syscall.c 19 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859
  1. /* Copyright (c) 2011-2014 PLUMgrid, http://plumgrid.com
  2. *
  3. * This program is free software; you can redistribute it and/or
  4. * modify it under the terms of version 2 of the GNU General Public
  5. * License as published by the Free Software Foundation.
  6. *
  7. * This program is distributed in the hope that it will be useful, but
  8. * WITHOUT ANY WARRANTY; without even the implied warranty of
  9. * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  10. * General Public License for more details.
  11. */
  12. #include <linux/bpf.h>
  13. #include <linux/syscalls.h>
  14. #include <linux/slab.h>
  15. #include <linux/anon_inodes.h>
  16. #include <linux/file.h>
  17. #include <linux/license.h>
  18. #include <linux/filter.h>
  19. #include <linux/version.h>
  20. DEFINE_PER_CPU(int, bpf_prog_active);
  21. int sysctl_unprivileged_bpf_disabled __read_mostly;
  22. static LIST_HEAD(bpf_map_types);
  23. static struct bpf_map *find_and_alloc_map(union bpf_attr *attr)
  24. {
  25. struct bpf_map_type_list *tl;
  26. struct bpf_map *map;
  27. list_for_each_entry(tl, &bpf_map_types, list_node) {
  28. if (tl->type == attr->map_type) {
  29. map = tl->ops->map_alloc(attr);
  30. if (IS_ERR(map))
  31. return map;
  32. map->ops = tl->ops;
  33. map->map_type = attr->map_type;
  34. return map;
  35. }
  36. }
  37. return ERR_PTR(-EINVAL);
  38. }
  39. /* boot time registration of different map implementations */
  40. void bpf_register_map_type(struct bpf_map_type_list *tl)
  41. {
  42. list_add(&tl->list_node, &bpf_map_types);
  43. }
  44. int bpf_map_precharge_memlock(u32 pages)
  45. {
  46. struct user_struct *user = get_current_user();
  47. unsigned long memlock_limit, cur;
  48. memlock_limit = rlimit(RLIMIT_MEMLOCK) >> PAGE_SHIFT;
  49. cur = atomic_long_read(&user->locked_vm);
  50. free_uid(user);
  51. if (cur + pages > memlock_limit)
  52. return -EPERM;
  53. return 0;
  54. }
  55. static int bpf_map_charge_memlock(struct bpf_map *map)
  56. {
  57. struct user_struct *user = get_current_user();
  58. unsigned long memlock_limit;
  59. memlock_limit = rlimit(RLIMIT_MEMLOCK) >> PAGE_SHIFT;
  60. atomic_long_add(map->pages, &user->locked_vm);
  61. if (atomic_long_read(&user->locked_vm) > memlock_limit) {
  62. atomic_long_sub(map->pages, &user->locked_vm);
  63. free_uid(user);
  64. return -EPERM;
  65. }
  66. map->user = user;
  67. return 0;
  68. }
  69. static void bpf_map_uncharge_memlock(struct bpf_map *map)
  70. {
  71. struct user_struct *user = map->user;
  72. atomic_long_sub(map->pages, &user->locked_vm);
  73. free_uid(user);
  74. }
  75. /* called from workqueue */
  76. static void bpf_map_free_deferred(struct work_struct *work)
  77. {
  78. struct bpf_map *map = container_of(work, struct bpf_map, work);
  79. bpf_map_uncharge_memlock(map);
  80. /* implementation dependent freeing */
  81. map->ops->map_free(map);
  82. }
  83. static void bpf_map_put_uref(struct bpf_map *map)
  84. {
  85. if (atomic_dec_and_test(&map->usercnt)) {
  86. if (map->map_type == BPF_MAP_TYPE_PROG_ARRAY)
  87. bpf_fd_array_map_clear(map);
  88. }
  89. }
  90. /* decrement map refcnt and schedule it for freeing via workqueue
  91. * (unrelying map implementation ops->map_free() might sleep)
  92. */
  93. void bpf_map_put(struct bpf_map *map)
  94. {
  95. if (atomic_dec_and_test(&map->refcnt)) {
  96. INIT_WORK(&map->work, bpf_map_free_deferred);
  97. schedule_work(&map->work);
