| Message ID | 20240607-hid_bpf_struct_ops-v2-15-3f95f4d02292@kernel.org (mailing list archive) |
|---|---|
| State | Superseded |
| Headers | show |
| Series | HID: convert HID-BPF into using bpf_struct_ops | expand |
| Context | Check | Description |
|---|---|---|
| netdev/tree_selection | success | Not a local patch, async |
On Fri, Jun 7, 2024 at 8:29 AM Benjamin Tissoires <bentiss@kernel.org> wrote: > > The idea is to provide a list of stucts and their editable fields. > > Currently no functional changes are introduced here, we will add some > more writeable fields in the next patch. > > Signed-off-by: Benjamin Tissoires <bentiss@kernel.org> > > --- > > new in v2 > --- > drivers/hid/bpf/hid_bpf_struct_ops.c | 91 +++++++++++++++++++++++++++--------- > 1 file changed, 69 insertions(+), 22 deletions(-) > > diff --git a/drivers/hid/bpf/hid_bpf_struct_ops.c b/drivers/hid/bpf/hid_bpf_struct_ops.c > index 056d05d96962..944e6d91a36b 100644 > --- a/drivers/hid/bpf/hid_bpf_struct_ops.c > +++ b/drivers/hid/bpf/hid_bpf_struct_ops.c > @@ -16,6 +16,7 @@ > #include <linux/hid_bpf.h> > #include <linux/init.h> > #include <linux/module.h> > +#include <linux/stddef.h> > #include <linux/workqueue.h> > #include "hid_bpf_dispatch.h" > > @@ -52,40 +53,86 @@ static int hid_bpf_ops_check_member(const struct btf_type *t, > return 0; > } > > +struct hid_bpf_offset_write_range { > + const char *struct_name; > + u32 struct_length; > + u32 start; > + u32 end; > +}; > + > static int hid_bpf_ops_btf_struct_access(struct bpf_verifier_log *log, > const struct bpf_reg_state *reg, > int off, int size) > { > - const struct btf_type *state; > - const struct btf_type *t; > - s32 type_id; > +#define WRITE_RANGE(_name, _field, _start_offset, _end_offset) \ > + { \ > + .struct_name = #_name, \ > + .struct_length = sizeof(struct _name), \ > + .start = offsetof(struct _name, _field) + _start_offset, \ > + .end = offsetofend(struct _name, _field) + _end_offset, \ > + } reading comment /* minus 1 to ensure \0 at the end */ in the next patch... I don't see this logic below. In general the manual byte offset adjustment looks like a footgun. Maybe add a flag for \0 and avoid messing with offsets? > > - type_id = btf_find_by_name_kind(reg->btf, "hid_bpf_ctx", > - BTF_KIND_STRUCT); > - if (type_id < 0) > - return -EINVAL; > + const struct hid_bpf_offset_write_range write_ranges[] = { > + WRITE_RANGE(hid_bpf_ctx, retval, 0, 0), > + }; > +#undef WRITE_RANGE > + const struct btf_type *state = NULL; > + const struct btf_type *t; > + const char *cur = NULL; > + int i; > > t = btf_type_by_id(reg->btf, reg->btf_id); > - state = btf_type_by_id(reg->btf, type_id); > - if (t != state) { > - bpf_log(log, "only access to hid_bpf_ctx is supported\n"); > - return -EACCES; > - } > > - /* out-of-bound access in hid_bpf_ctx */ > - if (off + size > sizeof(struct hid_bpf_ctx)) { > - bpf_log(log, "write access at off %d with size %d\n", off, size); > - return -EACCES; > + for (i = 0; i < ARRAY_SIZE(write_ranges); i++) { > + const struct hid_bpf_offset_write_range *write_range = &write_ranges[i]; > + s32 type_id; > + > + /* we already found a writeable struct, but there is a > + * new one, let's break the loop. > + */ > + if (t == state && write_range->struct_name != cur) > + break; > + > + /* new struct to look for */ > + if (write_range->struct_name != cur) { > + type_id = btf_find_by_name_kind(reg->btf, write_range->struct_name, > + BTF_KIND_STRUCT); > + if (type_id < 0) > + return -EINVAL; > + > + state = btf_type_by_id(reg->btf, type_id); > + } > + > + /* this is not the struct we are looking for */ > + if (t != state) { > + cur = write_range->struct_name; > + continue; > + } > + > + /* first time we see this struct, check for out of bounds */ > + if (cur != write_range->struct_name && > + off + size > write_range->struct_length) { > + bpf_log(log, "write access for struct %s at off %d with size %d\n", > + write_range->struct_name, off, size); > + return -EACCES; > + } > + > + /* now check if we are in our boundaries */ > + if (off >= write_range->start && off + size <= write_range->end) > + return NOT_INIT; > + > + cur = write_range->struct_name; > } > > - if (off < offsetof(struct hid_bpf_ctx, retval)) { > + > + if (t != state) > + bpf_log(log, "write access to this struct is not supported\n"); > + else > bpf_log(log, > - "write access at off %d with size %d on read-only part of hid_bpf_ctx\n", > - off, size); > - return -EACCES; > - } > + "write access at off %d with size %d on read-only part of %s\n", > + off, size, cur); > > - return NOT_INIT; > + return -EACCES; > } > > static const struct bpf_verifier_ops hid_bpf_verifier_ops = { > > -- > 2.44.0 >
