From patchwork Fri Jan 24 18:16:00 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jordan Rome X-Patchwork-Id: 13949815 X-Patchwork-Delegate: bpf@iogearbox.net Received: from mout.perfora.net (mout.perfora.net [74.208.4.196]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C649F21ADB7 for ; Fri, 24 Jan 2025 18:22:03 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.208.4.196 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1737742926; cv=none; b=czx3f2/hvUGG591Qz/tB+PYRE7G41f3X/5xGL5y5Y32s5RWWk+YZS1jWsZsBJWEVDGrN4+nwb4OxpD0ibID0Ee8wQ961Pxh74ip4NSPZmch/tdAT3ACAgIloRgbRRw1vgm0G8fOEfU48IUfcgJPKGZxnAaQl+sHzdq2tHy7ry8Q= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1737742926; c=relaxed/simple; bh=vuE0cbF3cK2RIUe+INQdehE2MHyMu75D7nDjiwGryAE=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=ZQOfCAAKIafcVFPcDHvN5JLvDx2bf1VOXBofzDCG5bfRdka0DmftSr4Qoxb8/ye/DtJMCTqGIA85YEGIV+zT79kpTWtuqHXdDxi/7L9IWlSPF2RuNWj6YalNGcBdXeoJmk4RBM/8M+gQbBQ4xENIqHPt4qsVRynaojZK3xoBIJE= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=jordanrome.com; spf=pass smtp.mailfrom=jordanrome.com; dkim=pass (2048-bit key) header.d=jordanrome.com header.i=linux@jordanrome.com header.b=wp7ZXXRE; arc=none smtp.client-ip=74.208.4.196 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=jordanrome.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=jordanrome.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=jordanrome.com header.i=linux@jordanrome.com header.b="wp7ZXXRE" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=jordanrome.com; s=s1-ionos; t=1737742919; x=1738347719; i=linux@jordanrome.com; bh=CTtBpXoCRGF8xp6ipvPviZzZSvtuH9Unpp03LtW5iJU=; h=X-UI-Sender-Class:From:To:Cc:Subject:Date:Message-ID: MIME-Version:Content-Transfer-Encoding:cc: content-transfer-encoding:content-type:date:from:message-id: mime-version:reply-to:subject:to; b=wp7ZXXRECo5jMCWFejrBX1W6qo6jywqevxGIlC/XakneUbfrpPh4T6ynEZ+srt3W B8CEtEuyEBMPBuzzuJxC1rAo5Ep4/JpCiGZ8B2TxAe28Ky+zIR1AhDYNPkDqfF0q7 E1EgdJWDvuSq1XAkipMaZNqjoz0cVDsvdYbje+l4IYger6SxuALViRDri9sOzCTQ6 AfdEjeOyuZC0/ALqpHG4AfyN7KQ+nCMVYPaKgIEihQqj+28mCONjBIwIZbv2poWtB f0vYd0rAhCT2GDKIf9TK35uH1iPR0ZiTC6+GbhQPBxsFRcwSjDRe3gxj5qXS8+kBU 4KFlXycENwmF3idmLA== X-UI-Sender-Class: 55c96926-9e95-11ee-ae09-1f7a4046a0f6 Received: from localhost ([69.171.251.21]) by mrelay.perfora.net (mreueus003 [74.208.5.2]) with ESMTPSA (Nemesis) id 0MHVog-1tegXl2DWe-000X2F; Fri, 24 Jan 2025 19:16:09 +0100 From: Jordan Rome To: bpf@vger.kernel.org Cc: linux-mm@kvack.org, Alexei Starovoitov , Daniel Borkmann , Andrii Nakryiko , Kernel Team , Andrew Morton , Shakeel Butt , Alexander Potapenko Subject: [bpf-next v3 1/3] mm: add copy_remote_vm_str Date: Fri, 24 Jan 2025 10:16:00 -0800 Message-ID: <20250124181602.1872142-1-linux@jordanrome.com> X-Mailer: git-send-email 2.43.5 Precedence: bulk X-Mailing-List: bpf@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Provags-ID: V03:K1:aN627SuLhjaIjqrJzCgctnzWbHzLjJyMe1aVh1V6WI5NYAcFzNw ldODKGOaIFpbthhCKD6LEgQ1JQZCFzWLyoXwdXYHyIL+0wv/9Vf7Ua82jXyqmCjhw7tArGS fhoxyagyJWERY7esMKb+EHdJATLH+W6q3LgznzoRb0fEm+29ueoB0DoEGBSsLfXdzEQ1Qbe u4u1n19/YDTuW+rZhKfrg== X-Spam-Flag: NO UI-OutboundReport: notjunk:1;M01:P0:HHPzqcsjC08=;G76sFteiqH8SCHuonPXk1b1lz8o 0Rq8Umz0Pd4QrzArMg/vuZOhlj1YVhUDEL0sGkSiDoDMPo/d2Zs79Zw8RUmYLduIZ5kx+Tt5x 0NAN9xDSaIesDzukiKgUQTQRHoPorz/eikgnpRqIdW2QF5dJxWDgm3VaR2RKuE1ILCDwz0XK/ xGzAb5yTpCXWnL7m6loSfW6m7IVK6QLNgUuctL5WdAOaYseBBE6FVAxxbt6wwICukc2hSsIHD tKDe97T4lRJHkNKk4lz/Csv0PGBfoe4R+DR+se6GUwae3CGySgURk5T9/TOxb0kLI2y2G/BOc yD2uIWxbxo+hxHvyopz1WSge/VL+0I7HqFcC8VtrrIBurMcQS/Ym2KFZQNP4VWe8ldMsaz2RE 2o0slD5ZLGYtC3PHwc69IP0XptGSmUxfB4OWKb+hioUgRk87jiXFq51DrXrsscjCk31J3SXOv 