  98. }
  99. }
  100. void bpf_map_put_with_uref(struct bpf_map *map)
  101. {
  102. bpf_map_put_uref(map);
  103. bpf_map_put(map);
  104. }
  105. static int bpf_map_release(struct inode *inode, struct file *filp)
  106. {
  107. bpf_map_put_with_uref(filp->private_data);
  108. return 0;
  109. }
  110. #ifdef CONFIG_PROC_FS
  111. static void bpf_map_show_fdinfo(struct seq_file *m, struct file *filp)
  112. {
  113. const struct bpf_map *map = filp->private_data;
  114. seq_printf(m,
  115. "map_type:\t%u\n"
  116. "key_size:\t%u\n"
  117. "value_size:\t%u\n"
  118. "max_entries:\t%u\n"
  119. "map_flags:\t%#x\n",
  120. map->map_type,
  121. map->key_size,
  122. map->value_size,
  123. map->max_entries,
  124. map->map_flags);
  125. }
  126. #endif
  127. static const struct file_operations bpf_map_fops = {
  128. #ifdef CONFIG_PROC_FS
  129. .show_fdinfo = bpf_map_show_fdinfo,
  130. #endif
  131. .release = bpf_map_release,
  132. };
  133. int bpf_map_new_fd(struct bpf_map *map)
  134. {
  135. return anon_inode_getfd("bpf-map", &bpf_map_fops, map,
  136. O_RDWR | O_CLOEXEC);
  137. }
  138. /* helper macro to check that unused fields 'union bpf_attr' are zero */
  139. #define CHECK_ATTR(CMD) \
  140. memchr_inv((void *) &attr->CMD##_LAST_FIELD + \
  141. sizeof(attr->CMD##_LAST_FIELD), 0, \
  142. sizeof(*attr) - \
  143. offsetof(union bpf_attr, CMD##_LAST_FIELD) - \
  144. sizeof(attr->CMD##_LAST_FIELD)) != NULL
  145. #define BPF_MAP_CREATE_LAST_FIELD map_flags
  146. /* called via syscall */
  147. static int map_create(union bpf_attr *attr)
  148. {
  149. struct bpf_map *map;
  150. int err;
  151. err = CHECK_ATTR(BPF_MAP_CREATE);
  152. if (err)
  153. return -EINVAL;
  154. /* find map type and init map: hashtable vs rbtree vs bloom vs ... */
  155. map = find_and_alloc_map(attr);
  156. if (IS_ERR(map))
  157. return PTR_ERR(map);
  158. atomic_set(&map->refcnt, 1);
  159. atomic_set(&map->usercnt, 1);
  160. err = bpf_map_charge_memlock(map);
  161. if (err)
  162. goto free_map;
  163. err = bpf_map_new_fd(map);
  164. if (err < 0)
  165. /* failed to allocate fd */
  166. goto free_map;
  167. return err;
  168. free_map:
  169. map->ops->map_free(map);
  170. return err;
  171. }
  172. /* if error is returned, fd is released.
  173. * On success caller should complete fd access with matching fdput()
  174. */
  175. struct bpf_map *__bpf_map_get(struct fd f)
  176. {
  177. if (!f.file)
  178. return ERR_PTR(-EBADF);
  179. if (f.file->f_op != &bpf_map_fops) {
  180. fdput(f);
  181. return ERR_PTR(-EINVAL);
  182. }
  183. return f.file->private_data;
  184. }
  185. void bpf_map_inc(struct bpf_map *map, bool uref)
  186. {
  187. atomic_inc(&map->refcnt);
  188. if (uref)
  189. atomic_inc(&map->usercnt);
  190. }
  191. struct bpf_map *bpf_map_get_with_uref(u32 ufd)
  192. {
  193. struct fd f = fdget(ufd);
  194. struct bpf_map *map;
  195. map = __bpf_map_get(f);
  196. if (IS_ERR(map))
  197. return map;
  198. bpf_map_inc(map, true);
  199. fdput(f);
  200. return map;
  201. }
  202. /* helper to convert user pointers passed inside __aligned_u64 fields */
  203. static void __user *u64_to_ptr(__u64 val)
  204. {
  205. return (void __user *) (unsigned long) val;
  206. }
  207. int __weak bpf_stackmap_copy(struct bpf_map *map, void *key, void *value)
  208. {
  209. return -ENOTSUPP;
  210. }
  211. /* last field in 'union bpf_attr' used by this command */
  212. #define BPF_MAP_LOOKUP_ELEM_LAST_FIELD value
