syscall.c 19 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876
  1. /* Copyright (c) 2011-2014 PLUMgrid, http://plumgrid.com
  2. *
  3. * This program is free software; you can redistribute it and/or
  4. * modify it under the terms of version 2 of the GNU General Public
  5. * License as published by the Free Software Foundation.
  6. *
  7. * This program is distributed in the hope that it will be useful, but
  8. * WITHOUT ANY WARRANTY; without even the implied warranty of
  9. * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  10. * General Public License for more details.
  11. */
  12. #include <linux/bpf.h>
  13. #include <linux/syscalls.h>
  14. #include <linux/slab.h>
  15. #include <linux/vmalloc.h>
  16. #include <linux/mmzone.h>
  17. #include <linux/anon_inodes.h>
  18. #include <linux/file.h>
  19. #include <linux/license.h>
  20. #include <linux/filter.h>
  21. #include <linux/version.h>
  22. DEFINE_PER_CPU(int, bpf_prog_active);
  23. int sysctl_unprivileged_bpf_disabled __read_mostly;
  24. static LIST_HEAD(bpf_map_types);
  25. static struct bpf_map *find_and_alloc_map(union bpf_attr *attr)
  26. {
  27. struct bpf_map_type_list *tl;
  28. struct bpf_map *map;
  29. list_for_each_entry(tl, &bpf_map_types, list_node) {
  30. if (tl->type == attr->map_type) {
  31. map = tl->ops->map_alloc(attr);
  32. if (IS_ERR(map))
  33. return map;
  34. map->ops = tl->ops;
  35. map->map_type = attr->map_type;
  36. return map;
  37. }
  38. }
  39. return ERR_PTR(-EINVAL);
  40. }
  41. /* boot time registration of different map implementations */
  42. void bpf_register_map_type(struct bpf_map_type_list *tl)
  43. {
  44. list_add(&tl->list_node, &bpf_map_types);
  45. }
  46. void *bpf_map_area_alloc(size_t size)
  47. {
  48. /* We definitely need __GFP_NORETRY, so OOM killer doesn't
  49. * trigger under memory pressure as we really just want to
  50. * fail instead.
  51. */
  52. const gfp_t flags = __GFP_NOWARN | __GFP_NORETRY | __GFP_ZERO;
  53. void *area;
  54. if (size <= (PAGE_SIZE << PAGE_ALLOC_COSTLY_ORDER)) {
  55. area = kmalloc(size, GFP_USER | flags);
  56. if (area != NULL)
  57. return area;
  58. }
  59. return __vmalloc(size, GFP_KERNEL | __GFP_HIGHMEM | flags,
  60. PAGE_KERNEL);
  61. }
  62. void bpf_map_area_free(void *area)
  63. {
  64. kvfree(area);
  65. }
  66. int bpf_map_precharge_memlock(u32 pages)
  67. {
  68. struct user_struct *user = get_current_user();
  69. unsigned long memlock_limit, cur;
  70. memlock_limit = rlimit(RLIMIT_MEMLOCK) >> PAGE_SHIFT;
  71. cur = atomic_long_read(&user->locked_vm);
  72. free_uid(user);
  73. if (cur + pages > memlock_limit)
  74. return -EPERM;
  75. return 0;
  76. }
  77. static int bpf_map_charge_memlock(struct bpf_map *map)
  78. {
  79. struct user_struct *user = get_current_user();
  80. unsigned long memlock_limit;
  81. memlock_limit = rlimit(RLIMIT_MEMLOCK) >> PAGE_SHIFT;
  82. atomic_long_add(map->pages, &user->locked_vm);
  83. if (atomic_long_read(&user->locked_vm) > memlock_limit) {
  84. atomic_long_sub(map->pages, &user->locked_vm);
  85. free_uid(user);
  86. return -EPERM;
  87. }
  88. map->user = user;
  89. return 0;
  90. }
  91. static void bpf_map_uncharge_memlock(struct bpf_map *map)
  92. {
  93. struct user_struct *user = map->user;
  94. atomic_long_sub(map->pages, &user->locked_vm);