diff --git a/drivers/hid/bpf/hid_bpf_struct_ops.c b/drivers/hid/bpf/hid_bpf_struct_ops.c index 056d05d96962..944e6d91a36b 100644 --- a/drivers/hid/bpf/hid_bpf_struct_ops.c +++ b/drivers/hid/bpf/hid_bpf_struct_ops.c @@ -16,6 +16,7 @@ #include <linux/hid_bpf.h> #include <linux/init.h> #include <linux/module.h> +#include <linux/stddef.h> #include <linux/workqueue.h> #include "hid_bpf_dispatch.h" @@ -52,40 +53,86 @@ static int hid_bpf_ops_check_member(const struct btf_type *t, return 0; } +struct hid_bpf_offset_write_range { + const char *struct_name; + u32 struct_length; + u32 start; + u32 end; +}; + static int hid_bpf_ops_btf_struct_access(struct bpf_verifier_log *log, const struct bpf_reg_state *reg, int off, int size) { - const struct btf_type *state; - const struct btf_type *t; - s32 type_id; +#define WRITE_RANGE(_name, _field, _start_offset, _end_offset) \ + { \ + .struct_name = #_name, \ + .struct_length = sizeof(struct _name), \ + .start = offsetof(struct _name, _field) + _start_offset, \ + .end = offsetofend(struct _name, _field) + _end_offset, \ + } - type_id = btf_find_by_name_kind(reg->btf, "hid_bpf_ctx", - BTF_KIND_STRUCT); - if (type_id < 0) - return -EINVAL; + const struct hid_bpf_offset_write_range write_ranges[] = { + WRITE_RANGE(hid_bpf_ctx, retval, 0, 0), + }; +#undef WRITE_RANGE + const struct btf_type *state = NULL; + const struct btf_type *t; + const char *cur = NULL; + int i; t = btf_type_by_id(reg->btf, reg->btf_id); - state = btf_type_by_id(reg->btf, type_id); - if (t != state) { - bpf_log(log, "only access to hid_bpf_ctx is supported\n"); - return -EACCES; - } - /* out-of-bound access in hid_bpf_ctx */ - if (off + size > sizeof(struct hid_bpf_ctx)) { - bpf_log(log, "write access at off %d with size %d\n", off, size); - return -EACCES; + for (i = 0; i < ARRAY_SIZE(write_ranges); i++) { + const struct hid_bpf_offset_write_range *write_range = &write_ranges[i]; + s32 type_id; + + /* we already found a writeable struct, but there is a + * new one, let's break the loop. + */ + if (t == state && write_range->struct_name != cur) + break; + + /* new struct to look for */ + if (write_range->struct_name != cur) { + type_id = btf_find_by_name_kind(reg->btf, write_range->struct_name, + BTF_KIND_STRUCT); + if (type_id < 0) + return -EINVAL; + + state = btf_type_by_id(reg->btf, type_id); + } + + /* this is not the struct we are looking for */ + if (t != state) { + cur = write_range->struct_name; + continue; + } + + /* first time we see this struct, check for out of bounds */ + if (cur != write_range->struct_name && + off + size > write_range->struct_length) { + bpf_log(log, "write access for struct %s at off %d with size %d\n", + write_range->struct_name, off, size); + return -EACCES; + } + + /* now check if we are in our boundaries */ + if (off >= write_range->start && off + size <= write_range->end) + return NOT_INIT; + + cur = write_range->struct_name; } - if (off < offsetof(struct hid_bpf_ctx, retval)) { + + if (t != state) + bpf_log(log, "write access to this struct is not supported\n"); + else bpf_log(log, - "write access at off %d with size %d on read-only part of hid_bpf_ctx\n", - off, size); - return -EACCES; - } + "write access at off %d with size %d on read-only part of %s\n", + off, size, cur); - return NOT_INIT; + return -EACCES; } static const struct bpf_verifier_ops hid_bpf_verifier_ops = {
The idea is to provide a list of stucts and their editable fields. Currently no functional changes are introduced here, we will add some more writeable fields in the next patch. Signed-off-by: Benjamin Tissoires <bentiss@kernel.org> --- new in v2 --- drivers/hid/bpf/hid_bpf_struct_ops.c | 91 +++++++++++++++++++++++++++--------- 1 file changed, 69 insertions(+), 22 deletions(-)