  213. static int map_lookup_elem(union bpf_attr *attr)
  214. {
  215. void __user *ukey = u64_to_ptr(attr->key);
  216. void __user *uvalue = u64_to_ptr(attr->value);
  217. int ufd = attr->map_fd;
  218. struct bpf_map *map;
  219. void *key, *value, *ptr;
  220. u32 value_size;
  221. struct fd f;
  222. int err;
  223. if (CHECK_ATTR(BPF_MAP_LOOKUP_ELEM))
  224. return -EINVAL;
  225. f = fdget(ufd);
  226. map = __bpf_map_get(f);
  227. if (IS_ERR(map))
  228. return PTR_ERR(map);
  229. err = -ENOMEM;
  230. key = kmalloc(map->key_size, GFP_USER);
  231. if (!key)
  232. goto err_put;
  233. err = -EFAULT;
  234. if (copy_from_user(key, ukey, map->key_size) != 0)
  235. goto free_key;
  236. if (map->map_type == BPF_MAP_TYPE_PERCPU_HASH ||
  237. map->map_type == BPF_MAP_TYPE_PERCPU_ARRAY)
  238. value_size = round_up(map->value_size, 8) * num_possible_cpus();
  239. else
  240. value_size = map->value_size;
  241. err = -ENOMEM;
  242. value = kmalloc(value_size, GFP_USER | __GFP_NOWARN);
  243. if (!value)
  244. goto free_key;
  245. if (map->map_type == BPF_MAP_TYPE_PERCPU_HASH) {
  246. err = bpf_percpu_hash_copy(map, key, value);
  247. } else if (map->map_type == BPF_MAP_TYPE_PERCPU_ARRAY) {
  248. err = bpf_percpu_array_copy(map, key, value);
  249. } else if (map->map_type == BPF_MAP_TYPE_STACK_TRACE) {
  250. err = bpf_stackmap_copy(map, key, value);
  251. } else {
  252. rcu_read_lock();
  253. ptr = map->ops->map_lookup_elem(map, key);
  254. if (ptr)
  255. memcpy(value, ptr, value_size);
  256. rcu_read_unlock();
  257. err = ptr ? 0 : -ENOENT;
  258. }
  259. if (err)
  260. goto free_value;
  261. err = -EFAULT;
  262. if (copy_to_user(uvalue, value, value_size) != 0)
  263. goto free_value;
  264. err = 0;
  265. free_value:
  266. kfree(value);
  267. free_key:
  268. kfree(key);
  269. err_put:
  270. fdput(f);
  271. return err;
  272. }
  273. #define BPF_MAP_UPDATE_ELEM_LAST_FIELD flags
  274. static int map_update_elem(union bpf_attr *attr)
  275. {
  276. void __user *ukey = u64_to_ptr(attr->key);
  277. void __user *uvalue = u64_to_ptr(attr->value);
  278. int ufd = attr->map_fd;
  279. struct bpf_map *map;
  280. void *key, *value;
  281. u32 value_size;
  282. struct fd f;
  283. int err;
  284. if (CHECK_ATTR(BPF_MAP_UPDATE_ELEM))
  285. return -EINVAL;
  286. f = fdget(ufd);
  287. map = __bpf_map_get(f);
  288. if (IS_ERR(map))
  289. return PTR_ERR(map);
  290. err = -ENOMEM;
  291. key = kmalloc(map->key_size, GFP_USER);
  292. if (!key)
  293. goto err_put;
  294. err = -EFAULT;
  295. if (copy_from_user(key, ukey, map->key_size) != 0)
  296. goto free_key;
  297. if (map->map_type == BPF_MAP_TYPE_PERCPU_HASH ||
  298. map->map_type == BPF_MAP_TYPE_PERCPU_ARRAY)
  299. value_size = round_up(map->value_size, 8) * num_possible_cpus();
  300. else
  301. value_size = map->value_size;
  302. err = -ENOMEM;
  303. value = kmalloc(value_size, GFP_USER | __GFP_NOWARN);
  304. if (!value)
  305. goto free_key;
  306. err = -EFAULT;
  307. if (copy_from_user(value, uvalue, value_size) != 0)
  308. goto free_value;
  309. /* must increment bpf_prog_active to avoid kprobe+bpf triggering from
  310. * inside bpf map update or delete otherwise deadlocks are possible
  311. */
  312. preempt_disable();
  313. __this_cpu_inc(bpf_prog_active);
  314. if (map->map_type == BPF_MAP_TYPE_PERCPU_HASH) {
  315. err = bpf_percpu_hash_update(map, key, value, attr->flags);
  316. } else if (map->map_type == BPF_MAP_TYPE_PERCPU_ARRAY) {
  317. err = bpf_percpu_array_update(map, key, value, attr->flags);