  95. free_uid(user);
  96. }
  97. /* called from workqueue */
  98. static void bpf_map_free_deferred(struct work_struct *work)
  99. {
  100. struct bpf_map *map = container_of(work, struct bpf_map, work);
  101. bpf_map_uncharge_memlock(map);
  102. /* implementation dependent freeing */
  103. map->ops->map_free(map);
  104. }
  105. static void bpf_map_put_uref(struct bpf_map *map)
  106. {
  107. if (atomic_dec_and_test(&map->usercnt)) {
  108. if (map->map_type == BPF_MAP_TYPE_PROG_ARRAY)
  109. bpf_fd_array_map_clear(map);
  110. }
  111. }
  112. /* decrement map refcnt and schedule it for freeing via workqueue
  113. * (unrelying map implementation ops->map_free() might sleep)
  114. */
  115. void bpf_map_put(struct bpf_map *map)
  116. {
  117. if (atomic_dec_and_test(&map->refcnt)) {
  118. INIT_WORK(&map->work, bpf_map_free_deferred);
  119. schedule_work(&map->work);
  120. }
  121. }
  122. void bpf_map_put_with_uref(struct bpf_map *map)
  123. {
  124. bpf_map_put_uref(map);
  125. bpf_map_put(map);
  126. }
  127. static int bpf_map_release(struct inode *inode, struct file *filp)
  128. {
  129. struct bpf_map *map = filp->private_data;
  130. if (map->ops->map_release)
  131. map->ops->map_release(map, filp);
  132. bpf_map_put_with_uref(map);
  133. return 0;
  134. }
  135. #ifdef CONFIG_PROC_FS
  136. static void bpf_map_show_fdinfo(struct seq_file *m, struct file *filp)
  137. {
  138. const struct bpf_map *map = filp->private_data;
  139. seq_printf(m,
  140. "map_type:\t%u\n"
  141. "key_size:\t%u\n"
  142. "value_size:\t%u\n"
  143. "max_entries:\t%u\n"
  144. "map_flags:\t%#x\n",
  145. map->map_type,
  146. map->key_size,
  147. map->value_size,
  148. map->max_entries,
  149. map->map_flags);
  150. }
  151. #endif
  152. static const struct file_operations bpf_map_fops = {
  153. #ifdef CONFIG_PROC_FS
  154. .show_fdinfo = bpf_map_show_fdinfo,
  155. #endif
  156. .release = bpf_map_release,
  157. };
  158. int bpf_map_new_fd(struct bpf_map *map)
  159. {
  160. return anon_inode_getfd("bpf-map", &bpf_map_fops, map,
  161. O_RDWR | O_CLOEXEC);
  162. }
  163. /* helper macro to check that unused fields 'union bpf_attr' are zero */
  164. #define CHECK_ATTR(CMD) \
  165. memchr_inv((void *) &attr->CMD##_LAST_FIELD + \
  166. sizeof(attr->CMD##_LAST_FIELD), 0, \
  167. sizeof(*attr) - \
  168. offsetof(union bpf_attr, CMD##_LAST_FIELD) - \
  169. sizeof(attr->CMD##_LAST_FIELD)) != NULL
  170. #define BPF_MAP_CREATE_LAST_FIELD map_flags
  171. /* called via syscall */
  172. static int map_create(union bpf_attr *attr)
  173. {
  174. struct bpf_map *map;
  175. int err;
  176. err = CHECK_ATTR(BPF_MAP_CREATE);
  177. if (err)
  178. return -EINVAL;
  179. /* find map type and init map: hashtable vs rbtree vs bloom vs ... */
  180. map = find_and_alloc_map(attr);
  181. if (IS_ERR(map))
  182. return PTR_ERR(map);
  183. atomic_set(&map->refcnt, 1);
  184. atomic_set(&map->usercnt, 1);
  185. err = bpf_map_charge_memlock(map);
  186. if (err)
  187. goto free_map_nouncharge;
  188. err = bpf_map_new_fd(map);
  189. if (err < 0)
  190. /* failed to allocate fd */
  191. goto free_map;
  192. return err;
  193. free_map:
  194. bpf_map_uncharge_memlock(map);
  195. free_map_nouncharge:
  196. map->ops->map_free(map);
  197. return err;
  198. }
  199. /* if error is returned, fd is released.
