[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <2a03633b-419d-643f-b787-ca1520e2229b@iogearbox.net>
Date: Thu, 14 May 2020 01:24:18 +0200
From: Daniel Borkmann <daniel@...earbox.net>
To: Linus Torvalds <torvalds@...ux-foundation.org>
Cc: Christoph Hellwig <hch@....de>,
the arch/x86 maintainers <x86@...nel.org>,
Alexei Starovoitov <ast@...nel.org>,
Masami Hiramatsu <mhiramat@...nel.org>,
Andrew Morton <akpm@...ux-foundation.org>,
linux-parisc@...r.kernel.org,
linux-um <linux-um@...ts.infradead.org>,
Netdev <netdev@...r.kernel.org>, bpf@...r.kernel.org,
Linux-MM <linux-mm@...ck.org>,
Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
bgregg@...flix.com
Subject: Re: [PATCH 11/18] maccess: remove strncpy_from_unsafe
On 5/14/20 1:03 AM, Linus Torvalds wrote:
> On Wed, May 13, 2020 at 3:36 PM Daniel Borkmann <daniel@...earbox.net> wrote:
>>
>> It's used for both.
>
> Daniel, BPF real;ly needs to make up its mind about that.
>
> You *cannot* use ti for both.
>
> Yes, it happens to work on x86 and some other architectures.
>
> But on other architectures, the exact same pointer value can be a
> kernel pointer or a user pointer.
Right, it has the same issue as with the old probe helper. I was merely stating that
there are existing users (on x86) out there that use it this way, even though broken
generally.
>> Given this is enabled on pretty much all program types, my
>> assumption would be that usage is still more often on kernel memory than user one.
>
> You need to pick one.
>
> If you know it is a user pointer, use strncpy_from_user() (possibly
> with disable_pagefault() aka strncpy_from_user_nofault()).
>
> And if you know it is a kernel pointer, use strncpy_from_unsafe() (aka
> strncpy_from_kernel_nofault()).
>
> You really can't pick the "randomly one or the other guess what I mean " option.
My preference would be to have %s, %sK, %sU for bpf_trace_printk() where the latter two
result in an explicit strncpy_from_kernel_nofault() or strncpy_from_user_nofault()
choice while the %s is converted as per your suggestion and it would still allow for a
grace period to convert existing users to the new variants, similar with what we did on
the bpf_probe_read_kernel() and bpf_probe_read_user() helpers to get this sorted out.
Thanks,
Daniel
Powered by blists - more mailing lists