  318. } else {
  319. rcu_read_lock();
  320. err = map->ops->map_update_elem(map, key, value, attr->flags);
  321. rcu_read_unlock();
  322. }
  323. __this_cpu_dec(bpf_prog_active);
  324. preempt_enable();
  325. free_value:
  326. kfree(value);
  327. free_key:
  328. kfree(key);
  329. err_put:
  330. fdput(f);
  331. return err;
  332. }
  333. #define BPF_MAP_DELETE_ELEM_LAST_FIELD key
  334. static int map_delete_elem(union bpf_attr *attr)
  335. {
  336. void __user *ukey = u64_to_ptr(attr->key);
  337. int ufd = attr->map_fd;
  338. struct bpf_map *map;
  339. struct fd f;
  340. void *key;
  341. int err;
  342. if (CHECK_ATTR(BPF_MAP_DELETE_ELEM))
  343. return -EINVAL;
  344. f = fdget(ufd);
  345. map = __bpf_map_get(f);
  346. if (IS_ERR(map))
  347. return PTR_ERR(map);
  348. err = -ENOMEM;
  349. key = kmalloc(map->key_size, GFP_USER);
  350. if (!key)
  351. goto err_put;
  352. err = -EFAULT;
  353. if (copy_from_user(key, ukey, map->key_size) != 0)
  354. goto free_key;
  355. preempt_disable();
  356. __this_cpu_inc(bpf_prog_active);
  357. rcu_read_lock();
  358. err = map->ops->map_delete_elem(map, key);
  359. rcu_read_unlock();
  360. __this_cpu_dec(bpf_prog_active);
  361. preempt_enable();
  362. free_key:
  363. kfree(key);
  364. err_put:
  365. fdput(f);
  366. return err;
  367. }
  368. /* last field in 'union bpf_attr' used by this command */
  369. #define BPF_MAP_GET_NEXT_KEY_LAST_FIELD next_key
  370. static int map_get_next_key(union bpf_attr *attr)
  371. {
  372. void __user *ukey = u64_to_ptr(attr->key);
  373. void __user *unext_key = u64_to_ptr(attr->next_key);
  374. int ufd = attr->map_fd;
  375. struct bpf_map *map;
  376. void *key, *next_key;
  377. struct fd f;
  378. int err;
  379. if (CHECK_ATTR(BPF_MAP_GET_NEXT_KEY))
  380. return -EINVAL;
  381. f = fdget(ufd);
  382. map = __bpf_map_get(f);
  383. if (IS_ERR(map))
  384. return PTR_ERR(map);
  385. err = -ENOMEM;
  386. key = kmalloc(map->key_size, GFP_USER);
  387. if (!key)
  388. goto err_put;
  389. err = -EFAULT;
  390. if (copy_from_user(key, ukey, map->key_size) != 0)
  391. goto free_key;
  392. err = -ENOMEM;
  393. next_key = kmalloc(map->key_size, GFP_USER);
  394. if (!next_key)
  395. goto free_key;
  396. rcu_read_lock();
  397. err = map->ops->map_get_next_key(map, key, next_key);
  398. rcu_read_unlock();
  399. if (err)
  400. goto free_next_key;
  401. err = -EFAULT;
  402. if (copy_to_user(unext_key, next_key, map->key_size) != 0)
  403. goto free_next_key;
  404. err = 0;
  405. free_next_key:
  406. kfree(next_key);
  407. free_key:
  408. kfree(key);
  409. err_put:
  410. fdput(f);
  411. return err;
  412. }
  413. static LIST_HEAD(bpf_prog_types);
  414. static int find_prog_type(enum bpf_prog_type type, struct bpf_prog *prog)
  415. {
  416. struct bpf_prog_type_list *tl;
  417. list_for_each_entry(tl, &bpf_prog_types, list_node) {
  418. if (tl->type == type) {
  419. prog->aux->ops = tl->ops;
  420. prog->type = type;
  421. return 0;
  422. }
  423. }
  424. return -EINVAL;
  425. }
  426. void bpf_register_prog_type(struct bpf_prog_type_list *tl)
  427. {
  428. list_add(&tl->list_node, &bpf_prog_types);
  429. }
  430. /* fixup insn->imm field of bpf_call instructions:
  431. * if (insn->imm == BPF_FUNC_map_lookup_elem)
  432. * insn->imm = bpf_map_lookup_elem - __bpf_call_base;
  433. * else if (insn->imm == BPF_FUNC_map_update_elem)
  434. * insn->imm = bpf_map_update_elem - __bpf_call_base;
  435. * else ...