3NfYGkdK/GdnEszMYTAHCTv1g9i66mH37H2XzVw/fKzdKkETixzAIC6qrGDkDXhWZ2/0uU9i5 l7YKFZACxs26/KULkRRIXHtVINy4ahig9+H0c+UuqepFiP2rzMPPacqCd6yVNEiXJo4WY9LYa 1+XP4kzCDZBQbyIHMyiO2Hm4fzFgYRAbHqYhAP5DW98wTO9AD8fU+NZfO43Jk1mB95DWK1zCP YylHNOhg6WqZAqlzKYEmenh3jURU7RDpqSn1ETA3+6B9XceS+djLpoO3TQwjB2vUJMp6iTOYI Jw3fOkIBkQuw/iE/rtBoaZmyp7+XE4MxwEt74pAONU3xy0951GpA+iBymc4YOkPsvXpNpExV5 N0peGRvY5PlqtUMS1due/GD6jwuaG/MLhIyvvZuZbwb9UA4NpdQJIhYTnqfMSzRc9V//xhLxJ XlUPnfdOne1r/0YwulkBjsA9zWnlkrLcgqvi0HdVp+JxOdYjPn00YMSy86tahxfiTsiSgQy9p kozrZm4Vf49AgLvd/uNBzWhlcST7XI0HSljeUAGbWTjbWHb54bVgmo+dErgtkls7ClanThQHc 0L5yT98U0cR59Lp3rzKOQbEsv0syETygQHN68jzyl+LEWYeVTKENTfUwGRubgSA4JzJJBoy6j 1kT+YYzUhn9qvvOnYEOBPYVO+VT+xx67Nf/0y4bVASftj+mkQH/2rtznQ8M8ZUFzVCSQjRHx8 igUQ6v26NomVO3XPLz/NS4Vs6U3lyQNdG/W3PUvMNemnTMkJDkRaDyPv06kzkKIlXYgxPvjCt 59ZHU4xeBUKrBNCE5qQN7/CXRkXtACC0bw== X-Patchwork-Delegate: bpf@iogearbox.net Similar to `access_process_vm` but specific to strings. Also chunks reads by page and utilizes `strscpy` for handling null termination. Signed-off-by: Jordan Rome --- include/linux/mm.h | 3 ++ mm/memory.c | 119 +++++++++++++++++++++++++++++++++++++++++++++ mm/nommu.c | 68 ++++++++++++++++++++++++++ 3 files changed, 190 insertions(+) -- 2.43.5 diff --git a/include/linux/mm.h b/include/linux/mm.h index f02925447e59..f3a05b3eb2f2 100644 --- a/include/linux/mm.h +++ b/include/linux/mm.h @@ -2485,6 +2485,9 @@ extern int access_process_vm(struct task_struct *tsk, unsigned long addr, extern int access_remote_vm(struct mm_struct *mm, unsigned long addr, void *buf, int len, unsigned int gup_flags); +extern int copy_remote_vm_str(struct task_struct *tsk, unsigned long addr, + void *buf, int len, unsigned int gup_flags); + long get_user_pages_remote(struct mm_struct *mm, unsigned long start, unsigned long nr_pages, unsigned int gup_flags, struct page **pages, diff --git a/mm/memory.c b/mm/memory.c index 398c031be9ba..905e3f10fad0 100644 --- a/mm/memory.c +++ b/mm/memory.c @@ -6714,6 +6714,125 @@ int access_process_vm(struct task_struct *tsk, unsigned long addr, } EXPORT_SYMBOL_GPL(access_process_vm); +/* + * Copy a string from another process's address space as given in mm. + * If there is any error return -EFAULT. + */ +static int __copy_remote_vm_str(struct mm_struct *mm, unsigned long addr, + void *buf, int len, unsigned int gup_flags) +{ + void *old_buf = buf; + int err = 0; + + if (mmap_read_lock_killable(mm)) + return -EFAULT; + + /* Untag the address before looking up the VMA */ + addr = untagged_addr_remote(mm, addr); + + /* Avoid triggering the temporary warning in __get_user_pages */ + if (!vma_lookup(mm, addr)) { + err = -EFAULT; + goto out; + } + + while (len) { + int bytes, offset, retval, end; + void *maddr; + struct page *page; + struct vm_area_struct *vma = NULL; + + page = get_user_page_vma_remote(mm, addr, gup_flags, &vma); + + if (IS_ERR(page)) { + /* + * Treat as a total failure for now until we decide how + * to handle the CONFIG_HAVE_IOREMAP_PROT case and + * stack expansion. + */ + err = -EFAULT; + goto out; + } + + bytes = len; + offset = addr & (PAGE_SIZE - 1); + if (bytes > PAGE_SIZE - offset) + bytes = PAGE_SIZE - offset; + + maddr = kmap_local_page(page); + retval = strscpy(buf, maddr + offset, bytes); + unmap_and_put_page(page, maddr); + + if (retval > -1 && retval < bytes) { + /* found the end of the string */ + buf += retval; + goto out; + } + + if (retval == -E2BIG) { + retval = bytes; + /* + * Because strscpy always null terminates we need to + * copy the last byte in the page if we are going to + * load more pages + */ + if (bytes < len) { + end = bytes - 1; + copy_from_user_page(vma, + page, + addr + end, + buf + end, + maddr + (PAGE_SIZE - 1), + 1); + } + } + + len -= retval; + buf += retval; + addr += retval; + } + +out: + mmap_read_unlock(mm); + if (err) + return err; + + return buf - old_buf; +} + +/** + * copy_remote_vm_str - copy a string from another process's address space. + * @tsk: the task of the target address space + * @addr: start address to read from + * @buf: destination buffer + * @len: number of bytes to transfer + * @gup_flags: flags modifying lookup behaviour + * + * The caller must hold a reference on @mm. + * + * Return: number of bytes copied from @addr (source) to @buf (destination). + * If the source string is shorter than @len then return the length of the + * source string. If the source string is longer than @len, return @len. + * On any error, return -EFAULT. + */ +int copy_remote_vm_str(struct task_struct *tsk, unsigned long addr, + void *buf, int len, unsigned int gup_flags) +{ + struct mm_struct *mm; + int ret; + + mm = get_task_mm(tsk); + if (!mm) + return -EFAULT; + + ret = __copy_remote_vm_str(mm, addr, buf, len, gup_flags); + + mmput(mm); + + return ret; +} +EXPORT_SYMBOL_GPL(copy_remote_vm_str); + /* * Print the name of a VMA. */ diff --git a/mm/nommu.c b/mm/nommu.c index 9cb6e99215e2..23281751b1eb 100644 --- a/mm/nommu.c +++ b/mm/nommu.c @@ -1701,6 +1701,74 @@ int access_process_vm(struct task_struct *tsk, unsigned long addr, void *buf, in } EXPORT_SYMBOL_GPL(access_process_vm); +/* + * Copy a string from another process's address space as given in mm. + * If there is any error return -EFAULT. + */ +static int __copy_remote_vm_str(struct mm_struct *mm, unsigned long addr, + void *buf, int len) +{ + int ret = 0; + + if (mmap_read_lock_killable(mm)) + return -EFAULT; + + /* the access must start within one of the target process's mappings */ + vma = find_vma(mm, addr); + if (vma) { + /* don't overrun this mapping */ + if (addr + len >= vma->vm_end) + len = vma->vm_end - addr; + + /* only read mappings where it is permitted */ + if (vma->vm_flags & VM_MAYREAD) { + ret = strscpy(buf, addr, len); + if (ret == -E2BIG) + ret = len; + } else { + ret = -EFAULT; + } + } else { + ret = -EFAULT; + } + + mmap_read_unlock(mm); + return ret; +} + +/** + * copy_remote_vm_str - copy a string from another process's address space. + * @tsk: the task of the target address space + * @addr: start address to read from + * @buf: destination buffer + * @len: number of bytes to transfer + * @gup_flags: flags modifying lookup behaviour (unused) + * + * The caller must hold a reference on @mm. + * + * Return: number of bytes copied from @addr (source) to @buf (destination). + * If the source string is shorter than @len then return the length of the + * source string. If the source string is longer than @len, return @len. + * On any error, return -EFAULT. + */ +int copy_remote_vm_str(struct task_struct *tsk, unsigned long addr, + void *buf, int len, unsigned int gup_flags) +{ + struct mm_struct *mm; + int ret; + + mm = get_task_mm(tsk); + if (!mm) + return -EFAULT; + + ret = __copy_remote_vm_str(mm, addr, buf, len); + + mmput(mm); + + return ret; +} +EXPORT_SYMBOL_GPL(copy_remote_vm_str); + /** * nommu_shrink_inode_mappings - Shrink the shared mappings on an inode * @inode: The inode to check From patchwork Fri Jan 24 18:33:02 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jordan Rome X-Patchwork-Id: 13949819 X-Patchwork-Delegate: bpf@iogearbox.net Received: from mout.perfora.net (mout.perfora.net [74.208.4.196]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6EF6F1CEE8E for ; Fri, 24 Jan 2025 18:33:10 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.208.4.196 