linux-kernel - Re: [PATCH bpf] bpf_trace: bail out from bpf_kprobe_multi_link

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 10 May 2022 20:41:55 +0200
From:   Eugene Syromiatnikov <esyr@...hat.com>
To:     Alexei Starovoitov <alexei.starovoitov@...il.com>
Cc:     Jiri Olsa <jolsa@...nel.org>,
        Masami Hiramatsu <mhiramat@...nel.org>,
        Steven Rostedt <rostedt@...dmis.org>,
        Ingo Molnar <mingo@...hat.com>,
        Alexei Starovoitov <ast@...nel.org>,
        Daniel Borkmann <daniel@...earbox.net>,
        Andrii Nakryiko <andrii@...nel.org>,
        Martin KaFai Lau <kafai@...com>,
        Song Liu <songliubraving@...com>, Yonghong Song <yhs@...com>,
        John Fastabend <john.fastabend@...il.com>,
        KP Singh <kpsingh@...nel.org>,
        Network Development <netdev@...r.kernel.org>,
        bpf <bpf@...r.kernel.org>, LKML <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH bpf] bpf_trace: bail out from
 bpf_kprobe_multi_link_attach when in compat

On Tue, May 10, 2022 at 11:10:35AM -0700, Alexei Starovoitov wrote:
> On Fri, May 6, 2022 at 7:22 AM Eugene Syromiatnikov <esyr@...hat.com> wrote:
> >
> > Since bpf_kprobe_multi_link_attach doesn't support 32-bit kernels
> > for whatever reason,
> 
> Jiri,
> why did you add this restriction?
> 
> > having it enabled for compat processes on 64-bit
> > kernels makes even less sense due to discrepances in the type sizes
> > that it does not handle.
> 
> I don't follow this logic.
> bpf progs are always 64-bit. Even when user space is 32-bit.
> Jiri's check is for the kernel.

The interface as defined (and implemented in libbpf) expects arrays of userspace
pointers to be passed (for example, syms points to an array of userspace
pointers—character strings; same goes for addrs, but with generic userspace
pointers) without regard to possible difference in the pointer size in case
of compat userspace.

> > Fixes: 0dcac272540613d4 ("bpf: Add multi kprobe link")
> > Signed-off-by: Eugene Syromiatnikov <esyr@...hat.com>
> > ---
> >  kernel/trace/bpf_trace.c | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
> > index d8553f4..9560af6 100644
> > --- a/kernel/trace/bpf_trace.c
> > +++ b/kernel/trace/bpf_trace.c
> > @@ -2410,7 +2410,7 @@ int bpf_kprobe_multi_link_attach(const union bpf_attr *attr, struct bpf_prog *pr
> >         int err;
> >
> >         /* no support for 32bit archs yet */
> > -       if (sizeof(u64) != sizeof(void *))
> > +       if (sizeof(u64) != sizeof(void *) || in_compat_syscall())
> >                 return -EOPNOTSUPP;
> >
> >         if (prog->expected_attach_type != BPF_TRACE_KPROBE_MULTI)
> > --
> > 2.1.4
> >
>