From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.6 required=3.0 tests=DKIM_INVALID,DKIM_SIGNED, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH,MAILING_LIST_MULTI,SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2AC58C433DF for ; Thu, 21 May 2020 15:40:02 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id D548A206F6 for ; Thu, 21 May 2020 15:40:01 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=fail reason="signature verification failed" (2048-bit key) header.d=infradead.org header.i=@infradead.org header.b="ueAHwy/N" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org D548A206F6 Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=lst.de Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id 776208001A; Thu, 21 May 2020 11:40:01 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 7271980008; Thu, 21 May 2020 11:40:01 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 664AE8001A; Thu, 21 May 2020 11:40:01 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0079.hostedemail.com [216.40.44.79]) by kanga.kvack.org (Postfix) with ESMTP id 503C380008 for ; Thu, 21 May 2020 11:40:01 -0400 (EDT) Received: from smtpin19.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay04.hostedemail.com (Postfix) with ESMTP id 0BFF64995E3 for ; Thu, 21 May 2020 15:40:01 +0000 (UTC) X-FDA: 76841137002.19.war05_57671d22fc42b X-HE-Tag: war05_57671d22fc42b X-Filterd-Recvd-Size: 9274 Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) by imf09.hostedemail.com (Postfix) with ESMTP for ; Thu, 21 May 2020 15:40:00 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=infradead.org; s=bombadil.20170209; h=Content-Transfer-Encoding: MIME-Version:References:In-Reply-To:Message-Id:Date:Subject:Cc:To:From:Sender :Reply-To:Content-Type:Content-ID:Content-Description; bh=Nj1hwlBJsYwdcRmY+JK7cmkAZmLgEv7+0K1FBDpl4r0=; b=ueAHwy/N0yWLlodFiB0SWaGzIX Atu1f0clQH66aN1cZYhKlCQF35As4ubWt+A3zUO/CX5NQTS8lJr5d0QgLzWKOhf7c/ajDj63hdokt tm8ndlhvR/bD0yhPBo2jdqRvHS+yzFefcyGXS97lGc4Yi5D2TcVvFHOrd2PDG3O1Q+76r0xJCLuNK BGTmDrW6VHR3B+mz3VSjMNSmWTuXzn+SG4u1P1sDIXYm91mTJhbToXqb5M5z+U5PEGzyEfEhcQX69 pGl6RXcORSLUFRBXVROBtair7Gb272pNd6E9AVU1oaEOPZcEDdjliifTfpkmGMvT7XsmVO3Xf6GHJ KwTkul5w==; Received: from [2001:4bb8:18c:5da7:c70:4a89:bc61:2] (helo=localhost) by bombadil.infradead.org with esmtpsa (Exim 4.92.3 #3 (Red Hat Linux)) id 1jbn2s-0004Uz-Fg; Thu, 21 May 2020 15:23:43 +0000 From: Christoph Hellwig To: x86@kernel.org, Alexei Starovoitov , Daniel Borkmann , Masami Hiramatsu , Linus Torvalds , Andrew Morton Cc: linux-parisc@vger.kernel.org, linux-um@lists.infradead.org, netdev@vger.kernel.org, bpf@vger.kernel.org, linux-mm@kvack.org, linux-kernel@vger.kernel.org Subject: [PATCH 13/23] bpf: rework the compat kernel probe handling Date: Thu, 21 May 2020 17:22:51 +0200 Message-Id: <20200521152301.2587579-14-hch@lst.de> X-Mailer: git-send-email 2.26.2 In-Reply-To: <20200521152301.2587579-1-hch@lst.de> References: <20200521152301.2587579-1-hch@lst.de> MIME-Version: 1.0 X-SRS-Rewrite: SMTP reverse-path rewritten from by bombadil.infradead.org. See http://www.infradead.org/rpr.html Content-Transfer-Encoding: quoted-printable X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: Instead of using the dangerous probe_kernel_read and strncpy_from_unsafe helpers, rework the compat probes to check if an address is a kernel or userspace one, and then use the low-level