netdev - Re: [PATCH net] bpf: fix bpf_trace

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Tue, 15 Aug 2017 17:32:57 -0700 (PDT)
From:   David Miller <davem@...emloft.net>
To:     daniel@...earbox.net
Cc:     james.hogan@...tec.com, ast@...com, netdev@...r.kernel.org
Subject: Re: [PATCH net] bpf: fix bpf_trace_printk on 32 bit archs

From: Daniel Borkmann <daniel@...earbox.net>
Date: Wed, 16 Aug 2017 01:45:33 +0200

> James reported that on MIPS32 bpf_trace_printk() is currently
> broken while MIPS64 works fine:
> 
>   bpf_trace_printk() uses conditional operators to attempt to
>   pass different types to __trace_printk() depending on the
>   format operators. This doesn't work as intended on 32-bit
>   architectures where u32 and long are passed differently to
>   u64, since the result of C conditional operators follows the
>   "usual arithmetic conversions" rules, such that the values
>   passed to __trace_printk() will always be u64 [causing issues
>   later in the va_list handling for vscnprintf()].
> 
>   For example the samples/bpf/tracex5 test printed lines like
>   below on MIPS32, where the fd and buf have come from the u64
>   fd argument, and the size from the buf argument:
> 
>     [...] 1180.941542: 0x00000001: write(fd=1, buf=  (null), size=6258688)
> 
>   Instead of this:
> 
>     [...] 1625.616026: 0x00000001: write(fd=1, buf=009e4000, size=512)
> 
> One way to get it working is to expand various combinations
> of argument types into 8 different combinations for 32 bit
> and 64 bit kernels. Fix tested by James on MIPS32 and MIPS64
> as well that it resolves the issue.
> 
> Fixes: 9c959c863f82 ("tracing: Allow BPF programs to call bpf_trace_printk()")
> Reported-by: James Hogan <james.hogan@...tec.com>
> Tested-by: James Hogan <james.hogan@...tec.com>
> Signed-off-by: Daniel Borkmann <daniel@...earbox.net>

Applied and queued up for -stable, thanks Daniel.