syscall.c 19 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875
  1. /* Copyright (c) 2011-2014 PLUMgrid, http://plumgrid.com
  2. *
  3. * This program is free software; you can redistribute it and/or
  4. * modify it under the terms of version 2 of the GNU General Public
  5. * License as published by the Free Software Foundation.
  6. *
  7. * This program is distributed in the hope that it will be useful, but
  8. * WITHOUT ANY WARRANTY; without even the implied warranty of
  9. * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  10. * General Public License for more details.
  11. */
  12. #include <linux/bpf.h>
  13. #include <linux/syscalls.h>
  14. #include <linux/slab.h>
  15. #include <linux/anon_inodes.h>
  16. #include <linux/file.h>
  17. #include <linux/license.h>
  18. #include <linux/filter.h>
  19. #include <linux/version.h>
  20. DEFINE_PER_CPU(int, bpf_prog_active);
  21. int sysctl_unprivileged_bpf_disabled __read_mostly;
  22. static LIST_HEAD(bpf_map_types);
  23. static struct bpf_map *find_and_alloc_map(union bpf_attr *attr)
  24. {
  25. struct bpf_map_type_list *tl;
  26. struct bpf_map *map;
  27. list_for_each_entry(tl, &bpf_map_types, list_node) {
  28. if (tl->type == attr->map_type) {
  29. map = tl->ops->map_alloc(attr);
  30. if (IS_ERR(map))
  31. return map;
  32. map->ops = tl->ops;
  33. map->map_type = attr->map_type;
  34. return map;
  35. }
  36. }
  37. return ERR_PTR(-EINVAL);
  38. }
  39. /* boot time registration of different map implementations */
  40. void bpf_register_map_type(struct bpf_map_type_list *tl)
  41. {
  42. list_add(&tl->list_node, &bpf_map_types);
  43. }
  44. int bpf_map_precharge_memlock(u32 pages)
  45. {
  46. struct user_struct *user = get_current_user();
  47. unsigned long memlock_limit, cur;
  48. memlock_limit = rlimit(RLIMIT_MEMLOCK) >> PAGE_SHIFT;
  49. cur = atomic_long_read(&user->locked_vm);
  50. free_uid(user);
  51. if (cur + pages > memlock_limit)
  52. return -EPERM;
  53. return 0;
  54. }
  55. static int bpf_map_charge_memlock(struct bpf_map *map)
  56. {
  57. struct user_struct *user = get_current_user();
  58. unsigned long memlock_limit;
  59. memlock_limit = rlimit(RLIMIT_MEMLOCK) >> PAGE_SHIFT;
  60. atomic_long_add(map->pages, &user->locked_vm);
  61. if (atomic_long_read(&user->locked_vm) > memlock_limit) {
  62. atomic_long_sub(map->pages, &user->locked_vm);
  63. free_uid(user);
  64. return -EPERM;
  65. }
  66. map->user = user;
  67. return 0;
  68. }
  69. static void bpf_map_uncharge_memlock(struct bpf_map *map)
  70. {
  71. struct user_struct *user = map->user;
  72. atomic_long_sub(map->pages, &user->locked_vm);
  73. free_uid(user);
  74. }
  75. /* called from workqueue */
  76. static void bpf_map_free_deferred(struct work_struct *work)
  77. {
  78. struct bpf_map *map = container_of(work, struct bpf_map, work);
  79. bpf_map_uncharge_memlock(map);
  80. /* implementation dependent freeing */
  81. map->ops->map_free(map);
  82. }
  83. static void bpf_map_put_uref(struct bpf_map *map)
  84. {
  85. if (atomic_dec_and_test(&map->usercnt)) {
  86. if (map->map_type == BPF_MAP_TYPE_PROG_ARRAY)
  87. bpf_fd_array_map_clear(map);
  88. }
  89. }
  90. /* decrement map refcnt and schedule it for freeing via workqueue
  91. * (unrelying map implementation ops->map_free() might sleep)
  92. */
  93. void bpf_map_put(struct bpf_map *map)
  94. {
  95. if (atomic_dec_and_test(&map->refcnt)) {
  96. INIT_WORK(&map->work, bpf_map_free_deferred);
  97. schedule_work(&map->work);
  98. }
  99. }
