[bpf-next,v4,1/2] bpf: Add bpf_copy_from_user_str kfunc

Commit Message

Jordan Rome Aug. 14, 2024, 12:45 a.m. UTC

This adds a kfunc wrapper around strncpy_from_user,
which can be called from sleepable BPF programs.

This matches the non-sleepable 'bpf_probe_read_user_str'
helper except it includes an additional 'flags'
param, which allows consumers to clear the entire
destination buffer on success.

Signed-off-by: Jordan Rome <[e-mail]>
---
 include/uapi/linux/bpf.h       |  8 +++++++
 kernel/bpf/helpers.c           | 42 ++++++++++++++++++++++++++++++++++
 tools/include/uapi/linux/bpf.h |  8 +++++++
 3 files changed, 58 insertions(+)

--
2.43.5

Comments

kernel test robot Aug. 15, 2024, 2:02 a.m. UTC | #1

Hi Jordan,

kernel test robot noticed the following build warnings:

[auto build test WARNING on bpf-next/master]

url:    https://github.com/intel-lab-lkp/linux/commits/Jordan-Rome/bpf-Add-tests-for-bpf_copy_from_user_str-kfunc/20240814-232043
base:   https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next.git master
patch link:    https://lore.kernel.org/r/20240814004531.352157-1-linux%40jordanrome.com
patch subject: [bpf-next v4 1/2] bpf: Add bpf_copy_from_user_str kfunc
config: x86_64-buildonly-randconfig-002-20240815 (https://download.01.org/0day-ci/archive/20240815/[e-mail]/config)
compiler: gcc-11 (Debian 11.3.0-12) 11.3.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240815/[e-mail]/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <[e-mail]>
| Closes: https://lore.kernel.org/oe-kbuild-all/[e-mail]/

All warnings (new ones prefixed by >>):

   kernel/bpf/helpers.c: In function 'bpf_copy_from_user_str':
>> kernel/bpf/helpers.c:2972:20: warning: suggest explicit braces to avoid ambiguous 'else' [-Wdangling-else]
    2972 |                 if (ret <= count)
         |                    ^


vim +/else +2972 kernel/bpf/helpers.c

  2941	
  2942	/**
  2943	 * bpf_copy_from_user_str() - Copy a string from an unsafe user address
  2944	 * @dst:             Destination address, in kernel space.  This buffer must be at
  2945	 *                   least @dst__szk bytes long.
  2946	 * @dst__szk:        Maximum number of bytes to copy, including the trailing NUL.
  2947	 * @unsafe_ptr__ign: Source address, in user space.
  2948	 * @flags:           The only supported flag is BPF_ZERO_BUFFER
  2949	 *
  2950	 * Copies a NUL-terminated string from userspace to BPF space. If user string is
  2951	 * too long this will still ensure zero termination in the dst buffer unless
  2952	 * buffer size is 0.
  2953	 *
  2954	 * If BPF_ZERO_BUFFER flag is set, memset the tail of @dst to 0 on success.
  2955	 */
  2956	__bpf_kfunc int bpf_copy_from_user_str(void *dst, u32 dst__szk, const void __user *unsafe_ptr__ign, u64 flags)
  2957	{
  2958		int ret;
  2959		int count;
  2960	
  2961		if (unlikely(!dst__szk))
  2962			return 0;
  2963	
  2964		count = dst__szk - 1;
  2965		if (unlikely(!count)) {
  2966			((char *)dst)[0] = '\0';
  2967			return 1;
  2968		}
  2969	
  2970		ret = strncpy_from_user(dst, unsafe_ptr__ign, count);
  2971		if (ret >= 0) {
> 2972			if (ret <= count)
  2973				if (flags & BPF_ZERO_BUFFER)
  2974					memset((char *)dst + ret, 0, dst__szk - ret);
  2975				else
  2976					((char *)dst)[ret] = '\0';
  2977			ret++;
  2978		}
  2979	
  2980		return ret;
  2981	}
  2982

kernel test robot Aug. 15, 2024, 3:47 a.m. UTC | #2

Hi Jordan,

kernel test robot noticed the following build warnings:

[auto build test WARNING on bpf-next/master]

url:    https://github.com/intel-lab-lkp/linux/commits/Jordan-Rome/bpf-Add-tests-for-bpf_copy_from_user_str-kfunc/20240814-232043
base:   https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next.git master
patch link:    https://lore.kernel.org/r/20240814004531.352157-1-linux%40jordanrome.com
patch subject: [bpf-next v4 1/2] bpf: Add bpf_copy_from_user_str kfunc
config: i386-buildonly-randconfig-002-20240815 (https://download.01.org/0day-ci/archive/20240815/[e-mail]/config)
compiler: clang version 18.1.5 (https://github.com/llvm/llvm-project 617a15a9eac96088ae5e9134248d8236e34b91b1)
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240815/[e-mail]/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <[e-mail]>
| Closes: https://lore.kernel.org/oe-kbuild-all/[e-mail]/

All warnings (new ones prefixed by >>):

>> kernel/bpf/helpers.c:2975:4: warning: add explicit braces to avoid dangling else [-Wdangling-else]
    2975 |                         else
         |                         ^
   1 warning generated.


