[bpf-next,v8,1/2] bpf: Add bpf_copy_from_user_str kfunc

Commit Message

Jordan Rome Aug. 23, 2024, 12:05 a.m. UTC

This adds a kfunc wrapper around strncpy_from_user,
which can be called from sleepable BPF programs.

This matches the non-sleepable 'bpf_probe_read_user_str'
helper except it includes an additional 'flags'
param, which allows consumers to clear the entire
destination buffer on success or failure.

Signed-off-by: Jordan Rome <[e-mail]>
---
 include/uapi/linux/bpf.h       |  9 ++++++++
 kernel/bpf/helpers.c           | 42 ++++++++++++++++++++++++++++++++++
 tools/include/uapi/linux/bpf.h |  9 ++++++++
 3 files changed, 60 insertions(+)

--
2.43.5

Comments

Alexei Starovoitov Aug. 23, 2024, 12:15 a.m. UTC | #1

On Thu, Aug 22, 2024 at 5:06 PM Jordan Rome <[e-mail]> wrote:
>
> +/**
> + * bpf_copy_from_user_str() - Copy a string from an unsafe user address
> + * @dst:             Destination address, in kernel space.  This buffer must be at
> + *                   least @dst__szk bytes long.
> + * @dst__szk:        Maximum number of bytes to copy, including the trailing NUL.
> + * @unsafe_ptr__ign: Source address, in user space.
> + * @flags:           The only supported flag is BPF_F_PAD_ZEROS
> + *
> + * Copies a NUL-terminated string from userspace to BPF space. If user string is
> + * too long this will still ensure zero termination in the dst buffer unless
> + * buffer size is 0.
> + *
> + * If BPF_F_PAD_ZEROS flag is set, memset the tail of @dst to 0 on success and
> + * memset all of @dst on failure.
> + */
> +__bpf_kfunc int bpf_copy_from_user_str(void *dst, u32 dst__szk, const void __user *unsafe_ptr__ign, u64 flags)

Did you miss my previous comment re __szk vs __sz ?

> +enum {
> +       BPF_F_PAD_ZEROS = (1ULL << 0),
> +};

Pls give enum a name, so it's easier for CORE logic to detect the
presence of this feature in the kernel.

Jordan Rome Aug. 23, 2024, 12:22 a.m. UTC | #2

On Thu, Aug 22, 2024 at 8:15 PM Alexei Starovoitov
<[e-mail]> wrote:
>
> On Thu, Aug 22, 2024 at 5:06 PM Jordan Rome <[e-mail]> wrote:
> >
> > +/**
> > + * bpf_copy_from_user_str() - Copy a string from an unsafe user address
> > + * @dst:             Destination address, in kernel space.  This buffer must be at
> > + *                   least @dst__szk bytes long.
> > + * @dst__szk:        Maximum number of bytes to copy, including the trailing NUL.
> > + * @unsafe_ptr__ign: Source address, in user space.
> > + * @flags:           The only supported flag is BPF_F_PAD_ZEROS
> > + *
> > + * Copies a NUL-terminated string from userspace to BPF space. If user string is
> > + * too long this will still ensure zero termination in the dst buffer unless
> > + * buffer size is 0.
> > + *
> > + * If BPF_F_PAD_ZEROS flag is set, memset the tail of @dst to 0 on success and
> > + * memset all of @dst on failure.
> > + */
> > +__bpf_kfunc int bpf_copy_from_user_str(void *dst, u32 dst__szk, const void __user *unsafe_ptr__ign, u64 flags)
>
> Did you miss my previous comment re __szk vs __sz ?
>

Ah, yes, I did miss it. Will fix.

> > +enum {
> > +       BPF_F_PAD_ZEROS = (1ULL << 0),
> > +};
>
> Pls give enum a name, so it's easier for CORE logic to detect the
> presence of this feature in the kernel.

How about 'bpf_copy_str_flags' ? As I imagine we will use this flag on
'bpf_copy_from_user_task_str', when I add that.