  100. void bpf_map_put_with_uref(struct bpf_map *map)
  101. {
  102. bpf_map_put_uref(map);
  103. bpf_map_put(map);
  104. }
  105. static int bpf_map_release(struct inode *inode, struct file *filp)
  106. {
  107. bpf_map_put_with_uref(filp->private_data);
  108. return 0;
  109. }
  110. #ifdef CONFIG_PROC_FS
  111. static void bpf_map_show_fdinfo(struct seq_file *m, struct file *filp)
  112. {
  113. const struct bpf_map *map = filp->private_data;
  114. seq_printf(m,
  115. "map_type:\t%u\n"
  116. "key_size:\t%u\n"
  117. "value_size:\t%u\n"
  118. "max_entries:\t%u\n"
  119. "map_flags:\t%#x\n",
  120. map->map_type,
  121. map->key_size,
  122. map->value_size,
  123. map->max_entries,
  124. map->map_flags);
  125. }
  126. #endif
  127. static const struct file_operations bpf_map_fops = {
  128. #ifdef CONFIG_PROC_FS
  129. .show_fdinfo = bpf_map_show_fdinfo,
  130. #endif
  131. .release = bpf_map_release,
  132. };
  133. int bpf_map_new_fd(struct bpf_map *map)
  134. {
  135. return anon_inode_getfd("bpf-map", &bpf_map_fops, map,
  136. O_RDWR | O_CLOEXEC);
  137. }
  138. /* helper macro to check that unused fields 'union bpf_attr' are zero */
  139. #define CHECK_ATTR(CMD) \
  140. memchr_inv((void *) &attr->CMD##_LAST_FIELD + \
  141. sizeof(attr->CMD##_LAST_FIELD), 0, \
  142. sizeof(*attr) - \
  143. offsetof(union bpf_attr, CMD##_LAST_FIELD) - \
  144. sizeof(attr->CMD##_LAST_FIELD)) != NULL
  145. #define BPF_MAP_CREATE_LAST_FIELD map_flags
  146. /* called via syscall */
  147. static int map_create(union bpf_attr *attr)
  148. {
  149. struct bpf_map *map;
  150. int err;
  151. err = CHECK_ATTR(BPF_MAP_CREATE);
  152. if (err)
  153. return -EINVAL;
  154. /* find map type and init map: hashtable vs rbtree vs bloom vs ... */
  155. map = find_and_alloc_map(attr);
  156. if (IS_ERR(map))
  157. return PTR_ERR(map);
  158. atomic_set(&map->refcnt, 1);
  159. atomic_set(&map->usercnt, 1);
  160. err = bpf_map_charge_memlock(map);
  161. if (err)
  162. goto free_map;
  163. err = bpf_map_new_fd(map);
  164. if (err < 0)
  165. /* failed to allocate fd */
  166. goto free_map;
  167. return err;
  168. free_map:
  169. map->ops->map_free(map);
  170. return err;
  171. }
  172. /* if error is returned, fd is released.
  173. * On success caller should complete fd access with matching fdput()
  174. */
  175. struct bpf_map *__bpf_map_get(struct fd f)
  176. {
  177. if (!f.file)
  178. return ERR_PTR(-EBADF);
  179. if (f.file->f_op != &bpf_map_fops) {
  180. fdput(f);
  181. return ERR_PTR(-EINVAL);
  182. }
  183. return f.file->private_data;
  184. }
  185. /* prog's and map's refcnt limit */
  186. #define BPF_MAX_REFCNT 32768
  187. struct bpf_map *bpf_map_inc(struct bpf_map *map, bool uref)
  188. {
  189. if (atomic_inc_return(&map->refcnt) > BPF_MAX_REFCNT) {
  190. atomic_dec(&map->refcnt);
  191. return ERR_PTR(-EBUSY);
  192. }
  193. if (uref)
  194. atomic_inc(&map->usercnt);
  195. return map;
  196. }
  197. struct bpf_map *bpf_map_get_with_uref(u32 ufd)
  198. {
  199. struct fd f = fdget(ufd);
  200. struct bpf_map *map;
  201. map = __bpf_map_get(f);
  202. if (IS_ERR(map))
  203. return map;
  204. map = bpf_map_inc(map, true);
  205. fdput(f);
  206. return map;
  207. }
  208. /* helper to convert user pointers passed inside __aligned_u64 fields */
  209. static void __user *u64_to_ptr(__u64 val)
  210. {
  211. return (void __user *) (unsigned long) val;
  212. }
  213. int __weak bpf_stackmap_copy(struct bpf_map *map, void *key, void *value)
  214. {
  215. return -ENOTSUPP;
  216. }
