin(&attr);
1437 break;
1438 case BPF_OBJ_GET:
1439 err = bpf_obj_get(&attr);
1440 break;
1441#ifdef CONFIG_CGROUP_BPF
1442 case BPF_PROG_ATTACH:
1443 err = bpf_prog_attach(&attr);
1444 break;
1445 case BPF_PROG_DETACH:
1446 err = bpf_prog_detach(&attr);
1447 break;
1448#endif
1449 case BPF_PROG_TEST_RUN:
1450 err = bpf_prog_test_run(&attr, uattr);
1451 break;
1452 case BPF_PROG_GET_NEXT_ID:
1453 err = bpf_obj_get_next_id(&attr, uattr,
1454 &prog_idr, &prog_idr_lock);
1455 break;
1456 case BPF_MAP_GET_NEXT_ID:
1457 err = bpf_obj_get_next_id(&attr, uattr,
1458 &map_idr, &map_idr_lock);
1459 break;
1460 case BPF_PROG_GET_FD_BY_ID:
1461 err = bpf_prog_get_fd_by_id(&attr);
1462 break;
1463 case BPF_MAP_GET_FD_BY_ID:
1464 err = bpf_map_get_fd_by_id(&attr);
1465 break;
1466 case BPF_OBJ_GET_INFO_BY_FD:
1467 err = bpf_obj_get_info_by_fd(&attr, uattr);
1468 break;
1469 default:
1470 err = -EINVAL;
1471 break;
1472 }
1473
1474 return err;
1475}
1476