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1737743593; cv=none; b=QI7OrIpVEQOSljitO/3IeG1QYUSNBlLZFU+x1fkgfJzwXhD1fHeL3M4kR469/3bmrHHE9keuMOuJROZltfEUQp0iHrtCoKQHzlJKq3AaIjLhuk0bXd6AoNDQsxm435ZpiwbU6HX0TnhvF3ZYDPibXwXCJM6J8OEPKz1o0TEgwok= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1737743593; c=relaxed/simple; bh=fEZYj59eSkdv8nLG6sXuX8A+LRPb1BRwGXlBkI5CXN4=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=JIVbllwf1hUyPA2W5jVfZ4GWJK3CYvxX/rdKsV5zUQ+Poer2ygABWeve0KuTra+IXtqmhB8hGwLzhL1YDYiLgjQ8pn+FZURb5kp2xxVHvdB7rJb/2ELAmkp7PYucMSlguNpOytyCsn2+SJ9Zm9dXhHV4/AIf6PAGcMkg/bymZqY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=jordanrome.com; spf=pass smtp.mailfrom=jordanrome.com; dkim=pass (2048-bit key) header.d=jordanrome.com header.i=linux@jordanrome.com header.b=XAGxtQfm; arc=none smtp.client-ip=74.208.4.196 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=jordanrome.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=jordanrome.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=jordanrome.com header.i=linux@jordanrome.com header.b="XAGxtQfm" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=jordanrome.com; s=s1-ionos; t=1737743589; x=1738348389; i=linux@jordanrome.com; bh=vN1sWSdQGaxq1WTOtCMw7Lms9Q+CJ/CADJP+cD3MASg=; h=X-UI-Sender-Class:From:To:Cc:Subject:Date:Message-ID: MIME-Version:Content-Transfer-Encoding:cc: content-transfer-encoding:content-type:date:from:message-id: mime-version:reply-to:subject:to; b=XAGxtQfmSln+YVeISGZBzIEf/+HTaoY+RXxwEv+T0WTPxCrM4j7gdsqKTw80oMwn qEUv+vOHScb15awfwS8492y61q6eyAnjEDIxgmg1dbIBaQv1XkcFflLUwrIqP5Z2G v4v2Vd34eW/iALnAWpfqXfIQ4L/smGPrK2+daO8zUBB6r0S9CpxfdoFG3sYxfMWVD ucnFAFWKiK2nk2nCsQvEWTunH4UD78Tu6A1n37kYWGlELb+aniF/gZJDdYIabeEXj vUeORyXG0iqgEkgJyZnf2UmLq486CViqi4mJmgBu+WIl+xWF8/rp4TJNDW3ZLrkoL UMxH/orWLRW9BmYn9Q== X-UI-Sender-Class: 55c96926-9e95-11ee-ae09-1f7a4046a0f6 Received: from localhost ([69.171.251.25]) by mrelay.perfora.net (mreueus003 [74.208.5.2]) with ESMTPSA (Nemesis) id 0LcRm4-1tBRK70mvO-00l7eS; Fri, 24 Jan 2025 19:33:09 +0100 From: Jordan Rome To: bpf@vger.kernel.org Cc: linux-mm@kvack.org, Alexei Starovoitov , Daniel Borkmann , Andrii Nakryiko , Kernel Team , Andrew Morton , Shakeel Butt , Alexander Potapenko Subject: [bpf-next v3 2/3] bpf: Add bpf_copy_from_user_task_str kfunc Date: Fri, 24 Jan 2025 10:33:02 -0800 Message-ID: <20250124183303.2019147-1-linux@jordanrome.com> X-Mailer: git-send-email 2.43.5 Precedence: bulk X-Mailing-List: bpf@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Provags-ID: V03:K1:A3DOnrZMBegsQsDQ07SD4gwqnYeAUC7z3LkazmDkP/9nz+99BU2 s/Dlf9iMtEhxUl7aRpzeB9lsWzzmkX+ycQbIjG6WqMtX+SWrIhflmLH2/5d0DwbCiWuYaOQ WS1AluKlWid823HDt5BQHi+UpQ/EHqvdMBeeRhzHgQQmBkHpBOfrZiXfxtQiG8PGLWx8MHC JjPI+FgtxErW8SlLYmvbA== X-Spam-Flag: NO UI-OutboundReport: notjunk:1;M01:P0:x6k/9Ven3Rg=;ytk0ZHTMf+L6t5x4vPikYFk/88+ D8Ov2R9KgEkjqKbscTL/ppcnHDR26YGsSiFts5SdHFiRRm0Fsolajg9yKfPCDRthKlFxraVBh bWi8X03MlWvIGil+rtUaIRv1y+/iC61/81TOi1KrglURmj46/120TCOqLz/h9uaYW3ALAkSOQ I5P7SYiu1WfII/pk0Uaaj1HOum3rCZB5+oTl0dcb9vIdqDlNOkENvOxdmI+bKvWMbyDsW4c8T x5OAMXgxOtKMwwDlxsqpsUuJOmkor8qA+/pyT5hC/+t8zrJHJTBZm+MAV1RyHMAr+5ZF3418/ hYEkQRPK7Trbhcsy7uDiukcR/qA4H79+BGrzSqi1X3klx1e9aHjFlOIv53NuIlEFwLJnWVCz/ F5fkcXMBLFF52t/j6/sNhdCb+rehRimeTgmOpUH0JdMlZoUg2W5U+INI+FlZ2jia0/cp8+JcV bmUIUrwCYoTk7t7bpd2sMfOqShL8OIDyCPAhXeY6K9Gdrxcln3YH9tVvmhrynnZ38rr1zqHXJ X6fiftbH5AU24t9mPhdRNEL2cxiuDuQzcEo1MFv5haZ4nvSmk1KjQQvS3FuK9HrT5nUbgowEc aY3fAe4q7XPSm9mbxIZcjLurp8cMEZPCHgXeS838kGGznQbZzpijrx/iDOr/V+9pv21lYW76K RfjZ3ikhHKoZBN79F1EESIJEKm6l9G3rJHG2eljFvg7bUjvODk7Jfz95PJllxiUkRvuv/bwEd XAtwpYHGWv+xy1RCG4/zI2Ofv7sjeM7sVHXmPUP4eZD/tLSq68Cjk8wWwY7rpZcx0swYryLtt crUG12kC63+gYw8iCQMCZbTX3bpKa+13pqdYCPcLqaWoNBDVgP6cdQNqkjMwlOJNg+fBmnfdb UApUpqhWRXVblwZ/X+M9NQLVCt53RGrheF8sCTkL0IMNuapBVtukXSxTta7rhw3q33AqSqa5J +KJgg+TOQJsjHCBBJ7USUgRcotUvtONXyhYFXTdmFbbyuv59Z4aXgdAbKxDW3uqaplTn/6Wai 