  217. /* last field in 'union bpf_attr' used by this command */
  218. #define BPF_MAP_LOOKUP_ELEM_LAST_FIELD value
  219. static int map_lookup_elem(union bpf_attr *attr)
  220. {
  221. void __user *ukey = u64_to_ptr(attr->key);
  222. void __user *uvalue = u64_to_ptr(attr->value);
  223. int ufd = attr->map_fd;
  224. struct bpf_map *map;
  225. void *key, *value, *ptr;
  226. u32 value_size;
  227. struct fd f;
  228. int err;
  229. if (CHECK_ATTR(BPF_MAP_LOOKUP_ELEM))
  230. return -EINVAL;
  231. f = fdget(ufd);
  232. map = __bpf_map_get(f);
  233. if (IS_ERR(map))
  234. return PTR_ERR(map);
  235. err = -ENOMEM;
  236. key = kmalloc(map->key_size, GFP_USER);
  237. if (!key)
  238. goto err_put;
  239. err = -EFAULT;
  240. if (copy_from_user(key, ukey, map->key_size) != 0)
  241. goto free_key;
  242. if (map->map_type == BPF_MAP_TYPE_PERCPU_HASH ||
  243. map->map_type == BPF_MAP_TYPE_PERCPU_ARRAY)
  244. value_size = round_up(map->value_size, 8) * num_possible_cpus();
  245. else
  246. value_size = map->value_size;
  247. err = -ENOMEM;
  248. value = kmalloc(value_size, GFP_USER | __GFP_NOWARN);
  249. if (!value)
  250. goto free_key;
  251. if (map->map_type == BPF_MAP_TYPE_PERCPU_HASH) {
  252. err = bpf_percpu_hash_copy(map, key, value);
  253. } else if (map->map_type == BPF_MAP_TYPE_PERCPU_ARRAY) {
  254. err = bpf_percpu_array_copy(map, key, value);
  255. } else if (map->map_type == BPF_MAP_TYPE_STACK_TRACE) {
  256. err = bpf_stackmap_copy(map, key, value);
  257. } else {
  258. rcu_read_lock();
  259. ptr = map->ops->map_lookup_elem(map, key);
  260. if (ptr)
  261. memcpy(value, ptr, value_size);
  262. rcu_read_unlock();
  263. err = ptr ? 0 : -ENOENT;
  264. }
  265. if (err)
  266. goto free_value;
  267. err = -EFAULT;
  268. if (copy_to_user(uvalue, value, value_size) != 0)
  269. goto free_value;
  270. err = 0;
  271. free_value:
  272. kfree(value);
  273. free_key:
  274. kfree(key);
  275. err_put:
  276. fdput(f);
  277. return err;
  278. }
  279. #define BPF_MAP_UPDATE_ELEM_LAST_FIELD flags
  280. static int map_update_elem(union bpf_attr *attr)
  281. {
  282. void __user *ukey = u64_to_ptr(attr->key);
  283. void __user *uvalue = u64_to_ptr(attr->value);
  284. int ufd = attr->map_fd;
  285. struct bpf_map *map;
  286. void *key, *value;
  287. u32 value_size;
  288. struct fd f;
  289. int err;
  290. if (CHECK_ATTR(BPF_MAP_UPDATE_ELEM))
  291. return -EINVAL;
  292. f = fdget(ufd);
  293. map = __bpf_map_get(f);
  294. if (IS_ERR(map))
  295. return PTR_ERR(map);
  296. err = -ENOMEM;
  297. key = kmalloc(map->key_size, GFP_USER);
  298. if (!key)
  299. goto err_put;
  300. err = -EFAULT;
  301. if (copy_from_user(key, ukey, map->key_size) != 0)
  302. goto free_key;
  303. if (map->map_type == BPF_MAP_TYPE_PERCPU_HASH ||
  304. map->map_type == BPF_MAP_TYPE_PERCPU_ARRAY)
  305. value_size = round_up(map->value_size, 8) * num_possible_cpus();
  306. else
  307. value_size = map->value_size;
  308. err = -ENOMEM;
  309. value = kmalloc(value_size, GFP_USER | __GFP_NOWARN);
  310. if (!value)
  311. goto free_key;
  312. err = -EFAULT;
  313. if (copy_from_user(value, uvalue, value_size) != 0)
  314. goto free_value;
  315. /* must increment bpf_prog_active to avoid kprobe+bpf triggering from
  316. * inside bpf map update or delete otherwise deadlocks are possible
  317. */
  318. preempt_disable();
  319. __this_cpu_inc(bpf_prog_active);
  320. if (map->map_type == BPF_MAP_TYPE_PERCPU_HASH) {
  321. err = bpf_percpu_hash_update(map, key, value, attr->flags);
  322. } else if (map->map_type == BPF_MAP_TYPE_PERCPU_ARRAY) {