  200. * On success caller should complete fd access with matching fdput()
  201. */
  202. struct bpf_map *__bpf_map_get(struct fd f)
  203. {
  204. if (!f.file)
  205. return ERR_PTR(-EBADF);
  206. if (f.file->f_op != &bpf_map_fops) {
  207. fdput(f);
  208. return ERR_PTR(-EINVAL);
  209. }
  210. return f.file->private_data;
  211. }
  212. /* prog's and map's refcnt limit */
  213. #define BPF_MAX_REFCNT 32768
  214. struct bpf_map *bpf_map_inc(struct bpf_map *map, bool uref)
  215. {
  216. if (atomic_inc_return(&map->refcnt) > BPF_MAX_REFCNT) {
  217. atomic_dec(&map->refcnt);
  218. return ERR_PTR(-EBUSY);
  219. }
  220. if (uref)
  221. atomic_inc(&map->usercnt);
  222. return map;
  223. }
  224. struct bpf_map *bpf_map_get_with_uref(u32 ufd)
  225. {
  226. struct fd f = fdget(ufd);
  227. struct bpf_map *map;
  228. map = __bpf_map_get(f);
  229. if (IS_ERR(map))
  230. return map;
  231. map = bpf_map_inc(map, true);
  232. fdput(f);
  233. return map;
  234. }
  235. /* helper to convert user pointers passed inside __aligned_u64 fields */
  236. static void __user *u64_to_ptr(__u64 val)
  237. {
  238. return (void __user *) (unsigned long) val;
  239. }
  240. int __weak bpf_stackmap_copy(struct bpf_map *map, void *key, void *value)
  241. {
  242. return -ENOTSUPP;
  243. }
  244. /* last field in 'union bpf_attr' used by this command */
  245. #define BPF_MAP_LOOKUP_ELEM_LAST_FIELD value
  246. static int map_lookup_elem(union bpf_attr *attr)
  247. {
  248. void __user *ukey = u64_to_ptr(attr->key);
  249. void __user *uvalue = u64_to_ptr(attr->value);
  250. int ufd = attr->map_fd;
  251. struct bpf_map *map;
  252. void *key, *value, *ptr;
  253. u32 value_size;
  254. struct fd f;
  255. int err;
  256. if (CHECK_ATTR(BPF_MAP_LOOKUP_ELEM))
  257. return -EINVAL;
  258. f = fdget(ufd);
  259. map = __bpf_map_get(f);
  260. if (IS_ERR(map))
  261. return PTR_ERR(map);
  262. err = -ENOMEM;
  263. key = kmalloc(map->key_size, GFP_USER);
  264. if (!key)
  265. goto err_put;
  266. err = -EFAULT;
  267. if (copy_from_user(key, ukey, map->key_size) != 0)
  268. goto free_key;
  269. if (map->map_type == BPF_MAP_TYPE_PERCPU_HASH ||
  270. map->map_type == BPF_MAP_TYPE_PERCPU_ARRAY)
  271. value_size = round_up(map->value_size, 8) * num_possible_cpus();
  272. else
  273. value_size = map->value_size;
  274. err = -ENOMEM;
  275. value = kmalloc(value_size, GFP_USER | __GFP_NOWARN);
  276. if (!value)
  277. goto free_key;
  278. if (map->map_type == BPF_MAP_TYPE_PERCPU_HASH) {
  279. err = bpf_percpu_hash_copy(map, key, value);
  280. } else if (map->map_type == BPF_MAP_TYPE_PERCPU_ARRAY) {
  281. err = bpf_percpu_array_copy(map, key, value);
  282. } else if (map->map_type == BPF_MAP_TYPE_STACK_TRACE) {
  283. err = bpf_stackmap_copy(map, key, value);
  284. } else {
  285. rcu_read_lock();
  286. ptr = map->ops->map_lookup_elem(map, key);
  287. if (ptr)
  288. memcpy(value, ptr, value_size);
  289. rcu_read_unlock();
  290. err = ptr ? 0 : -ENOENT;
  291. }
  292. if (err)
  293. goto free_value;
  294. err = -EFAULT;
  295. if (copy_to_user(uvalue, value, value_size) != 0)
  296. goto free_value;
  297. err = 0;
  298. free_value:
  299. kfree(value);
  300. free_key:
  301. kfree(key);
  302. err_put:
  303. fdput(f);
  304. return err;
  305. }