Alexei Starovoitov Aug. 23, 2024, 12:45 a.m. UTC | #3

On Thu, Aug 22, 2024 at 5:22 PM Jordan Rome <[e-mail]> wrote:
>
> On Thu, Aug 22, 2024 at 8:15 PM Alexei Starovoitov
> <[e-mail]> wrote:
> >
> > On Thu, Aug 22, 2024 at 5:06 PM Jordan Rome <[e-mail]> wrote:
> > >
> > > +/**
> > > + * bpf_copy_from_user_str() - Copy a string from an unsafe user address
> > > + * @dst:             Destination address, in kernel space.  This buffer must be at
> > > + *                   least @dst__szk bytes long.
> > > + * @dst__szk:        Maximum number of bytes to copy, including the trailing NUL.
> > > + * @unsafe_ptr__ign: Source address, in user space.
> > > + * @flags:           The only supported flag is BPF_F_PAD_ZEROS
> > > + *
> > > + * Copies a NUL-terminated string from userspace to BPF space. If user string is
> > > + * too long this will still ensure zero termination in the dst buffer unless
> > > + * buffer size is 0.
> > > + *
> > > + * If BPF_F_PAD_ZEROS flag is set, memset the tail of @dst to 0 on success and
> > > + * memset all of @dst on failure.
> > > + */
> > > +__bpf_kfunc int bpf_copy_from_user_str(void *dst, u32 dst__szk, const void __user *unsafe_ptr__ign, u64 flags)
> >
> > Did you miss my previous comment re __szk vs __sz ?
> >
>
> Ah, yes, I did miss it. Will fix.
>
> > > +enum {
> > > +       BPF_F_PAD_ZEROS = (1ULL << 0),
> > > +};
> >
> > Pls give enum a name, so it's easier for CORE logic to detect the
> > presence of this feature in the kernel.
>
> How about 'bpf_copy_str_flags' ? As I imagine we will use this flag on
> 'bpf_copy_from_user_task_str', when I add that.

Maybe 'enum bpf_kfunc_flags' ?
since BPF_F_PAD_ZEROS is supposed to be generic and apply to various kfuncs.

Jordan Rome Aug. 23, 2024, 12:51 a.m. UTC | #4

On Thu, Aug 22, 2024 at 8:45 PM Alexei Starovoitov
<[e-mail]> wrote:
>
> On Thu, Aug 22, 2024 at 5:22 PM Jordan Rome <[e-mail]> wrote:
> >
> > On Thu, Aug 22, 2024 at 8:15 PM Alexei Starovoitov
> > <[e-mail]> wrote:
> > >
> > > On Thu, Aug 22, 2024 at 5:06 PM Jordan Rome <[e-mail]> wrote:
> > > >
> > > > +/**
> > > > + * bpf_copy_from_user_str() - Copy a string from an unsafe user address
> > > > + * @dst:             Destination address, in kernel space.  This buffer must be at
> > > > + *                   least @dst__szk bytes long.
> > > > + * @dst__szk:        Maximum number of bytes to copy, including the trailing NUL.
> > > > + * @unsafe_ptr__ign: Source address, in user space.
> > > > + * @flags:           The only supported flag is BPF_F_PAD_ZEROS
> > > > + *
> > > > + * Copies a NUL-terminated string from userspace to BPF space. If user string is
> > > > + * too long this will still ensure zero termination in the dst buffer unless
> > > > + * buffer size is 0.
> > > > + *
> > > > + * If BPF_F_PAD_ZEROS flag is set, memset the tail of @dst to 0 on success and
> > > > + * memset all of @dst on failure.
> > > > + */
> > > > +__bpf_kfunc int bpf_copy_from_user_str(void *dst, u32 dst__szk, const void __user *unsafe_ptr__ign, u64 flags)
> > >
> > > Did you miss my previous comment re __szk vs __sz ?
> > >
> >
> > Ah, yes, I did miss it. Will fix.
> >
> > > > +enum {
> > > > +       BPF_F_PAD_ZEROS = (1ULL << 0),
> > > > +};
> > >
> > > Pls give enum a name, so it's easier for CORE logic to detect the
> > > presence of this feature in the kernel.
> >
> > How about 'bpf_copy_str_flags' ? As I imagine we will use this flag on
> > 'bpf_copy_from_user_task_str', when I add that.
>
> Maybe 'enum bpf_kfunc_flags' ?
> since BPF_F_PAD_ZEROS is supposed to be generic and apply to various kfuncs.

Works for me.