  323. err = bpf_percpu_array_update(map, key, value, attr->flags);
  324. } else {
  325. rcu_read_lock();
  326. err = map->ops->map_update_elem(map, key, value, attr->flags);
  327. rcu_read_unlock();
  328. }
  329. __this_cpu_dec(bpf_prog_active);
  330. preempt_enable();
  331. free_value:
  332. kfree(value);
  333. free_key:
  334. kfree(key);
  335. err_put:
  336. fdput(f);
  337. return err;
  338. }
  339. #define BPF_MAP_DELETE_ELEM_LAST_FIELD key
  340. static int map_delete_elem(union bpf_attr *attr)
  341. {
  342. void __user *ukey = u64_to_ptr(attr->key);
  343. int ufd = attr->map_fd;
  344. struct bpf_map *map;
  345. struct fd f;
  346. void *key;
  347. int err;
  348. if (CHECK_ATTR(BPF_MAP_DELETE_ELEM))
  349. return -EINVAL;
  350. f = fdget(ufd);
  351. map = __bpf_map_get(f);
  352. if (IS_ERR(map))
  353. return PTR_ERR(map);
  354. err = -ENOMEM;
  355. key = kmalloc(map->key_size, GFP_USER);
  356. if (!key)
  357. goto err_put;
  358. err = -EFAULT;
  359. if (copy_from_user(key, ukey, map->key_size) != 0)
  360. goto free_key;
  361. preempt_disable();
  362. __this_cpu_inc(bpf_prog_active);
  363. rcu_read_lock();
  364. err = map->ops->map_delete_elem(map, key);
  365. rcu_read_unlock();
  366. __this_cpu_dec(bpf_prog_active);
  367. preempt_enable();
  368. free_key:
  369. kfree(key);
  370. err_put:
  371. fdput(f);
  372. return err;
  373. }
  374. /* last field in 'union bpf_attr' used by this command */
  375. #define BPF_MAP_GET_NEXT_KEY_LAST_FIELD next_key
  376. static int map_get_next_key(union bpf_attr *attr)
  377. {
  378. void __user *ukey = u64_to_ptr(attr->key);
  379. void __user *unext_key = u64_to_ptr(attr->next_key);
  380. int ufd = attr->map_fd;
  381. struct bpf_map *map;
  382. void *key, *next_key;
  383. struct fd f;
  384. int err;
  385. if (CHECK_ATTR(BPF_MAP_GET_NEXT_KEY))
  386. return -EINVAL;
  387. f = fdget(ufd);
  388. map = __bpf_map_get(f);
  389. if (IS_ERR(map))
  390. return PTR_ERR(map);
  391. err = -ENOMEM;
  392. key = kmalloc(map->key_size, GFP_USER);
  393. if (!key)
  394. goto err_put;
  395. err = -EFAULT;
  396. if (copy_from_user(key, ukey, map->key_size) != 0)
  397. goto free_key;
  398. err = -ENOMEM;
  399. next_key = kmalloc(map->key_size, GFP_USER);
  400. if (!next_key)
  401. goto free_key;
  402. rcu_read_lock();
  403. err = map->ops->map_get_next_key(map, key, next_key);
  404. rcu_read_unlock();
  405. if (err)
  406. goto free_next_key;
  407. err = -EFAULT;
  408. if (copy_to_user(unext_key, next_key, map->key_size) != 0)
  409. goto free_next_key;
  410. err = 0;
  411. free_next_key:
  412. kfree(next_key);
  413. free_key:
  414. kfree(key);
  415. err_put:
  416. fdput(f);
  417. return err;
  418. }
  419. static LIST_HEAD(bpf_prog_types);
  420. static int find_prog_type(enum bpf_prog_type type, struct bpf_prog *prog)
  421. {
  422. struct bpf_prog_type_list *tl;
  423. list_for_each_entry(tl, &bpf_prog_types, list_node) {
  424. if (tl->type == type) {
  425. prog->aux->ops = tl->ops;
  426. prog->type = type;
  427. return 0;
  428. }
  429. }
  430. return -EINVAL;
  431. }
  432. void bpf_register_prog_type(struct bpf_prog_type_list *tl)
  433. {
  434. list_add(&tl->list_node, &bpf_prog_types);
  435. }
  436. /* fixup insn->imm field of bpf_call instructions:
  437. * if (insn->imm == BPF_FUNC_map_lookup_elem)
  438. * insn->imm = bpf_map_lookup_elem - __bpf_call_base;
  439. * else if (insn->imm == BPF_FUNC_map_update_elem)
  440. * insn->imm = bpf_map_update_elem - __bpf_call_base;
  441. * else ...
