[bpf-next,v5,1/9] bpf: Fix bpf_strtol and bpf_strtoul helpers for 32bit

Commit Message

Daniel Borkmann Sept. 13, 2024, 7:17 p.m. UTC

The bpf_strtol() and bpf_strtoul() helpers are currently broken on 32bit:

The argument type ARG_PTR_TO_LONG is BPF-side "long", not kernel-side "long"
and therefore always considered fixed 64bit no matter if 64 or 32bit underlying
architecture.

This contract breaks in case of the two mentioned helpers since their BPF_CALL
definition for the helpers was added with {unsigned,}long *res. Meaning, the
transition from BPF-side "long" (BPF program) to kernel-side "long" (BPF helper)
breaks here.

Both helpers call __bpf_strtoll() with "long long" correctly, but later assigning
the result into 32-bit "*(long *)" on 32bit architectures. From a BPF program
point of view, this means upper bits will be seen as uninitialised.

Therefore, fix both BPF_CALL signatures to {s,u}64 types to fix this situation.

Now, changing also uapi/bpf.h helper documentation which generates bpf_helper_defs.h
for BPF programs is tricky: Changing signatures there to __{s,u}64 would trigger
compiler warnings (incompatible pointer types passing 'long *' to parameter of type
'__s64 *' (aka 'long long *')) for existing BPF programs.

Leaving the signatures as-is would be fine as from BPF program point of view it is
still BPF-side "long" and thus equivalent to __{s,u}64 on 64 or 32bit underlying
architectures.

Note that bpf_strtol() and bpf_strtoul() are the only helpers with this issue.

Fixes: d7a4cb9b6705 ("bpf: Introduce bpf_strtol and bpf_strtoul helpers")
Reported-by: Alexei Starovoitov <[e-mail]>
Signed-off-by: Daniel Borkmann <[e-mail]>
Acked-by: Andrii Nakryiko <[e-mail]>
Link: https://lore.kernel.org/bpf/[e-mail]
---
 v3 -> v4:
 - added patch

 kernel/bpf/helpers.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

Comments

[e-mail] Sept. 13, 2024, 8:31 p.m. UTC | #1

Hello:

This series was applied to bpf/bpf-next.git (master)
by Alexei Starovoitov <[e-mail]>:

On Fri, 13 Sep 2024 21:17:46 +0200 you wrote:
> The bpf_strtol() and bpf_strtoul() helpers are currently broken on 32bit:
> 
> The argument type ARG_PTR_TO_LONG is BPF-side "long", not kernel-side "long"
> and therefore always considered fixed 64bit no matter if 64 or 32bit underlying
> architecture.
> 
> This contract breaks in case of the two mentioned helpers since their BPF_CALL
> definition for the helpers was added with {unsigned,}long *res. Meaning, the
> transition from BPF-side "long" (BPF program) to kernel-side "long" (BPF helper)
> breaks here.
> 
> [...]

Here is the summary with links:
  - [bpf-next,v5,1/9] bpf: Fix bpf_strtol and bpf_strtoul helpers for 32bit
    https://git.kernel.org/bpf/bpf-next/c/cfe69c50b055
  - [bpf-next,v5,2/9] bpf: Remove truncation test in bpf_strtol and bpf_strtoul helpers
    https://git.kernel.org/bpf/bpf-next/c/7d71f59e0280
  - [bpf-next,v5,3/9] bpf: Fix helper writes to read-only maps
    https://git.kernel.org/bpf/bpf-next/c/32556ce93bc4
  - [bpf-next,v5,4/9] bpf: Improve check_raw_mode_ok test for MEM_UNINIT-tagged types
    https://git.kernel.org/bpf/bpf-next/c/18752d73c189
  - [bpf-next,v5,5/9] bpf: Zero former ARG_PTR_TO_{LONG,INT} args in case of error
    https://git.kernel.org/bpf/bpf-next/c/4b3786a6c539
  - [bpf-next,v5,6/9] selftests/bpf: Fix ARG_PTR_TO_LONG {half-,}uninitialized test
    https://git.kernel.org/bpf/bpf-next/c/b8e188f023e0
  - [bpf-next,v5,7/9] selftests/bpf: Rename ARG_PTR_TO_LONG test description
    https://git.kernel.org/bpf/bpf-next/c/b073b82d4d3c
  - [bpf-next,v5,8/9] selftests/bpf: Add a test case to write strtol result into .rodata
    https://git.kernel.org/bpf/bpf-next/c/2e3f06602047
  - [bpf-next,v5,9/9] selftests/bpf: Add a test case to write mtu result into .rodata
    https://git.kernel.org/bpf/bpf-next/c/211bf9cf178a

You are awesome, thank you!

Patch

diff --git a/kernel/bpf/helpers.c b/kernel/bpf/helpers.c
index 3956be5d6440..0cf42be52890 100644
--- a/kernel/bpf/helpers.c
+++ b/kernel/bpf/helpers.c
@@ -518,7 +518,7 @@  static int __bpf_strtoll(const char *buf, size_t buf_len, u64 flags,
 }
 
 BPF_CALL_4(bpf_strtol, const char *, buf, size_t, buf_len, u64, flags,
-	   long *, res)
+	   s64 *, res)
 {
 	long long _res;
 	int err;
@@ -543,7 +543,7 @@  const struct bpf_func_proto bpf_strtol_proto = {
 };
 
 BPF_CALL_4(bpf_strtoul, const char *, buf, size_t, buf_len, u64, flags,
-	   unsigned long *, res)
+	   u64 *, res)
 {
 	unsigned long long _res;
 	bool is_negative;