  436. *
  437. * this function is called after eBPF program passed verification
  438. */
  439. static void fixup_bpf_calls(struct bpf_prog *prog)
  440. {
  441. const struct bpf_func_proto *fn;
  442. int i;
  443. for (i = 0; i < prog->len; i++) {
  444. struct bpf_insn *insn = &prog->insnsi[i];
  445. if (insn->code == (BPF_JMP | BPF_CALL)) {
  446. /* we reach here when program has bpf_call instructions
  447. * and it passed bpf_check(), means that
  448. * ops->get_func_proto must have been supplied, check it
  449. */
  450. BUG_ON(!prog->aux->ops->get_func_proto);
  451. if (insn->imm == BPF_FUNC_get_route_realm)
  452. prog->dst_needed = 1;
  453. if (insn->imm == BPF_FUNC_get_prandom_u32)
  454. bpf_user_rnd_init_once();
  455. if (insn->imm == BPF_FUNC_tail_call) {
  456. /* mark bpf_tail_call as different opcode
  457. * to avoid conditional branch in
  458. * interpeter for every normal call
  459. * and to prevent accidental JITing by
  460. * JIT compiler that doesn't support
  461. * bpf_tail_call yet
  462. */
  463. insn->imm = 0;
  464. insn->code |= BPF_X;
  465. continue;
  466. }
  467. fn = prog->aux->ops->get_func_proto(insn->imm);
  468. /* all functions that have prototype and verifier allowed
  469. * programs to call them, must be real in-kernel functions
  470. */
  471. BUG_ON(!fn->func);
  472. insn->imm = fn->func - __bpf_call_base;
  473. }
  474. }
  475. }
  476. /* drop refcnt on maps used by eBPF program and free auxilary data */
  477. static void free_used_maps(struct bpf_prog_aux *aux)
  478. {
  479. int i;
  480. for (i = 0; i < aux->used_map_cnt; i++)
  481. bpf_map_put(aux->used_maps[i]);
  482. kfree(aux->used_maps);
  483. }
  484. static int bpf_prog_charge_memlock(struct bpf_prog *prog)
  485. {
  486. struct user_struct *user = get_current_user();
  487. unsigned long memlock_limit;
  488. memlock_limit = rlimit(RLIMIT_MEMLOCK) >> PAGE_SHIFT;
  489. atomic_long_add(prog->pages, &user->locked_vm);
  490. if (atomic_long_read(&user->locked_vm) > memlock_limit) {
  491. atomic_long_sub(prog->pages, &user->locked_vm);
  492. free_uid(user);
  493. return -EPERM;
  494. }
  495. prog->aux->user = user;
  496. return 0;
  497. }
  498. static void bpf_prog_uncharge_memlock(struct bpf_prog *prog)
  499. {
  500. struct user_struct *user = prog->aux->user;
  501. atomic_long_sub(prog->pages, &user->locked_vm);
  502. free_uid(user);
  503. }
  504. static void __prog_put_common(struct rcu_head *rcu)
  505. {
  506. struct bpf_prog_aux *aux = container_of(rcu, struct bpf_prog_aux, rcu);
  507. free_used_maps(aux);
  508. bpf_prog_uncharge_memlock(aux->prog);
  509. bpf_prog_free(aux->prog);
  510. }
  511. /* version of bpf_prog_put() that is called after a grace period */
  512. void bpf_prog_put_rcu(struct bpf_prog *prog)
  513. {
  514. if (atomic_dec_and_test(&prog->aux->refcnt))
  515. call_rcu(&prog->aux->rcu, __prog_put_common);
  516. }
  517. void bpf_prog_put(struct bpf_prog *prog)
  518. {
  519. if (atomic_dec_and_test(&prog->aux->refcnt))