  442. *
  443. * this function is called after eBPF program passed verification
  444. */
  445. static void fixup_bpf_calls(struct bpf_prog *prog)
  446. {
  447. const struct bpf_func_proto *fn;
  448. int i;
  449. for (i = 0; i < prog->len; i++) {
  450. struct bpf_insn *insn = &prog->insnsi[i];
  451. if (insn->code == (BPF_JMP | BPF_CALL)) {
  452. /* we reach here when program has bpf_call instructions
  453. * and it passed bpf_check(), means that
  454. * ops->get_func_proto must have been supplied, check it
  455. */
  456. BUG_ON(!prog->aux->ops->get_func_proto);
  457. if (insn->imm == BPF_FUNC_get_route_realm)
  458. prog->dst_needed = 1;
  459. if (insn->imm == BPF_FUNC_get_prandom_u32)
  460. bpf_user_rnd_init_once();
  461. if (insn->imm == BPF_FUNC_tail_call) {
  462. /* mark bpf_tail_call as different opcode
  463. * to avoid conditional branch in
  464. * interpeter for every normal call
  465. * and to prevent accidental JITing by
  466. * JIT compiler that doesn't support
  467. * bpf_tail_call yet
  468. */
  469. insn->imm = 0;
  470. insn->code |= BPF_X;
  471. continue;
  472. }
  473. fn = prog->aux->ops->get_func_proto(insn->imm);
  474. /* all functions that have prototype and verifier allowed
  475. * programs to call them, must be real in-kernel functions
  476. */
  477. BUG_ON(!fn->func);
  478. insn->imm = fn->func - __bpf_call_base;
  479. }
  480. }
  481. }
  482. /* drop refcnt on maps used by eBPF program and free auxilary data */
  483. static void free_used_maps(struct bpf_prog_aux *aux)
  484. {
  485. int i;
  486. for (i = 0; i < aux->used_map_cnt; i++)
  487. bpf_map_put(aux->used_maps[i]);
  488. kfree(aux->used_maps);
  489. }
  490. static int bpf_prog_charge_memlock(struct bpf_prog *prog)
  491. {
  492. struct user_struct *user = get_current_user();
  493. unsigned long memlock_limit;
  494. memlock_limit = rlimit(RLIMIT_MEMLOCK) >> PAGE_SHIFT;
  495. atomic_long_add(prog->pages, &user->locked_vm);
  496. if (atomic_long_read(&user->locked_vm) > memlock_limit) {
  497. atomic_long_sub(prog->pages, &user->locked_vm);
  498. free_uid(user);
  499. return -EPERM;
  500. }
  501. prog->aux->user = user;
  502. return 0;
  503. }
  504. static void bpf_prog_uncharge_memlock(struct bpf_prog *prog)
  505. {
  506. struct user_struct *user = prog->aux->user;
  507. atomic_long_sub(prog->pages, &user->locked_vm);
  508. free_uid(user);
  509. }
  510. static void __prog_put_common(struct rcu_head *rcu)
  511. {
  512. struct bpf_prog_aux *aux = container_of(rcu, struct bpf_prog_aux, rcu);
  513. free_used_maps(aux);
  514. bpf_prog_uncharge_memlock(aux->prog);
  515. bpf_prog_free(aux->prog);
  516. }
  517. /* version of bpf_prog_put() that is called after a grace period */
  518. void bpf_prog_put_rcu(struct bpf_prog *prog)
  519. {
  520. if (atomic_dec_and_test(&prog->aux->refcnt))
  521. call_rcu(&prog->aux->rcu, __prog_put_common);
  522. }
  523. void bpf_prog_put(struct bpf_prog *prog)
  524. {
  525. if (atomic_dec_and_test(&prog->aux->refcnt))
  526. __prog_put_common(&prog->aux->rcu);
  527. }