3M2drKTgHqzNoAuoHHpYa5a9q16jSNZrJOfWfOZ6XpDT/CxSwqduSysq+UnWzC/18UGDxwevm CjGOf9n5iVlbvodn5jd6do00SkKinNumR6YnxnakXnaSvtGwR3sFMD55czcGE20ctGZNDSM0j pexo5TnvynaxEINYSsIqhndk9jxYpT3CI0GWl3yDGXYarg7y27MuYScC19h3n2GtX1ztYgP1d zXuOsUpmufpEH1G6OwCcyBqdb8SKl9skjg== X-Patchwork-Delegate: bpf@iogearbox.net This new kfunc will be able to copy a string from another process's/task's address space. This is similar to `bpf_copy_from_user_str` but accepts a `struct task_struct*` argument. Signed-off-by: Jordan Rome Acked-by: Andrii Nakryiko --- kernel/bpf/helpers.c | 51 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 51 insertions(+) -- 2.43.5 diff --git a/kernel/bpf/helpers.c b/kernel/bpf/helpers.c index f27ce162427a..c26fabf97afd 100644 --- a/kernel/bpf/helpers.c +++ b/kernel/bpf/helpers.c @@ -3082,6 +3082,56 @@ __bpf_kfunc void bpf_local_irq_restore(unsigned long *flags__irq_flag) local_irq_restore(*flags__irq_flag); } +/** + * bpf_copy_from_user_task_str() - Copy a string from an task's address space + * @dst: Destination address, in kernel space. This buffer must be + * at least @dst__sz bytes long. + * @dst__sz: Maximum number of bytes to copy, includes the trailing NUL. + * @unsafe_ptr__ign: Source address in the task's address space. + * @tsk: The task whose address space will be used + * @flags: The only supported flag is BPF_F_PAD_ZEROS + * + * Copies a NULL-terminated string from a task's address space to *dst* buffer. + * If user string is too long this will still ensure zero termination in the + * dst buffer unless buffer size is 0. + * + * If BPF_F_PAD_ZEROS flag is set, memset the tail of @dst to 0 on success and + * memset all of @dst on failure. + * + * Return: The number of copied bytes on success, including the NULL-terminator. + * A negative error code on failure. + */ +__bpf_kfunc int bpf_copy_from_user_task_str(void *dst, + u32 dst__sz, + const void __user *unsafe_ptr__ign, + struct task_struct *tsk, + u64 flags) +{ + int ret = 0; + + if (unlikely(flags & ~BPF_F_PAD_ZEROS)) + return -EINVAL; + + if (unlikely(!dst__sz)) + return 0; + + ret = copy_remote_vm_str(tsk, (unsigned long)unsafe_ptr__ign, dst, dst__sz, 0); + + if (ret <= 0) { + if (flags & BPF_F_PAD_ZEROS) + memset(dst, 0, dst__sz); + return ret ?: -EINVAL; + } + + if (ret < dst__sz) { + if (flags & BPF_F_PAD_ZEROS) + memset(dst + ret, 0, dst__sz - ret); + return ret + 1; + } + + return ret; +} + __bpf_kfunc_end_defs(); BTF_KFUNCS_START(generic_btf_ids) @@ -3174,6 +3224,7 @@ BTF_ID_FLAGS(func, bpf_iter_bits_new, KF_ITER_NEW) BTF_ID_FLAGS(func, bpf_iter_bits_next, KF_ITER_NEXT | KF_RET_NULL) BTF_ID_FLAGS(func, bpf_iter_bits_destroy, KF_ITER_DESTROY) BTF_ID_FLAGS(func, bpf_copy_from_user_str, KF_SLEEPABLE) +BTF_ID_FLAGS(func, bpf_copy_from_user_task_str, KF_SLEEPABLE) BTF_ID_FLAGS(func, bpf_get_kmem_cache) BTF_ID_FLAGS(func, bpf_iter_kmem_cache_new, KF_ITER_NEW | KF_SLEEPABLE) BTF_ID_FLAGS(func, bpf_iter_kmem_cache_next, KF_ITER_NEXT | KF_RET_NULL | KF_SLEEPABLE) From patchwork Fri Jan 24 18:33:03 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jordan Rome X-Patchwork-Id: 13949820 X-Patchwork-Delegate: bpf@iogearbox.net Received: from mout.perfora.net (mout.perfora.net [74.208.4.196]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7E47123B0 for ; Fri, 24 Jan 2025 18:33:28 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.208.4.196 