kernel or user probe helper shared by the proper kernel and user probe helpers. This slightly changes behavior as the compat probe on a user address doesn't check the lockdown flags, just as the pure user probes do. Signed-off-by: Christoph Hellwig --- kernel/trace/bpf_trace.c | 109 ++++++++++++++++++++++++--------------- 1 file changed, 67 insertions(+), 42 deletions(-) diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c index 737d739230a6b..43566cd2a8180 100644 --- a/kernel/trace/bpf_trace.c +++ b/kernel/trace/bpf_trace.c @@ -136,17 +136,23 @@ static const struct bpf_func_proto bpf_override_ret= urn_proto =3D { }; #endif =20 -BPF_CALL_3(bpf_probe_read_user, void *, dst, u32, size, - const void __user *, unsafe_ptr) +static __always_inline int +bpf_probe_read_user_common(void *dst, u32 size, const void __user *unsaf= e_ptr) { - int ret =3D probe_user_read(dst, unsafe_ptr, size); + int ret; =20 + ret =3D probe_user_read(dst, unsafe_ptr, size); if (unlikely(ret < 0)) memset(dst, 0, size); - return ret; } =20 +BPF_CALL_3(bpf_probe_read_user, void *, dst, u32, size, + const void __user *, unsafe_ptr) +{ + return bpf_probe_read_user_common(dst, size, unsafe_ptr); +} + static const struct bpf_func_proto bpf_probe_read_user_proto =3D { .func =3D bpf_probe_read_user, .gpl_only =3D true, @@ -156,17 +162,24 @@ static const struct bpf_func_proto bpf_probe_read_u= ser_proto =3D { .arg3_type =3D ARG_ANYTHING, }; =20 -BPF_CALL_3(bpf_probe_read_user_str, void *, dst, u32, size, - const void __user *, unsafe_ptr) +static __always_inline int +bpf_probe_read_user_str_common(void *dst, u32 size, + const void __user *unsafe_ptr) { - int ret =3D strncpy_from_user_nofault(dst, unsafe_ptr, size); + int ret; =20 + ret =3D strncpy_from_user_nofault(dst, unsafe_ptr, size); if (unlikely(ret < 0)) memset(dst, 0, size); - return ret; } =20 +BPF_CALL_3(bpf_probe_read_user_str, void *, dst, u32, size, + const void __user *, unsafe_ptr) +{ + return bpf_probe_read_user_str_common(dst, size, unsafe_ptr); +} + static const struct bpf_func_proto bpf_probe_read_user_str_proto =3D { .func =3D bpf_probe_read_user_str, .gpl_only =3D true, @@ -177,25 +190,25 @@ static const struct bpf_func_proto bpf_probe_read_u= ser_str_proto =3D { }; =20 static __always_inline int -bpf_probe_read_kernel_common(void *dst, u32 size, const void *unsafe_ptr= , - const bool compat) +bpf_probe_read_kernel_common(void *dst, u32 size, const void *unsafe_ptr= ) { int ret =3D security_locked_down(LOCKDOWN_BPF_READ); =20 if (unlikely(ret < 0)) - goto out; - ret =3D compat ? probe_kernel_read(dst, unsafe_ptr, size) : - probe_kernel_read_strict(dst, unsafe_ptr, size); + goto fail; + ret =3D probe_kernel_read_strict(dst, unsafe_ptr, size); if (unlikely(ret < 0)) -out: - memset(dst, 0, size); + goto fail; + return ret; +fail: + memset(dst, 0, size); return ret; } =20 BPF_CALL_3(bpf_probe_read_kernel, void *, dst, u32, size, const void *, unsafe_ptr) { - return bpf_probe_read_kernel_common(dst, size, unsafe_ptr, false); + return bpf_probe_read_kernel_common(dst, size, unsafe_ptr); } =20 static const struct bpf_func_proto bpf_probe_read_kernel_proto =3D { @@ -207,50 +220,37 @@ static const struct bpf_func_proto bpf_probe_read_k= ernel_proto =3D { .arg3_type =3D ARG_ANYTHING, }; =20 -BPF_CALL_3(bpf_probe_read_compat, void *, dst, u32, size, - const void *, unsafe_ptr) -{ - return