  528. EXPORT_SYMBOL_GPL(bpf_prog_put);
  529. static int bpf_prog_release(struct inode *inode, struct file *filp)
  530. {
  531. struct bpf_prog *prog = filp->private_data;
  532. bpf_prog_put_rcu(prog);
  533. return 0;
  534. }
  535. static const struct file_operations bpf_prog_fops = {
  536. .release = bpf_prog_release,
  537. };
  538. int bpf_prog_new_fd(struct bpf_prog *prog)
  539. {
  540. return anon_inode_getfd("bpf-prog", &bpf_prog_fops, prog,
  541. O_RDWR | O_CLOEXEC);
  542. }
  543. static struct bpf_prog *__bpf_prog_get(struct fd f)
  544. {
  545. if (!f.file)
  546. return ERR_PTR(-EBADF);
  547. if (f.file->f_op != &bpf_prog_fops) {
  548. fdput(f);
  549. return ERR_PTR(-EINVAL);
  550. }
  551. return f.file->private_data;
  552. }
  553. struct bpf_prog *bpf_prog_inc(struct bpf_prog *prog)
  554. {
  555. if (atomic_inc_return(&prog->aux->refcnt) > BPF_MAX_REFCNT) {
  556. atomic_dec(&prog->aux->refcnt);
  557. return ERR_PTR(-EBUSY);
  558. }
  559. return prog;
  560. }
  561. /* called by sockets/tracing/seccomp before attaching program to an event
  562. * pairs with bpf_prog_put()
  563. */
  564. struct bpf_prog *bpf_prog_get(u32 ufd)
  565. {
  566. struct fd f = fdget(ufd);
  567. struct bpf_prog *prog;
  568. prog = __bpf_prog_get(f);
  569. if (IS_ERR(prog))
  570. return prog;
  571. prog = bpf_prog_inc(prog);
  572. fdput(f);
  573. return prog;
  574. }
  575. EXPORT_SYMBOL_GPL(bpf_prog_get);
  576. /* last field in 'union bpf_attr' used by this command */
  577. #define BPF_PROG_LOAD_LAST_FIELD kern_version
  578. static int bpf_prog_load(union bpf_attr *attr)
  579. {
  580. enum bpf_prog_type type = attr->prog_type;
  581. struct bpf_prog *prog;
  582. int err;
  583. char license[128];
  584. bool is_gpl;
  585. if (CHECK_ATTR(BPF_PROG_LOAD))
  586. return -EINVAL;
  587. /* copy eBPF program license from user space */
  588. if (strncpy_from_user(license, u64_to_ptr(attr->license),
  589. sizeof(license) - 1) < 0)
  590. return -EFAULT;
  591. license[sizeof(license) - 1] = 0;
  592. /* eBPF programs must be GPL compatible to use GPL-ed functions */
  593. is_gpl = license_is_gpl_compatible(license);
  594. if (attr->insn_cnt >= BPF_MAXINSNS)
  595. return -EINVAL;
  596. if (type == BPF_PROG_TYPE_KPROBE &&
  597. attr->kern_version != LINUX_VERSION_CODE)
  598. return -EINVAL;
  599. if (type != BPF_PROG_TYPE_SOCKET_FILTER && !capable(CAP_SYS_ADMIN))
  600. return -EPERM;
  601. /* plain bpf_prog allocation */
  602. prog = bpf_prog_alloc(bpf_prog_size(attr->insn_cnt), GFP_USER);
  603. if (!prog)
  604. return -ENOMEM;
  605. err = bpf_prog_charge_memlock(prog);
  606. if (err)
  607. goto free_prog_nouncharge;
  608. prog->len = attr->insn_cnt;
  609. err = -EFAULT;
  610. if (copy_from_user(prog->insns, u64_to_ptr(attr->insns),
  611. prog->len * sizeof(struct bpf_insn)) != 0)
  612. goto free_prog;
  613. prog->orig_prog = NULL;
  614. prog->jited = 0;
  615. atomic_set(&prog->aux->refcnt, 1);
  616. prog->gpl_compatible = is_gpl ? 1 : 0;
  617. /* find program type: socket_filter vs tracing_filter */