Patch

diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h
index e05b39e39c3f..8556f65da4f8 100644
--- a/include/uapi/linux/bpf.h
+++ b/include/uapi/linux/bpf.h
@@ -7513,4 +7513,13 @@  struct bpf_iter_num {
 	__u64 __opaque[1];
 } __attribute__((aligned(8)));

+/*
+ * Flags to control bpf_copy_from_user_str() behaviour.
+ *     - BPF_F_PAD_ZEROS: Pad destination buffer with zeros. (See the respective
+ *       helper documentation for details.)
+ */
+enum {
+	BPF_F_PAD_ZEROS = (1ULL << 0),
+};
+
 #endif /* _UAPI__LINUX_BPF_H__ */
diff --git a/kernel/bpf/helpers.c b/kernel/bpf/helpers.c
index d02ae323996b..e5614a980d59 100644
--- a/kernel/bpf/helpers.c
+++ b/kernel/bpf/helpers.c
@@ -2939,6 +2939,47 @@  __bpf_kfunc void bpf_iter_bits_destroy(struct bpf_iter_bits *it)
 	bpf_mem_free(&bpf_global_ma, kit->bits);
 }

+/**
+ * bpf_copy_from_user_str() - Copy a string from an unsafe user address
+ * @dst:             Destination address, in kernel space.  This buffer must be at
+ *                   least @dst__szk bytes long.
+ * @dst__szk:        Maximum number of bytes to copy, including the trailing NUL.
+ * @unsafe_ptr__ign: Source address, in user space.
+ * @flags:           The only supported flag is BPF_F_PAD_ZEROS
+ *
+ * Copies a NUL-terminated string from userspace to BPF space. If user string is
+ * too long this will still ensure zero termination in the dst buffer unless
+ * buffer size is 0.
+ *
+ * If BPF_F_PAD_ZEROS flag is set, memset the tail of @dst to 0 on success and
+ * memset all of @dst on failure.
+ */
+__bpf_kfunc int bpf_copy_from_user_str(void *dst, u32 dst__szk, const void __user *unsafe_ptr__ign, u64 flags)
+{
+	int ret;
+
+	if (unlikely(flags & ~BPF_F_PAD_ZEROS))
+		return -EINVAL;
+
+	if (unlikely(!dst__szk))
+		return 0;
+
+	ret = strncpy_from_user(dst, unsafe_ptr__ign, dst__szk - 1);
+	if (ret < 0) {
+		if (flags & BPF_F_PAD_ZEROS)
+			memset((char *)dst, 0, dst__szk);
+
+		return ret;
+	}
+
+	if (flags & BPF_F_PAD_ZEROS)
+		memset((char *)dst + ret, 0, dst__szk - ret);
+	else
+		((char *)dst)[ret] = '\0';
+
+	return ret + 1;
+}
+
 __bpf_kfunc_end_defs();

 BTF_KFUNCS_START(generic_btf_ids)
@@ -3024,6 +3065,7 @@  BTF_ID_FLAGS(func, bpf_preempt_enable)
 BTF_ID_FLAGS(func, bpf_iter_bits_new, KF_ITER_NEW)
 BTF_ID_FLAGS(func, bpf_iter_bits_next, KF_ITER_NEXT | KF_RET_NULL)
 BTF_ID_FLAGS(func, bpf_iter_bits_destroy, KF_ITER_DESTROY)
+BTF_ID_FLAGS(func, bpf_copy_from_user_str, KF_SLEEPABLE)
 BTF_KFUNCS_END(common_btf_ids)

 static const struct btf_kfunc_id_set common_kfunc_set = {
diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h
index e05b39e39c3f..8556f65da4f8 100644
--- a/tools/include/uapi/linux/bpf.h
+++ b/tools/include/uapi/linux/bpf.h
@@ -7513,4 +7513,13 @@  struct bpf_iter_num {
 	__u64 __opaque[1];
 } __attribute__((aligned(8)));

+/*
+ * Flags to control bpf_copy_from_user_str() behaviour.
+ *     - BPF_F_PAD_ZEROS: Pad destination buffer with zeros. (See the respective
+ *       helper documentation for details.)
+ */
+enum {
+	BPF_F_PAD_ZEROS = (1ULL << 0),
+};
+
 #endif /* _UAPI__LINUX_BPF_H__ */