| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <aa1d0ac8-dda0-67db-8aaa-3b1cec531622@fb.com>
Date: Mon, 22 Apr 2019 23:16:42 +0000
From: Yonghong Song <yhs@...com>
To: Matt Mullins <mmullins@...com>,
"netdev@...r.kernel.org" <netdev@...r.kernel.org>,
Andrew Hall <hall@...com>,
"bpf@...r.kernel.org" <bpf@...r.kernel.org>,
"ast@...nel.org" <ast@...nel.org>
CC: "daniel@...earbox.net" <daniel@...earbox.net>,
"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
Martin Lau <kafai@...com>,
"rostedt@...dmis.org" <rostedt@...dmis.org>,
"mingo@...hat.com" <mingo@...hat.com>,
Song Liu <songliubraving@...com>
Subject: Re: [PATCH bpf-next v3 1/5] bpf: add writable context for raw
tracepoints
On 4/22/19 4:01 PM, Matt Mullins wrote:
> On Mon, 2019-04-22 at 21:17 +0000, Yonghong Song wrote:
>>
>> On 4/22/19 12:23 PM, Matt Mullins wrote:
>>> On Mon, 2019-04-22 at 18:12 +0000, Yonghong Song wrote:
>>>>
>>>> On 4/19/19 2:04 PM, Matt Mullins wrote:
>>>>> This is an opt-in interface that allows a tracepoint to provide a safe
>>>>> buffer that can be written from a BPF_PROG_TYPE_RAW_TRACEPOINT program.
>>>>> The size of the buffer must be a compile-time constant, and is checked
>>>>> before allowing a BPF program to attach to a tracepoint that uses this
>>>>> feature.
>>>>>
>>>>> The pointer to this buffer will be the first argument of tracepoints
>>>>> that opt in; the buffer is readable by both BPF_PROG_TYPE_RAW_TRACEPOINT
>>>>> and BPF_PROG_TYPE_RAW_TRACEPOINT_WRITABLE programs that attach to such a
>>>>> tracepoint, but the buffer to which it points may only be written by the
>>>>> latter.
>>>>>
>>>>> Signed-off-by: Matt Mullins <mmullins@...com>
>>>>> ---
>>>>> include/linux/bpf.h | 2 ++
>>>>> include/linux/bpf_types.h | 1 +
>>>>> include/linux/tracepoint-defs.h | 1 +
>>>>> include/trace/bpf_probe.h | 27 +++++++++++++++++++++++++--
>>>>> include/uapi/linux/bpf.h | 1 +
>>>>> kernel/bpf/syscall.c | 8 ++++++--
>>>>> kernel/bpf/verifier.c | 31 +++++++++++++++++++++++++++++++
>>>>> kernel/trace/bpf_trace.c | 21 +++++++++++++++++++++
>>>>> 8 files changed, 88 insertions(+), 4 deletions(-)
>>>>>
>>>>> diff --git a/include/linux/bpf.h b/include/linux/bpf.h
>>>>> index a2132e09dc1c..d3c71fd67476 100644
>>>>> --- a/include/linux/bpf.h
>>>>> +++ b/include/linux/bpf.h
>>>>> @@ -263,6 +263,7 @@ enum bpf_reg_type {
>>>>> PTR_TO_SOCK_COMMON_OR_NULL, /* reg points to sock_common or NULL */
>>>>> PTR_TO_TCP_SOCK, /* reg points to struct tcp_sock */
>>>>> PTR_TO_TCP_SOCK_OR_NULL, /* reg points to struct tcp_sock or NULL */
>>>>> + PTR_TO_TP_BUFFER, /* reg points to a writable raw tp's buffer */
>>>>> };
>>>>>
>>>>
>>>> [...]