  306. #define BPF_MAP_UPDATE_ELEM_LAST_FIELD flags
  307. static int map_update_elem(union bpf_attr *attr)
  308. {
  309. void __user *ukey = u64_to_ptr(attr->key);
  310. void __user *uvalue = u64_to_ptr(attr->value);
  311. int ufd = attr->map_fd;
  312. struct bpf_map *map;
  313. void *key, *value;
  314. u32 value_size;
  315. struct fd f;
  316. int err;
  317. if (CHECK_ATTR(BPF_MAP_UPDATE_ELEM))
  318. return -EINVAL;
  319. f = fdget(ufd);
  320. map = __bpf_map_get(f);
  321. if (IS_ERR(map))
  322. return PTR_ERR(map);
  323. err = -ENOMEM;
  324. key = kmalloc(map->key_size, GFP_USER);
  325. if (!key)
  326. goto err_put;
  327. err = -EFAULT;
  328. if (copy_from_user(key, ukey, map->key_size) != 0)
  329. goto free_key;
  330. if (map->map_type == BPF_MAP_TYPE_PERCPU_HASH ||
  331. map->map_type == BPF_MAP_TYPE_PERCPU_ARRAY)
  332. value_size = round_up(map->value_size, 8) * num_possible_cpus();
  333. else
  334. value_size = map->value_size;
  335. err = -ENOMEM;
  336. value = kmalloc(value_size, GFP_USER | __GFP_NOWARN);
  337. if (!value)
  338. goto free_key;
  339. err = -EFAULT;
  340. if (copy_from_user(value, uvalue, value_size) != 0)
  341. goto free_value;
  342. /* must increment bpf_prog_active to avoid kprobe+bpf triggering from
  343. * inside bpf map update or delete otherwise deadlocks are possible
  344. */
  345. preempt_disable();
  346. __this_cpu_inc(bpf_prog_active);
  347. if (map->map_type == BPF_MAP_TYPE_PERCPU_HASH) {
  348. err = bpf_percpu_hash_update(map, key, value, attr->flags);
  349. } else if (map->map_type == BPF_MAP_TYPE_PERCPU_ARRAY) {
  350. err = bpf_percpu_array_update(map, key, value, attr->flags);
  351. } else if (map->map_type == BPF_MAP_TYPE_PERF_EVENT_ARRAY ||
  352. map->map_type == BPF_MAP_TYPE_PROG_ARRAY ||
  353. map->map_type == BPF_MAP_TYPE_CGROUP_ARRAY) {
  354. rcu_read_lock();
  355. err = bpf_fd_array_map_update_elem(map, f.file, key, value,
  356. attr->flags);
  357. rcu_read_unlock();
  358. } else {
  359. rcu_read_lock();
  360. err = map->ops->map_update_elem(map, key, value, attr->flags);
  361. rcu_read_unlock();
  362. }
  363. __this_cpu_dec(bpf_prog_active);
  364. preempt_enable();
  365. free_value:
  366. kfree(value);
  367. free_key:
  368. kfree(key);
  369. err_put:
  370. fdput(f);
  371. return err;
  372. }
  373. #define BPF_MAP_DELETE_ELEM_LAST_FIELD key
  374. static int map_delete_elem(union bpf_attr *attr)
  375. {
  376. void __user *ukey = u64_to_ptr(attr->key);
  377. int ufd = attr->map_fd;
  378. struct bpf_map *map;
  379. struct fd f;
  380. void *key;
  381. int err;
  382. if (CHECK_ATTR(BPF_MAP_DELETE_ELEM))
  383. return -EINVAL;
  384. f = fdget(ufd);
  385. map = __bpf_map_get(f);
  386. if (IS_ERR(map))
  387. return PTR_ERR(map);
  388. err = -ENOMEM;
  389. key = kmalloc(map->key_size, GFP_USER);
  390. if (!key)
  391. goto err_put;
  392. err = -EFAULT;
  393. if (copy_from_user(key, ukey, map->key_size) != 0)
  394. goto free_key;
  395. preempt_disable();
  396. __this_cpu_inc(bpf_prog_active);
  397. rcu_read_lock();
  398. err = map->ops->map_delete_elem(map, key);
  399. rcu_read_unlock();
  400. __this_cpu_dec(bpf_prog_active);
  401. preempt_enable();
  402. free_key:
  403. kfree(key);
  404. err_put:
  405. fdput(f);
  406. return err;