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1737743610; cv=none; b=ifmU1D1Zyudf+L6rkGT9VBwTXa+SsYi9sf7YBHlwwFIayJC1y7XdDbqYnb01b3V2YRYXpar7NOBBvaMT/j7w/V/Zq5qz+NKakNKzJLwDSTNtoY74wDsLvg60oGu6i81OVbj1gT5Rvj9S0wSTscCfpg6cwUpg5HXHwiMHM2SesDQ= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1737743610; c=relaxed/simple; bh=6OetfNGlQPA7bF/31cowEceSmUN864flsc70y//RuOU=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=DN2CxP9QOzU6tbhNDCgfBy+v2VbLu0RuuwF5rZFuIWN/FGAIxmUm6DVjVixBV+U0Xnrkrrtg+Zraz5cehco6wlEsYuyFT8TZXORMuJ6BvCzsXJHBqBteFYevsbhwBEqg75oUvn9Jf6WYPrukEn2vlf5Kve8L0WKzgEn5U4WdtE8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=jordanrome.com; spf=pass smtp.mailfrom=jordanrome.com; dkim=pass (2048-bit key) header.d=jordanrome.com header.i=linux@jordanrome.com header.b=CP0mGe2k; arc=none smtp.client-ip=74.208.4.196 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=jordanrome.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=jordanrome.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=jordanrome.com header.i=linux@jordanrome.com header.b="CP0mGe2k" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=jordanrome.com; s=s1-ionos; t=1737743593; x=1738348393; i=linux@jordanrome.com; bh=CIo1HKNRd5SU/EePwl2u9+/j6C3koqMMEyXcI7WTJYA=; h=X-UI-Sender-Class:From:To:Cc:Subject:Date:Message-ID:In-Reply-To: References:MIME-Version:Content-Transfer-Encoding:cc: content-transfer-encoding:content-type:date:from:message-id: mime-version:reply-to:subject:to; b=CP0mGe2klQy9gKrznC1GQtr7pXduN6Cd48fjo+tOj7KW2iHF+yfij0T2F1HTiV9w MyySou11mP3+XtbRAqGiX+WJ0IC9tQ8P8tzZ584qyq0uRbRTbs9C0XwW8atjtMnOA AqK5RY7AAEhWvWMrJBvsT+mFC95+xWL7hmpSGvTpSM1m0CWFepeZvF1Ex7Q0PQdO2 +7V7ugcJcew4vsb5JzsrvT2bI6FxMFL3IEC5hNNxUva9oaVlBTQ1ILdUTTvhFtr0J SOSE8vFdJuxcOJY2e6lPk76rIJTbj8axGhswvn7cMtYnMh6ph47wNCEYcxLOMzIKc ishHeFqJpfsmMWYXAw== X-UI-Sender-Class: 55c96926-9e95-11ee-ae09-1f7a4046a0f6 Received: from localhost ([69.171.251.30]) by mrelay.perfora.net (mreueus002 [74.208.5.2]) with ESMTPSA (Nemesis) id 0MWlFl-1tyi5z3EHz-00I128; Fri, 24 Jan 2025 19:33:12 +0100 From: Jordan Rome To: bpf@vger.kernel.org Cc: linux-mm@kvack.org, Alexei Starovoitov , Daniel Borkmann , Andrii Nakryiko , Kernel Team , Andrew Morton , Shakeel Butt , Alexander Potapenko Subject: [bpf-next v3 3/3] selftests/bpf: Add tests for bpf_copy_from_user_task_str Date: Fri, 24 Jan 2025 10:33:03 -0800 Message-ID: <20250124183303.2019147-2-linux@jordanrome.com> X-Mailer: git-send-email 2.43.5 In-Reply-To: <20250124183303.2019147-1-linux@jordanrome.com> References: <20250124183303.2019147-1-linux@jordanrome.com> Precedence: bulk X-Mailing-List: bpf@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Provags-ID: V03:K1:WfqbFLPdYyNudQtsm1yh/2tFoS3iCnwEbzAyw3rPVOirMuR2YUi sXqN1JtLOow+sVqSGcfVpbh1c+5TfXyEfjoaCLQuySnYFPurxIAHjzVNI2D1vPtBbgqn2LX O+P4sdNZB1E8g4KiyMZ1+eaZhJulVF+phtZhiUkuE98GChRl7PO+aVfumRJt6KlYyEdFRvR edD5pl7z72OEpH9+PD4qQ== X-Spam-Flag: NO UI-OutboundReport: notjunk:1;M01:P0:Nfc8MBLV+1o=;ePVf57x9BMm4fhnnhPhYeBwHIJn yQiDHQxknAecuaiJT3MuRHV4PJCwMub0lEgFomVjbPTC0+c3S0MjVpjlMmR0WY05O695jzTmT WauNlJdjzTD3rBQI8aDaGg+MpOWjyGwC3FC96MehF9gtgUMR+5m5l1HY8tSgF8OV+BBGugHUG 2iSNt7Mlr1e3l2+fm6YtN3muDD7Pwm8T1CX0o3A1LeAvt4LVsMBeQuzXB+Wz57bberBPYwSb6 awtaz7xN35CWfVdq8+fpIGUU3VXkGf1sSP+fi0QQv2YxMJo13oC3soHWjSN5qmreEXWJWqzdJ QIsQ9s6Dk3sP4a475ObKuviAV/sEgFK+7L85UxsOuS0a+UxXnCxSkFgiHspDsHn/FwMXCI9Ib 1a54EIS4NoijwNjCHLTGe1AuhhC68WlwHhcoHh8z1lRzVI1Zw/r+/eRmJmn41rve0I6vNqBHi EH/sHyRmGQE/Pv8xv8rupPV7Ouzi5vYogH18sR2bDulNy5QX+YKo7hOgYQEx4oSs5dpivY7Nh TLtxBL+0ryyyZa5fRgRHpbN94VCIDU41+Y8Vvrrqi7c1igjDU5HT2iseW+vWYmmqzi24tiV/o /yLWgMGsxKKWkJ6IHRLzjKa1KHzm/Upn/SKoKYXIeVHiNGZuCXluOSl8gZfGfN4PKt/nemSms A/DwC8yAu3aQc/Pi6WgPfqACL3YKF1w1STmST83T2rttgoqOY8AtR2tg3+oNYwg+aDn9HOZKn zPT9UY/8lsLWGdx/dicapPWKJ+LuME/MR1ZiXZGPQBSIsXpmoVWzk1x9kUdSiQbpv7Jy6UUxi w0bX8GpYn5yc5QFpPGXnp61UN1tOr7FE3W3p+M+NfcxJ5bYhOpE17HV94zz9f8bEdENZrjQAK Z28kEvrOkH586ftsjwUqKt3ojyrgkcApDQG2P0qS4KNhXmHubjCXp4qMJ/jtHXDQbnZVstAwi yeSIecYqPgeoQdc9DyYIF+kooj7OUKDm8zmADuUd/EQo4K9S6WSkQu4tMlu7vzsww8ni/qAkv 