netdev - Re: [PATCH bpf-next 3/3] selftests/bpf: add tests for user- and non-CO-RE BPF_CORE

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 4 Jan 2021 19:46:44 -0800
From:   Alexei Starovoitov <alexei.starovoitov@...il.com>
To:     Andrii Nakryiko <andrii@...nel.org>
Cc:     bpf@...r.kernel.org, netdev@...r.kernel.org, ast@...com,
        daniel@...earbox.net, kernel-team@...com
Subject: Re: [PATCH bpf-next 3/3] selftests/bpf: add tests for user- and
 non-CO-RE BPF_CORE_READ() variants

On Fri, Dec 18, 2020 at 03:56:14PM -0800, Andrii Nakryiko wrote:
> +
> +/* shuffled layout for relocatable (CO-RE) reads */
> +struct callback_head___shuffled {
> +	void (*func)(struct callback_head___shuffled *head);
> +	struct callback_head___shuffled *next;
> +};
> +
> +struct callback_head k_probe_in = {};
> +struct callback_head___shuffled k_core_in = {};
> +
> +struct callback_head *u_probe_in = 0;
> +struct callback_head___shuffled *u_core_in = 0;
> +
> +long k_probe_out = 0;
> +long u_probe_out = 0;
> +
> +long k_core_out = 0;
> +long u_core_out = 0;
> +
> +int my_pid = 0;
> +
> +SEC("raw_tracepoint/sys_enter")
> +int handler(void *ctx)
> +{
> +	int pid = bpf_get_current_pid_tgid() >> 32;
> +
> +	if (my_pid != pid)
> +		return 0;
> +
> +	/* next pointers for kernel address space have to be initialized from
> +	 * BPF side, user-space mmaped addresses are stil user-space addresses
> +	 */
> +	k_probe_in.next = &k_probe_in;
> +	__builtin_preserve_access_index(({k_core_in.next = &k_core_in;}));
> +
> +	k_probe_out = (long)BPF_PROBE_READ(&k_probe_in, next, next, func);
> +	k_core_out = (long)BPF_CORE_READ(&k_core_in, next, next, func);
> +	u_probe_out = (long)BPF_PROBE_READ_USER(u_probe_in, next, next, func);
> +	u_core_out = (long)BPF_CORE_READ_USER(u_core_in, next, next, func);

I don't understand what the test suppose to demonstrate.
co-re relocs work for kernel btf only.
Are you saying that 'struct callback_head' happened to be used by user space
process that allocated it in user memory. And that is the same struct as
being used by the kernel? So co-re relocs that apply against the kernel
will sort-of work against the data of user space process because
the user space is using the same struct? That sounds convoluted.
I struggle to see the point of patch 1:
+#define bpf_core_read_user(dst, sz, src)                                   \
+       bpf_probe_read_user(dst, sz, (const void *)__builtin_preserve_access_index(src))

co-re for user structs? Aren't they uapi? No reloc is needed.