  407. }
  408. /* last field in 'union bpf_attr' used by this command */
  409. #define BPF_MAP_GET_NEXT_KEY_LAST_FIELD next_key
  410. static int map_get_next_key(union bpf_attr *attr)
  411. {
  412. void __user *ukey = u64_to_ptr(attr->key);
  413. void __user *unext_key = u64_to_ptr(attr->next_key);
  414. int ufd = attr->map_fd;
  415. struct bpf_map *map;
  416. void *key, *next_key;
  417. struct fd f;
  418. int err;
  419. if (CHECK_ATTR(BPF_MAP_GET_NEXT_KEY))
  420. return -EINVAL;
  421. f = fdget(ufd);
  422. map = __bpf_map_get(f);
  423. if (IS_ERR(map))
  424. return PTR_ERR(map);
  425. if (ukey) {
  426. err = -ENOMEM;
  427. key = kmalloc(map->key_size, GFP_USER);
  428. if (!key)
  429. goto err_put;
  430. err = -EFAULT;
  431. if (copy_from_user(key, ukey, map->key_size) != 0)
  432. goto free_key;
  433. } else {
  434. key = NULL;
  435. }
  436. err = -ENOMEM;
  437. next_key = kmalloc(map->key_size, GFP_USER);
  438. if (!next_key)
  439. goto free_key;
  440. rcu_read_lock();
  441. err = map->ops->map_get_next_key(map, key, next_key);
  442. rcu_read_unlock();
  443. if (err)
  444. goto free_next_key;
  445. err = -EFAULT;
  446. if (copy_to_user(unext_key, next_key, map->key_size) != 0)
  447. goto free_next_key;
  448. err = 0;
  449. free_next_key:
  450. kfree(next_key);
  451. free_key:
  452. kfree(key);
  453. err_put:
  454. fdput(f);
  455. return err;
  456. }
  457. static LIST_HEAD(bpf_prog_types);
  458. static int find_prog_type(enum bpf_prog_type type, struct bpf_prog *prog)
  459. {
  460. struct bpf_prog_type_list *tl;
  461. list_for_each_entry(tl, &bpf_prog_types, list_node) {
  462. if (tl->type == type) {
  463. prog->aux->ops = tl->ops;
  464. prog->type = type;
  465. return 0;
  466. }
  467. }
  468. return -EINVAL;
  469. }
  470. void bpf_register_prog_type(struct bpf_prog_type_list *tl)
  471. {
  472. list_add(&tl->list_node, &bpf_prog_types);
  473. }
  474. /* drop refcnt on maps used by eBPF program and free auxilary data */
  475. static void free_used_maps(struct bpf_prog_aux *aux)
  476. {
  477. int i;
  478. for (i = 0; i < aux->used_map_cnt; i++)
  479. bpf_map_put(aux->used_maps[i]);
  480. kfree(aux->used_maps);
  481. }
  482. static int bpf_prog_charge_memlock(struct bpf_prog *prog)
  483. {
  484. struct user_struct *user = get_current_user();
  485. unsigned long memlock_limit;
  486. memlock_limit = rlimit(RLIMIT_MEMLOCK) >> PAGE_SHIFT;
  487. atomic_long_add(prog->pages, &user->locked_vm);
  488. if (atomic_long_read(&user->locked_vm) > memlock_limit) {
  489. atomic_long_sub(prog->pages, &user->locked_vm);
  490. free_uid(user);
  491. return -EPERM;
  492. }
  493. prog->aux->user = user;
  494. return 0;
  495. }
  496. static void bpf_prog_uncharge_memlock(struct bpf_prog *prog)
  497. {
  498. struct user_struct *user = prog->aux->user;
  499. atomic_long_sub(prog->pages, &user->locked_vm);
  500. free_uid(user);
  501. }
  502. static void __bpf_prog_put_rcu(struct rcu_head *rcu)
  503. {
  504. struct bpf_prog_aux *aux = container_of(rcu, struct bpf_prog_aux, rcu);
  505. free_used_maps(aux);
  506. bpf_prog_uncharge_memlock(aux->prog);
  507. bpf_prog_free(aux->prog);
  508. }
  509. void bpf_prog_put(struct bpf_prog *prog)
  510. {
  511. if (atomic_dec_and_test(&prog->aux->refcnt))