  520. __prog_put_common(&prog->aux->rcu);
  521. }
  522. EXPORT_SYMBOL_GPL(bpf_prog_put);
  523. static int bpf_prog_release(struct inode *inode, struct file *filp)
  524. {
  525. struct bpf_prog *prog = filp->private_data;
  526. bpf_prog_put_rcu(prog);
  527. return 0;
  528. }
  529. static const struct file_operations bpf_prog_fops = {
  530. .release = bpf_prog_release,
  531. };
  532. int bpf_prog_new_fd(struct bpf_prog *prog)
  533. {
  534. return anon_inode_getfd("bpf-prog", &bpf_prog_fops, prog,
  535. O_RDWR | O_CLOEXEC);
  536. }
  537. static struct bpf_prog *__bpf_prog_get(struct fd f)
  538. {
  539. if (!f.file)
  540. return ERR_PTR(-EBADF);
  541. if (f.file->f_op != &bpf_prog_fops) {
  542. fdput(f);
  543. return ERR_PTR(-EINVAL);
  544. }
  545. return f.file->private_data;
  546. }
  547. /* called by sockets/tracing/seccomp before attaching program to an event
  548. * pairs with bpf_prog_put()
  549. */
  550. struct bpf_prog *bpf_prog_get(u32 ufd)
  551. {
  552. struct fd f = fdget(ufd);
  553. struct bpf_prog *prog;
  554. prog = __bpf_prog_get(f);
  555. if (IS_ERR(prog))
  556. return prog;
  557. atomic_inc(&prog->aux->refcnt);
  558. fdput(f);
  559. return prog;
  560. }
  561. EXPORT_SYMBOL_GPL(bpf_prog_get);
  562. /* last field in 'union bpf_attr' used by this command */
  563. #define BPF_PROG_LOAD_LAST_FIELD kern_version
  564. static int bpf_prog_load(union bpf_attr *attr)
  565. {
  566. enum bpf_prog_type type = attr->prog_type;
  567. struct bpf_prog *prog;
  568. int err;
  569. char license[128];
  570. bool is_gpl;
  571. if (CHECK_ATTR(BPF_PROG_LOAD))
  572. return -EINVAL;
  573. /* copy eBPF program license from user space */
  574. if (strncpy_from_user(license, u64_to_ptr(attr->license),
  575. sizeof(license) - 1) < 0)
  576. return -EFAULT;
  577. license[sizeof(license) - 1] = 0;
  578. /* eBPF programs must be GPL compatible to use GPL-ed functions */
  579. is_gpl = license_is_gpl_compatible(license);
  580. if (attr->insn_cnt >= BPF_MAXINSNS)
  581. return -EINVAL;
  582. if (type == BPF_PROG_TYPE_KPROBE &&
  583. attr->kern_version != LINUX_VERSION_CODE)
  584. return -EINVAL;
  585. if (type != BPF_PROG_TYPE_SOCKET_FILTER && !capable(CAP_SYS_ADMIN))
  586. return -EPERM;
  587. /* plain bpf_prog allocation */
  588. prog = bpf_prog_alloc(bpf_prog_size(attr->insn_cnt), GFP_USER);
  589. if (!prog)
  590. return -ENOMEM;
  591. err = bpf_prog_charge_memlock(prog);
  592. if (err)
  593. goto free_prog_nouncharge;
  594. prog->len = attr->insn_cnt;
  595. err = -EFAULT;
  596. if (copy_from_user(prog->insns, u64_to_ptr(attr->insns),
  597. prog->len * sizeof(struct bpf_insn)) != 0)
  598. goto free_prog;
  599. prog->orig_prog = NULL;
  600. prog->jited = 0;
  601. atomic_set(&prog->aux->refcnt, 1);
  602. prog->gpl_compatible = is_gpl ? 1 : 0;
  603. /* find program type: socket_filter vs tracing_filter */
  604. err = find_prog_type(type, prog);
  605. if (err < 0)
  606. goto free_prog;