>>>>> /* truncate register to smaller size (in bytes)
>>>>> * must be called with size < BPF_REG_SIZE
>>>>> */
>>>>> @@ -2100,6 +2127,10 @@ static int check_mem_access(struct bpf_verifier_env *env, int insn_idx, u32 regn
>>>>> err = check_sock_access(env, insn_idx, regno, off, size, t);
>>>>> if (!err && value_regno >= 0)
>>>>> mark_reg_unknown(env, regs, value_regno);
>>>>> + } else if (reg->type == PTR_TO_TP_BUFFER) {
>>>>> + err = check_tp_buffer_access(env, reg, regno, off, size);
>>>>> + if (!err && t == BPF_READ && value_regno >= 0)
>>>>> + mark_reg_unknown(env, regs, value_regno);
>>>>> } else {
>>>>> verbose(env, "R%d invalid mem access '%s'\n", regno,
>>>>> reg_type_str[reg->type]);
>>>>> diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
>>>>> index d64c00afceb5..a2dd79dc6871 100644
>>>>> --- a/kernel/trace/bpf_trace.c
>>>>> +++ b/kernel/trace/bpf_trace.c
>>>>> @@ -909,6 +909,24 @@ const struct bpf_verifier_ops raw_tracepoint_verifier_ops = {
>>>>> const struct bpf_prog_ops raw_tracepoint_prog_ops = {
>>>>> };
>>>>>
>>>>> +static bool raw_tp_writable_prog_is_valid_access(int off, int size,
>>>>> + enum bpf_access_type type,
>>>>> + const struct bpf_prog *prog,
>>>>> + struct bpf_insn_access_aux *info)
>>>>> +{
>>>>> + if (off == 0 && size == sizeof(u64))
>>>>> + info->reg_type = PTR_TO_TP_BUFFER;
>>>>
>>>> on 32bit system, the first argument pointer size could be sizeof(u32)?
>>>
>>> As far as I can tell, pointers are always 64 bits wide from the
>>> perspective of the eBPF instruction set. I think the proper fixup is
>>> in include/trace/events/nbd.h ... I should use a u64 instead of a
>>> pointer type.
>>
>> u64 is okay. You may want to double check tracepoint definition to
>> ensure the assign to the first argument converting to u64 as well to
>> avoid potential garbage. It would be good if this is enforced during
>> compilation time.
>
> Now that I've looked into this further, this is already handled in
> include/trace/bpf_probe.h:
>
> #undef DECLARE_EVENT_CLASS
> #define DECLARE_EVENT_CLASS(call, proto, args, tstruct, assign, print) \
> static notrace void \
> __bpf_trace_##call(void *__data, proto) \
> { \
> struct bpf_prog *prog = __data; \
> CONCATENATE(bpf_trace_run, COUNT_ARGS(args))(prog, CAST_TO_U64(args)); \
> }
>
> The 32-bit value of the struct nbd_request pointer will be zero-
> extended to 64-bits before the BPF program sees it, so there won't be
> any garbage in the upper half of the register. I'm going to leave the
> trace_* functions taking the pointer as-is, so that I can keep the
> compile-time checks that writable_size == sizeof(*first_argument).
>
>>>> Should the first argument for raw_tp_writable_prog be always
>>>> PTR_TO_TP_BUFFER?
>>>
>>> That is the purpose of this patch series, yes. My initial attempt at
>>> this tried to add it to the end of the context structure instead, and
>>> that ended up being quite complex to track.
>>
>> So `size == sizeof(u64)` can be removed, off == 0 just implies
>> reg_type PTR_TO_TP_BUFFER?
>
> I can't get rid of the size check, because I can emit an opcode like
>
> 0: (71) r6 = *(u8 *)(r1 +0)
>
> and I don't want to accidentally mark a value as PTR_TO_TP_BUFFER
> unless it is a whole, valid pointer.
We could reject if off == 0 && size != 8 to allow only whole pointer
access. I cannot think that user will use r6 in a meaningful except the
hash. But if you have a valid use case to permit such access, I
am okay with that.
>
>>>>> + return raw_tp_prog_is_valid_access(off, size, type, prog, info);
>>>>> +}
>>>>> +
>>>>> +const struct bpf_verifier_ops raw_tracepoint_writable_verifier_ops = {
>>>>> + .get_func_proto = raw_tp_prog_func_proto,
>>>>> + .is_valid_access = raw_tp_writable_prog_is_valid_access,
>>>>> +};
>>>>> +
>>>>> +const struct bpf_prog_ops raw_tracepoint_writable_prog_ops = {
>>>>> +};
>>>>> +
>>>>> static bool pe_prog_is_valid_access(int off, int size, enum bpf_access_type type,
>>>>> const struct bpf_prog *prog,
>>>>> struct bpf_insn_access_aux *info)
>>>>> @@ -1198,6 +1216,9 @@ static int __bpf_probe_register(struct bpf_raw_event_map *btp, struct bpf_prog *
>>>>> if (prog->aux->max_ctx_offset > btp->num_args * sizeof(u64))
>>>>> return -EINVAL;
>>>>>
>>>>> + if (prog->aux->max_tp_access > btp->writable_size)
>>>>> + return -EINVAL;
>>>>> +
>>>>> return tracepoint_probe_register(tp, (void *)btp->bpf_func, prog);
>>>>> }
>>>>>
>>>>>
Powered by blists - more mailing lists