  512. call_rcu(&prog->aux->rcu, __bpf_prog_put_rcu);
  513. }
  514. EXPORT_SYMBOL_GPL(bpf_prog_put);
  515. static int bpf_prog_release(struct inode *inode, struct file *filp)
  516. {
  517. struct bpf_prog *prog = filp->private_data;
  518. bpf_prog_put(prog);
  519. return 0;
  520. }
  521. static const struct file_operations bpf_prog_fops = {
  522. .release = bpf_prog_release,
  523. };
  524. int bpf_prog_new_fd(struct bpf_prog *prog)
  525. {
  526. return anon_inode_getfd("bpf-prog", &bpf_prog_fops, prog,
  527. O_RDWR | O_CLOEXEC);
  528. }
  529. static struct bpf_prog *____bpf_prog_get(struct fd f)
  530. {
  531. if (!f.file)
  532. return ERR_PTR(-EBADF);
  533. if (f.file->f_op != &bpf_prog_fops) {
  534. fdput(f);
  535. return ERR_PTR(-EINVAL);
  536. }
  537. return f.file->private_data;
  538. }
  539. struct bpf_prog *bpf_prog_add(struct bpf_prog *prog, int i)
  540. {
  541. if (atomic_add_return(i, &prog->aux->refcnt) > BPF_MAX_REFCNT) {
  542. atomic_sub(i, &prog->aux->refcnt);
  543. return ERR_PTR(-EBUSY);
  544. }
  545. return prog;
  546. }
  547. EXPORT_SYMBOL_GPL(bpf_prog_add);
  548. struct bpf_prog *bpf_prog_inc(struct bpf_prog *prog)
  549. {
  550. return bpf_prog_add(prog, 1);
  551. }
  552. static struct bpf_prog *__bpf_prog_get(u32 ufd, enum bpf_prog_type *type)
  553. {
  554. struct fd f = fdget(ufd);
  555. struct bpf_prog *prog;
  556. prog = ____bpf_prog_get(f);
  557. if (IS_ERR(prog))
  558. return prog;
  559. if (type && prog->type != *type) {
  560. prog = ERR_PTR(-EINVAL);
  561. goto out;
  562. }
  563. prog = bpf_prog_inc(prog);
  564. out:
  565. fdput(f);
  566. return prog;
  567. }
  568. struct bpf_prog *bpf_prog_get(u32 ufd)
  569. {
  570. return __bpf_prog_get(ufd, NULL);
  571. }
  572. struct bpf_prog *bpf_prog_get_type(u32 ufd, enum bpf_prog_type type)
  573. {
  574. return __bpf_prog_get(ufd, &type);
  575. }
  576. EXPORT_SYMBOL_GPL(bpf_prog_get_type);
  577. /* last field in 'union bpf_attr' used by this command */
  578. #define BPF_PROG_LOAD_LAST_FIELD kern_version
  579. static int bpf_prog_load(union bpf_attr *attr)
  580. {
  581. enum bpf_prog_type type = attr->prog_type;
  582. struct bpf_prog *prog;
  583. int err;
  584. char license[128];
  585. bool is_gpl;
  586. if (CHECK_ATTR(BPF_PROG_LOAD))
  587. return -EINVAL;
  588. /* copy eBPF program license from user space */
  589. if (strncpy_from_user(license, u64_to_ptr(attr->license),
  590. sizeof(license) - 1) < 0)
  591. return -EFAULT;
  592. license[sizeof(license) - 1] = 0;
  593. /* eBPF programs must be GPL compatible to use GPL-ed functions */
  594. is_gpl = license_is_gpl_compatible(license);
  595. if (attr->insn_cnt >= BPF_MAXINSNS)
  596. return -EINVAL;
  597. if (type == BPF_PROG_TYPE_KPROBE &&
  598. attr->kern_version != LINUX_VERSION_CODE)
  599. return -EINVAL;
  600. if (type != BPF_PROG_TYPE_SOCKET_FILTER && !capable(CAP_SYS_ADMIN))
  601. return -EPERM;
  602. /* plain bpf_prog allocation */
  603. prog = bpf_prog_alloc(bpf_prog_size(attr->insn_cnt), GFP_USER);
  604. if (!prog)
  605. return -ENOMEM;
  606. err = bpf_prog_charge_memlock(prog);
  607. if (err)
  608. goto free_prog_nouncharge;
  609. prog->len = attr->insn_cnt;
  610. err = -EFAULT;
  611. if (copy_from_user(prog->insns, u64_to_ptr(attr->insns),