  607. /* run eBPF verifier */
  608. err = bpf_check(&prog, attr);
  609. if (err < 0)
  610. goto free_used_maps;
  611. /* fixup BPF_CALL->imm field */
  612. fixup_bpf_calls(prog);
  613. /* eBPF program is ready to be JITed */
  614. err = bpf_prog_select_runtime(prog);
  615. if (err < 0)
  616. goto free_used_maps;
  617. err = bpf_prog_new_fd(prog);
  618. if (err < 0)
  619. /* failed to allocate fd */
  620. goto free_used_maps;
  621. return err;
  622. free_used_maps:
  623. free_used_maps(prog->aux);
  624. free_prog:
  625. bpf_prog_uncharge_memlock(prog);
  626. free_prog_nouncharge:
  627. bpf_prog_free(prog);
  628. return err;
  629. }
  630. #define BPF_OBJ_LAST_FIELD bpf_fd
  631. static int bpf_obj_pin(const union bpf_attr *attr)
  632. {
  633. if (CHECK_ATTR(BPF_OBJ))
  634. return -EINVAL;
  635. return bpf_obj_pin_user(attr->bpf_fd, u64_to_ptr(attr->pathname));
  636. }
  637. static int bpf_obj_get(const union bpf_attr *attr)
  638. {
  639. if (CHECK_ATTR(BPF_OBJ) || attr->bpf_fd != 0)
  640. return -EINVAL;
  641. return bpf_obj_get_user(u64_to_ptr(attr->pathname));
  642. }
  643. SYSCALL_DEFINE3(bpf, int, cmd, union bpf_attr __user *, uattr, unsigned int, size)
  644. {
  645. union bpf_attr attr = {};
  646. int err;
  647. if (!capable(CAP_SYS_ADMIN) && sysctl_unprivileged_bpf_disabled)
  648. return -EPERM;
  649. if (!access_ok(VERIFY_READ, uattr, 1))
  650. return -EFAULT;
  651. if (size > PAGE_SIZE) /* silly large */
  652. return -E2BIG;
  653. /* If we're handed a bigger struct than we know of,
  654. * ensure all the unknown bits are 0 - i.e. new
  655. * user-space does not rely on any kernel feature
  656. * extensions we dont know about yet.
  657. */
  658. if (size > sizeof(attr)) {
  659. unsigned char __user *addr;
  660. unsigned char __user *end;
  661. unsigned char val;
  662. addr = (void __user *)uattr + sizeof(attr);
  663. end = (void __user *)uattr + size;
  664. for (; addr < end; addr++) {
  665. err = get_user(val, addr);
  666. if (err)
  667. return err;
  668. if (val)
  669. return -E2BIG;
  670. }
  671. size = sizeof(attr);
  672. }
  673. /* copy attributes from user space, may be less than sizeof(bpf_attr) */
  674. if (copy_from_user(&attr, uattr, size) != 0)
  675. return -EFAULT;
  676. switch (cmd) {
  677. case BPF_MAP_CREATE:
  678. err = map_create(&attr);
  679. break;
  680. case BPF_MAP_LOOKUP_ELEM:
  681. err = map_lookup_elem(&attr);
  682. break;
  683. case BPF_MAP_UPDATE_ELEM:
  684. err = map_update_elem(&attr);
  685. break;
  686. case BPF_MAP_DELETE_ELEM:
  687. err = map_delete_elem(&attr);
  688. break;
  689. case BPF_MAP_GET_NEXT_KEY:
  690. err = map_get_next_key(&attr);
  691. break;
  692. case BPF_PROG_LOAD:
  693. err = bpf_prog_load(&attr);
  694. break;
  695. case BPF_OBJ_PIN:
  696. err = bpf_obj_pin(&attr);
  697. break;
  698. case BPF_OBJ_GET:
  699. err = bpf_obj_get(&attr);
  700. break;
  701. default:
  702. err = -EINVAL;
  703. break;
  704. }
  705. return err;
  706. }