linux-kernel - Re: [PATCH bpf-next v3 3/6] bpf: Add a bpf

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAEf4Bza+rVCp=G5i97MuuBrTX+o1ZUBn3nzstssoS1KtE4F6vw@mail.gmail.com>
Date:   Wed, 14 Apr 2021 15:57:21 -0700
From:   Andrii Nakryiko <andrii.nakryiko@...il.com>
To:     Florent Revest <revest@...omium.org>
Cc:     bpf <bpf@...r.kernel.org>, Alexei Starovoitov <ast@...nel.org>,
        Daniel Borkmann <daniel@...earbox.net>,
        Andrii Nakryiko <andrii@...nel.org>,
        Yonghong Song <yhs@...com>, KP Singh <kpsingh@...nel.org>,
        Brendan Jackman <jackmanb@...omium.org>,
        open list <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH bpf-next v3 3/6] bpf: Add a bpf_snprintf helper

On Wed, Apr 14, 2021 at 2:46 AM Florent Revest <revest@...omium.org> wrote:
>
> On Wed, Apr 14, 2021 at 1:16 AM Andrii Nakryiko
> <andrii.nakryiko@...il.com> wrote:
> > On Mon, Apr 12, 2021 at 8:38 AM Florent Revest <revest@...omium.org> wrote:
> > > +static int check_bpf_snprintf_call(struct bpf_verifier_env *env,
> > > +                                  struct bpf_reg_state *regs)
> > > +{
> > > +       struct bpf_reg_state *fmt_reg = &regs[BPF_REG_3];
> > > +       struct bpf_reg_state *data_len_reg = &regs[BPF_REG_5];
> > > +       struct bpf_map *fmt_map = fmt_reg->map_ptr;
> > > +       int err, fmt_map_off, num_args;
> > > +       u64 fmt_addr;
> > > +       char *fmt;
> > > +
> > > +       /* data must be an array of u64 */
> > > +       if (data_len_reg->var_off.value % 8)
> > > +               return -EINVAL;
> > > +       num_args = data_len_reg->var_off.value / 8;
> > > +
> > > +       /* fmt being ARG_PTR_TO_CONST_STR guarantees that var_off is const
> > > +        * and map_direct_value_addr is set.
> > > +        */
> > > +       fmt_map_off = fmt_reg->off + fmt_reg->var_off.value;
> > > +       err = fmt_map->ops->map_direct_value_addr(fmt_map, &fmt_addr,
> > > +                                                 fmt_map_off);
> > > +       if (err)
> > > +               return err;
> > > +       fmt = (char *)fmt_addr + fmt_map_off;
> > > +
> >
> > bot complained about lack of (long) cast before fmt_addr, please address
>
> Will do.
>
> > > +       /* Maximumly we can have MAX_SNPRINTF_VARARGS parameters, just give
> > > +        * all of them to snprintf().
> > > +        */
> > > +       err = snprintf(str, str_size, fmt, BPF_CAST_FMT_ARG(0, args, mod),
> > > +               BPF_CAST_FMT_ARG(1, args, mod), BPF_CAST_FMT_ARG(2, args, mod),
> > > +               BPF_CAST_FMT_ARG(3, args, mod), BPF_CAST_FMT_ARG(4, args, mod),
> > > +               BPF_CAST_FMT_ARG(5, args, mod), BPF_CAST_FMT_ARG(6, args, mod),
> > > +               BPF_CAST_FMT_ARG(7, args, mod), BPF_CAST_FMT_ARG(8, args, mod),
> > > +               BPF_CAST_FMT_ARG(9, args, mod), BPF_CAST_FMT_ARG(10, args, mod),
> > > +               BPF_CAST_FMT_ARG(11, args, mod));
> > > +
> > > +       put_fmt_tmp_buf();
> >
> > reading this for at least 3rd time, this put_fmt_tmp_buf() looks a bit
> > out of place and kind of random. I think bpf_printf_cleanup() name
> > pairs with bpf_printf_prepare() better.
>
> Yes, I thought it would be clever to name that function
> put_fmt_tmp_buf() as a clear parallel to try_get_fmt_tmp_buf() but
> because it only puts the buffer if it is used and because they get
> called in two different contexts, it's after all maybe not such a
> clever name... I'll revert to bpf_printf_cleanup(). Thank you for your
> patience with my naming adventures! :)
>
> > > +
> > > +       return err + 1;
> >
> > snprintf() already returns string length *including* terminating zero,
> > so this is wrong
>
> lib/vsprintf.c says:
>  * The return value is the number of characters which would be
>  * generated for the given input, excluding the trailing null,
>  * as per ISO C99.
>
> Also if I look at the "no arg" test case in the selftest patch.
> "simple case" is asserted to return 12 which seems correct to me
> (includes the terminating zero only once). Am I missing something ?
>

no, you are right, but that means that bpf_trace_printk is broken, it
doesn't do + 1 (which threw me off here), shall we fix that?

> However that makes me wonder whether it would be more appropriate to
> return the value excluding the trailing null. On one hand it makes
> sense to be coherent with other BPF helpers that include the trailing
> zero (as discussed in patch v1), on the other hand the helper is
> clearly named after the standard "snprintf" function and it's likely
> that users will assume it works the same as the std snprintf.


Having zero included simplifies BPF code tremendously for cases like
bpf_probe_read_str(). So no, let's stick with including zero
terminator in return size.