  618. err = find_prog_type(type, prog);
  619. if (err < 0)
  620. goto free_prog;
  621. /* run eBPF verifier */
  622. err = bpf_check(&prog, attr);
  623. if (err < 0)
  624. goto free_used_maps;
  625. /* fixup BPF_CALL->imm field */
  626. fixup_bpf_calls(prog);
  627. /* eBPF program is ready to be JITed */
  628. prog = bpf_prog_select_runtime(prog, &err);
  629. if (err < 0)
  630. goto free_used_maps;
  631. err = bpf_prog_new_fd(prog);
  632. if (err < 0)
  633. /* failed to allocate fd */
  634. goto free_used_maps;
  635. return err;
  636. free_used_maps:
  637. free_used_maps(prog->aux);
  638. free_prog:
  639. bpf_prog_uncharge_memlock(prog);
  640. free_prog_nouncharge:
  641. bpf_prog_free(prog);
  642. return err;
  643. }
  644. #define BPF_OBJ_LAST_FIELD bpf_fd
  645. static int bpf_obj_pin(const union bpf_attr *attr)
  646. {
  647. if (CHECK_ATTR(BPF_OBJ))
  648. return -EINVAL;
  649. return bpf_obj_pin_user(attr->bpf_fd, u64_to_ptr(attr->pathname));
  650. }
  651. static int bpf_obj_get(const union bpf_attr *attr)
  652. {
  653. if (CHECK_ATTR(BPF_OBJ) || attr->bpf_fd != 0)
  654. return -EINVAL;
  655. return bpf_obj_get_user(u64_to_ptr(attr->pathname));
  656. }
  657. SYSCALL_DEFINE3(bpf, int, cmd, union bpf_attr __user *, uattr, unsigned int, size)
  658. {
  659. union bpf_attr attr = {};
  660. int err;
  661. if (!capable(CAP_SYS_ADMIN) && sysctl_unprivileged_bpf_disabled)
  662. return -EPERM;
  663. if (!access_ok(VERIFY_READ, uattr, 1))
  664. return -EFAULT;
  665. if (size > PAGE_SIZE) /* silly large */
  666. return -E2BIG;
  667. /* If we're handed a bigger struct than we know of,
  668. * ensure all the unknown bits are 0 - i.e. new
  669. * user-space does not rely on any kernel feature
  670. * extensions we dont know about yet.
  671. */
  672. if (size > sizeof(attr)) {
  673. unsigned char __user *addr;
  674. unsigned char __user *end;
  675. unsigned char val;
  676. addr = (void __user *)uattr + sizeof(attr);
  677. end = (void __user *)uattr + size;
  678. for (; addr < end; addr++) {
  679. err = get_user(val, addr);
  680. if (err)
  681. return err;
  682. if (val)
  683. return -E2BIG;
  684. }
  685. size = sizeof(attr);
  686. }
  687. /* copy attributes from user space, may be less than sizeof(bpf_attr) */
  688. if (copy_from_user(&attr, uattr, size) != 0)
  689. return -EFAULT;
  690. switch (cmd) {
  691. case BPF_MAP_CREATE:
  692. err = map_create(&attr);
  693. break;
  694. case BPF_MAP_LOOKUP_ELEM:
  695. err = map_lookup_elem(&attr);
  696. break;
  697. case BPF_MAP_UPDATE_ELEM:
  698. err = map_update_elem(&attr);
  699. break;
  700. case BPF_MAP_DELETE_ELEM:
  701. err = map_delete_elem(&attr);
  702. break;
  703. case BPF_MAP_GET_NEXT_KEY:
  704. err = map_get_next_key(&attr);
  705. break;
  706. case BPF_PROG_LOAD:
  707. err = bpf_prog_load(&attr);
  708. break;
  709. case BPF_OBJ_PIN:
  710. err = bpf_obj_pin(&attr);
  711. break;
  712. case BPF_OBJ_GET:
  713. err = bpf_obj_get(&attr);
  714. break;
  715. default:
  716. err = -EINVAL;
  717. break;
  718. }
  719. return err;
  720. }