bpf_probe_read_kernel_common(dst, size, unsafe_ptr, true); -} - -static const struct bpf_func_proto bpf_probe_read_compat_proto =3D { - .func =3D bpf_probe_read_compat, - .gpl_only =3D true, - .ret_type =3D RET_INTEGER, - .arg1_type =3D ARG_PTR_TO_UNINIT_MEM, - .arg2_type =3D ARG_CONST_SIZE_OR_ZERO, - .arg3_type =3D ARG_ANYTHING, -}; - static __always_inline int -bpf_probe_read_kernel_str_common(void *dst, u32 size, const void *unsafe= _ptr, - const bool compat) +bpf_probe_read_kernel_str_common(void *dst, u32 size, const void *unsafe= _ptr) { int ret =3D security_locked_down(LOCKDOWN_BPF_READ); =20 if (unlikely(ret < 0)) - goto out; + goto fail; + /* - * The strncpy_from_unsafe_*() call will likely not fill the entire - * buffer, but that's okay in this circumstance as we're probing + * The strncpy_from_kernel_nofault() call will likely not fill the + * entire buffer, but that's okay in this circumstance as we're probing * arbitrary memory anyway similar to bpf_probe_read_*() and might * as well probe the stack. Thus, memory is explicitly cleared * only in error case, so that improper users ignoring return * code altogether don't copy garbage; otherwise length of string * is returned that can be used for bpf_perf_event_output() et al. */ - ret =3D compat ? strncpy_from_unsafe(dst, unsafe_ptr, size) : - strncpy_from_kernel_nofault(dst, unsafe_ptr, size); + ret =3D strncpy_from_kernel_nofault(dst, unsafe_ptr, size); if (unlikely(ret < 0)) -out: - memset(dst, 0, size); + goto fail; + + return 0; +fail: + memset(dst, 0, size); return ret; } =20 BPF_CALL_3(bpf_probe_read_kernel_str, void *, dst, u32, size, const void *, unsafe_ptr) { - return bpf_probe_read_kernel_str_common(dst, size, unsafe_ptr, false); + return bpf_probe_read_kernel_str_common(dst, size, unsafe_ptr); } =20 static const struct bpf_func_proto bpf_probe_read_kernel_str_proto =3D { @@ -262,10 +262,34 @@ static const struct bpf_func_proto bpf_probe_read_k= ernel_str_proto =3D { .arg3_type =3D ARG_ANYTHING, }; =20 +#ifdef CONFIG_ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE +BPF_CALL_3(bpf_probe_read_compat, void *, dst, u32, size, + const void *, unsafe_ptr) +{ + if ((unsigned long)unsafe_ptr < TASK_SIZE) { + return bpf_probe_read_user_common(dst, size, + (__force void __user *)unsafe_ptr); + } + return bpf_probe_read_kernel_common(dst, size, unsafe_ptr); +} + +static const struct bpf_func_proto bpf_probe_read_compat_proto =3D { + .func =3D bpf_probe_read_compat, + .gpl_only =3D true, + .ret_type =3D RET_INTEGER, + .arg1_type =3D ARG_PTR_TO_UNINIT_MEM, + .arg2_type =3D ARG_CONST_SIZE_OR_ZERO, + .arg3_type =3D ARG_ANYTHING, +}; + BPF_CALL_3(bpf_probe_read_compat_str, void *, dst, u32, size, const void *, unsafe_ptr) { - return bpf_probe_read_kernel_str_common(dst, size, unsafe_ptr, true); + if ((unsigned long)unsafe_ptr < TASK_SIZE) { + return bpf_probe_read_user_str_common(dst, size, + (__force void __user *)unsafe_ptr); + } + return bpf_probe_read_kernel_str_common(dst, size, unsafe_ptr); } =20 static const struct bpf_func_proto bpf_probe_read_compat_str_proto =3D { @@ -276,6 +300,7 @@ static const struct bpf_func_proto bpf_probe_read_com= pat_str_proto =3D { .arg2_type =3D ARG_CONST_SIZE_OR_ZERO, .arg3_type =3D ARG_ANYTHING, }; +#endif /* CONFIG_ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE */ =20 BPF_CALL_3(bpf_probe_write_user, void __user *, unsafe_ptr, const void *= , src, u32, size) --=20 2.26.2