vim +2975 kernel/bpf/helpers.c

  2941	
  2942	/**
  2943	 * bpf_copy_from_user_str() - Copy a string from an unsafe user address
  2944	 * @dst:             Destination address, in kernel space.  This buffer must be at
  2945	 *                   least @dst__szk bytes long.
  2946	 * @dst__szk:        Maximum number of bytes to copy, including the trailing NUL.
  2947	 * @unsafe_ptr__ign: Source address, in user space.
  2948	 * @flags:           The only supported flag is BPF_ZERO_BUFFER
  2949	 *
  2950	 * Copies a NUL-terminated string from userspace to BPF space. If user string is
  2951	 * too long this will still ensure zero termination in the dst buffer unless
  2952	 * buffer size is 0.
  2953	 *
  2954	 * If BPF_ZERO_BUFFER flag is set, memset the tail of @dst to 0 on success.
  2955	 */
  2956	__bpf_kfunc int bpf_copy_from_user_str(void *dst, u32 dst__szk, const void __user *unsafe_ptr__ign, u64 flags)
  2957	{
  2958		int ret;
  2959		int count;
  2960	
  2961		if (unlikely(!dst__szk))
  2962			return 0;
  2963	
  2964		count = dst__szk - 1;
  2965		if (unlikely(!count)) {
  2966			((char *)dst)[0] = '\0';
  2967			return 1;
  2968		}
  2969	
  2970		ret = strncpy_from_user(dst, unsafe_ptr__ign, count);
  2971		if (ret >= 0) {
  2972			if (ret <= count)
  2973				if (flags & BPF_ZERO_BUFFER)
  2974					memset((char *)dst + ret, 0, dst__szk - ret);
> 2975				else
  2976					((char *)dst)[ret] = '\0';
  2977			ret++;
  2978		}
  2979	
  2980		return ret;
  2981	}
  2982

Patch

diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h
index e05b39e39c3f..e207175981be 100644
--- a/include/uapi/linux/bpf.h
+++ b/include/uapi/linux/bpf.h
@@ -7513,4 +7513,12 @@  struct bpf_iter_num {
 	__u64 __opaque[1];
 } __attribute__((aligned(8)));

+/*
+ * Flags to control bpf_copy_from_user_str() behaviour.
+ *     - BPF_ZERO_BUFFER: Memset 0 the tail of the destination buffer on success
+ */
+enum {
+	BPF_ZERO_BUFFER = (1ULL << 0)
+};
+
 #endif /* _UAPI__LINUX_BPF_H__ */
diff --git a/kernel/bpf/helpers.c b/kernel/bpf/helpers.c
index d02ae323996b..34c4414f2257 100644
--- a/kernel/bpf/helpers.c
+++ b/kernel/bpf/helpers.c
@@ -2939,6 +2939,47 @@  __bpf_kfunc void bpf_iter_bits_destroy(struct bpf_iter_bits *it)
 	bpf_mem_free(&bpf_global_ma, kit->bits);
 }

+/**
+ * bpf_copy_from_user_str() - Copy a string from an unsafe user address
+ * @dst:             Destination address, in kernel space.  This buffer must be at
+ *                   least @dst__szk bytes long.
+ * @dst__szk:        Maximum number of bytes to copy, including the trailing NUL.
+ * @unsafe_ptr__ign: Source address, in user space.
+ * @flags:           The only supported flag is BPF_ZERO_BUFFER
+ *
+ * Copies a NUL-terminated string from userspace to BPF space. If user string is
+ * too long this will still ensure zero termination in the dst buffer unless
+ * buffer size is 0.
+ *
+ * If BPF_ZERO_BUFFER flag is set, memset the tail of @dst to 0 on success.
+ */
+__bpf_kfunc int bpf_copy_from_user_str(void *dst, u32 dst__szk, const void __user *unsafe_ptr__ign, u64 flags)
+{
+	int ret;
+	int count;
+
+	if (unlikely(!dst__szk))
+		return 0;
+
+	count = dst__szk - 1;
+	if (unlikely(!count)) {
+		((char *)dst)[0] = '\0';
+		return 1;
+	}
+
+	ret = strncpy_from_user(dst, unsafe_ptr__ign, count);
+	if (ret >= 0) {
+		if (ret <= count)
+			if (flags & BPF_ZERO_BUFFER)
+				memset((char *)dst + ret, 0, dst__szk - ret);
+			else
+				((char *)dst)[ret] = '\0';
+		ret++;
+	}
+
+	return ret;
+}
+
 __bpf_kfunc_end_defs();

 BTF_KFUNCS_START(generic_btf_ids)
@@ -3024,6 +3065,7 @@  BTF_ID_FLAGS(func, bpf_preempt_enable)
 BTF_ID_FLAGS(func, bpf_iter_bits_new, KF_ITER_NEW)
 BTF_ID_FLAGS(func, bpf_iter_bits_next, KF_ITER_NEXT | KF_RET_NULL)
 BTF_ID_FLAGS(func, bpf_iter_bits_destroy, KF_ITER_DESTROY)
+BTF_ID_FLAGS(func, bpf_copy_from_user_str, KF_SLEEPABLE)
 BTF_KFUNCS_END(common_btf_ids)

 static const struct btf_kfunc_id_set common_kfunc_set = {
diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h
index e05b39e39c3f..15c2c3431e0f 100644
--- a/tools/include/uapi/linux/bpf.h
+++ b/tools/include/uapi/linux/bpf.h
@@ -7513,4 +7513,12 @@  struct bpf_iter_num {
 	__u64 __opaque[1];
 } __attribute__((aligned(8)));

+/*
+ * Flags to control bpf_copy_from_user_str() behaviour.
+ *     - BPF_ZERO_BUFFER: Memset 0 the entire destination buffer on success
+ */
+enum {
+	BPF_ZERO_BUFFER = (1ULL << 0)
+};
+
 #endif /* _UAPI__LINUX_BPF_H__ */