  612. prog->len * sizeof(struct bpf_insn)) != 0)
  613. goto free_prog;
  614. prog->orig_prog = NULL;
  615. prog->jited = 0;
  616. atomic_set(&prog->aux->refcnt, 1);
  617. prog->gpl_compatible = is_gpl ? 1 : 0;
  618. /* find program type: socket_filter vs tracing_filter */
  619. err = find_prog_type(type, prog);
  620. if (err < 0)
  621. goto free_prog;
  622. /* run eBPF verifier */
  623. err = bpf_check(&prog, attr);
  624. if (err < 0)
  625. goto free_used_maps;
  626. /* eBPF program is ready to be JITed */
  627. prog = bpf_prog_select_runtime(prog, &err);
  628. if (err < 0)
  629. goto free_used_maps;
  630. err = bpf_prog_new_fd(prog);
  631. if (err < 0)
  632. /* failed to allocate fd */
  633. goto free_used_maps;
  634. return err;
  635. free_used_maps:
  636. free_used_maps(prog->aux);
  637. free_prog:
  638. bpf_prog_uncharge_memlock(prog);
  639. free_prog_nouncharge:
  640. bpf_prog_free(prog);
  641. return err;
  642. }
  643. #define BPF_OBJ_LAST_FIELD bpf_fd
  644. static int bpf_obj_pin(const union bpf_attr *attr)
  645. {
  646. if (CHECK_ATTR(BPF_OBJ))
  647. return -EINVAL;
  648. return bpf_obj_pin_user(attr->bpf_fd, u64_to_ptr(attr->pathname));
  649. }
  650. static int bpf_obj_get(const union bpf_attr *attr)
  651. {
  652. if (CHECK_ATTR(BPF_OBJ) || attr->bpf_fd != 0)
  653. return -EINVAL;
  654. return bpf_obj_get_user(u64_to_ptr(attr->pathname));
  655. }
  656. SYSCALL_DEFINE3(bpf, int, cmd, union bpf_attr __user *, uattr, unsigned int, size)
  657. {
  658. union bpf_attr attr = {};
  659. int err;
  660. if (sysctl_unprivileged_bpf_disabled && !capable(CAP_SYS_ADMIN))
  661. return -EPERM;
  662. if (!access_ok(VERIFY_READ, uattr, 1))
  663. return -EFAULT;
  664. if (size > PAGE_SIZE) /* silly large */
  665. return -E2BIG;
  666. /* If we're handed a bigger struct than we know of,
  667. * ensure all the unknown bits are 0 - i.e. new
  668. * user-space does not rely on any kernel feature
  669. * extensions we dont know about yet.
  670. */
  671. if (size > sizeof(attr)) {
  672. unsigned char __user *addr;
  673. unsigned char __user *end;
  674. unsigned char val;
  675. addr = (void __user *)uattr + sizeof(attr);
  676. end = (void __user *)uattr + size;
  677. for (; addr < end; addr++) {
  678. err = get_user(val, addr);
  679. if (err)
  680. return err;
  681. if (val)
  682. return -E2BIG;
  683. }
  684. size = sizeof(attr);
  685. }
  686. /* copy attributes from user space, may be less than sizeof(bpf_attr) */
  687. if (copy_from_user(&attr, uattr, size) != 0)
  688. return -EFAULT;
  689. switch (cmd) {
  690. case BPF_MAP_CREATE:
  691. err = map_create(&attr);
  692. break;
  693. case BPF_MAP_LOOKUP_ELEM:
  694. err = map_lookup_elem(&attr);
  695. break;
  696. case BPF_MAP_UPDATE_ELEM:
  697. err = map_update_elem(&attr);
  698. break;
  699. case BPF_MAP_DELETE_ELEM:
  700. err = map_delete_elem(&attr);
  701. break;
  702. case BPF_MAP_GET_NEXT_KEY:
  703. err = map_get_next_key(&attr);
  704. break;
  705. case BPF_PROG_LOAD:
  706. err = bpf_prog_load(&attr);
  707. break;
  708. case BPF_OBJ_PIN:
  709. err = bpf_obj_pin(&attr);
  710. break;
  711. case BPF_OBJ_GET:
  712. err = bpf_obj_get(&attr);
  713. break;
  714. default:
  715. err = -EINVAL;
  716. break;
  717. }
  718. return err;
  719. }