0Kwgqjz1lC6lEMSMZ6ylaTZwt1Yn5mo6V7EDo5L4mtEMyOqzp0DM9ufXxoWR+Bcl+Hk+tuYRR 4Z+UeobPbj3caPK8CTr2S7EYyHSLbVmqNLyT14R8TdjqqCA5cFzD9IBElsgyzxGxsKN2QJSim /1/W8EfYIbPEIBmYOo05/FisZzsbapHX4X1a/Kxz6VRYTH3QTjNJJq7sL8xghX9CUc2wZxF5F ojYQkZ8aVZLW0PdFPVAeTcDSqCEU60zUKg== X-Patchwork-Delegate: bpf@iogearbox.net This adds tests for both the happy path and the error path (with and without the BPF_F_PAD_ZEROS flag). Signed-off-by: Jordan Rome --- .../selftests/bpf/prog_tests/bpf_iter.c | 68 ++++++++++++ .../selftests/bpf/prog_tests/read_vsyscall.c | 1 + .../selftests/bpf/progs/bpf_iter_tasks.c | 103 ++++++++++++++++++ .../selftests/bpf/progs/read_vsyscall.c | 11 +- 4 files changed, 181 insertions(+), 2 deletions(-) -- 2.43.5 diff --git a/tools/testing/selftests/bpf/prog_tests/bpf_iter.c b/tools/testing/selftests/bpf/prog_tests/bpf_iter.c index 6f1bfacd7375..add4a18c33bd 100644 --- a/tools/testing/selftests/bpf/prog_tests/bpf_iter.c +++ b/tools/testing/selftests/bpf/prog_tests/bpf_iter.c @@ -323,19 +323,87 @@ static void test_task_pidfd(void) static void test_task_sleepable(void) { struct bpf_iter_tasks *skel; + int pid, status, err, data_pipe[2], finish_pipe[2], c; + char *test_data = NULL; + char *test_data_long = NULL; + char *data[2]; + + if (!ASSERT_OK(pipe(data_pipe), "data_pipe") || + !ASSERT_OK(pipe(finish_pipe), "finish_pipe")) + return; skel = bpf_iter_tasks__open_and_load(); if (!ASSERT_OK_PTR(skel, "bpf_iter_tasks__open_and_load")) return; + pid = fork(); + if (!ASSERT_GE(pid, 0, "fork")) + return; + + if (pid == 0) { + /* child */ + close(data_pipe[0]); + close(finish_pipe[1]); + + test_data = malloc(sizeof(char) * 10); + strncpy(test_data, "test_data", 10); + test_data[9] = '\0'; + + test_data_long = malloc(sizeof(char) * 5000); + for (int i = 0; i < 5000; ++i) { + if (i % 2 == 0) + test_data_long[i] = 'b'; + else + test_data_long[i] = 'a'; + } + test_data_long[4999] = '\0'; + + data[0] = test_data; + data[1] = test_data_long; + + write(data_pipe[1], &data, sizeof(data)); + + /* keep child alive until after the test */ + err = read(finish_pipe[0], &c, 1); + if (err != 1) + exit(-1); + + close(data_pipe[1]); + close(finish_pipe[0]); + _exit(0); + } + + /* parent */ + close(data_pipe[1]); + close(finish_pipe[0]); + + err = read(data_pipe[0], &data, sizeof(data)); + ASSERT_EQ(err, sizeof(data), "read_check"); + + skel->bss->user_ptr = data[0]; + skel->bss->user_ptr_long = data[1]; + skel->bss->pid = pid; + do_dummy_read(skel->progs.dump_task_sleepable); ASSERT_GT(skel->bss->num_expected_failure_copy_from_user_task, 0, "num_expected_failure_copy_from_user_task"); ASSERT_GT(skel->bss->num_success_copy_from_user_task, 0, "num_success_copy_from_user_task"); + ASSERT_GT(skel->bss->num_expected_failure_copy_from_user_task_str, 0, + "num_expected_failure_copy_from_user_task_str"); + ASSERT_GT(skel->bss->num_success_copy_from_user_task_str, 0, + "num_success_copy_from_user_task_str"); bpf_iter_tasks__destroy(skel); + + write(finish_pipe[1], &c, 1); + err = waitpid(pid, &status, 0); + ASSERT_EQ(err, pid, "waitpid"); + ASSERT_EQ(status, 0, "zero_child_exit"); + + close(data_pipe[0]); + close(finish_pipe[1]); } static void test_task_stack(void) diff --git a/tools/testing/selftests/bpf/prog_tests/read_vsyscall.c b/tools/testing/selftests/bpf/prog_tests/read_vsyscall.c index c7b9ba8b1d06..a8d1eaa67020 100644 --- a/tools/testing/selftests/bpf/prog_tests/read_vsyscall.c +++ b/tools/testing/selftests/bpf/prog_tests/read_vsyscall.c @@ -24,6 +24,7 @@ struct read_ret_desc { { .name = "copy_from_user", .ret = -EFAULT }, { .name = "copy_from_user_task", .ret = -EFAULT }, { .name = "copy_from_user_str", .ret = -EFAULT }, + { .name = "copy_from_user_task_str", .ret = -EFAULT }, }; void test_read_vsyscall(void) diff --git a/tools/testing/selftests/bpf/progs/bpf_iter_tasks.c b/tools/testing/selftests/bpf/progs/bpf_iter_tasks.c index bc10c4e4b4fa..e4b80260e9c5 100644 --- a/tools/testing/selftests/bpf/progs/bpf_iter_tasks.c +++ b/tools/testing/selftests/bpf/progs/bpf_iter_tasks.c @@ -9,6 +9,13 @@ char _license[] SEC("license") = "GPL"; uint32_t tid = 0; int num_unknown_tid = 0; int num_known_tid = 0; +void *user_ptr = 0; +void *user_ptr_long = 0; +uint32_t pid = 0; + +static char big_str1[5000]; +static char big_str2[5005]; +static char big_str3[4996]; SEC("iter/task") int dump_task(struct bpf_iter__task *ctx) @@ -35,7 +42,9 @@ int dump_task(struct bpf_iter__task *ctx) } int num_expected_failure_copy_from_user_task = 0; +int num_expected_failure_copy_from_user_task_str = 0; int num_success_copy_from_user_task = 0; +int num_success_copy_from_user_task_str = 0; SEC("iter.s/task") int dump_task_sleepable(struct bpf_iter__task *ctx) @@ -44,6 +53,9 @@ int dump_task_sleepable(struct bpf_iter__task *ctx) struct task_struct *task = ctx->task; static const char info[] = " === END ==="; struct pt_regs *regs; + char task_str1[10] = "aaaaaaaaaa"; + char task_str2[10], task_str3[10]; + char task_str4[20] = "aaaaaaaaaaaaaaaaaaaa"; void *ptr; uint32_t user_data = 0; int ret; @@ -78,8 +90,99 @@ int dump_task_sleepable(struct bpf_iter__task *ctx) BPF_SEQ_PRINTF(seq, "%s\n", info); return 0; } + ++num_success_copy_from_user_task; + /* Read an invalid pointer and ensure we get an error */ + ptr = NULL; + ret = bpf_copy_from_user_task_str((char *)task_str1, sizeof(task_str1), ptr, task, 0); + if (ret >= 0 || task_str1[9] != 'a') { + BPF_SEQ_PRINTF(seq, "%s\n", info); + return 0; + } + + /* Read an invalid pointer and ensure we get error with pad zeros flag */ + ptr = NULL; + ret = bpf_copy_from_user_task_str((char *)task_str1, sizeof(task_str1), + ptr, task, BPF_F_PAD_ZEROS); + if (ret >= 0 || task_str1[9] != '\0') { + BPF_SEQ_PRINTF(seq, "%s\n", info); + return 0; + } + + ++num_expected_failure_copy_from_user_task_str; + + /* Same length as the string */ + ret = bpf_copy_from_user_task_str((char *)task_str2, 10, user_ptr, task, 0); + /* only need to do the task pid check once */ + if (bpf_strncmp(task_str2, 10, "test_data\0") != 0 || ret != 10 || task->tgid != pid) { + BPF_SEQ_PRINTF(seq, "%s\n", info); + return 0; + } + + /* Shorter length than the string */ + ret = bpf_copy_from_user_task_str((char *)task_str3, 2, user_ptr, task, 0); + if (bpf_strncmp(task_str3, 2, "t\0") != 0 || ret != 2) { + BPF_SEQ_PRINTF(seq, "%s\n", info); + return 0; + } + + /* Longer length than the string */ + ret = bpf_copy_from_user_task_str((char *)task_str4, 20, user_ptr, task, 0); + if (bpf_strncmp(task_str4, 10, "test_data\0") != 0 || ret != 10 + || task_str4[sizeof(task_str4) - 1] != 'a') { + BPF_SEQ_PRINTF(seq, "%s\n", info); + return 0; + } + + /* Longer length than the string with pad zeros flag */ + ret = bpf_copy_from_user_task_str((char *)task_str4, 20, user_ptr, task, BPF_F_PAD_ZEROS); + if (bpf_strncmp(task_str4, 10, "test_data\0") != 0 || ret != 10 + || task_str4[sizeof(task_str4) - 1] != '\0') { + BPF_SEQ_PRINTF(seq, "%s\n", info); + return 0; + } + + /* String that crosses a page boundary */ + ret = bpf_copy_from_user_task_str(big_str1, 5000, user_ptr_long, task, BPF_F_PAD_ZEROS); + if (bpf_strncmp(big_str1, 4, "baba") != 0 || ret != 5000 + || bpf_strncmp(big_str1 + 4996, 4, "bab\0") != 0) { + BPF_SEQ_PRINTF(seq, "%s\n", info); + return 0; + } + + for (int i = 0; i < 4999; ++i) { + if (i % 2 == 0) { + if (big_str1[i] != 'b') { + BPF_SEQ_PRINTF(seq, "%s\n", info); + return 0; + } + } else { + if (big_str1[i] != 'a') { + BPF_SEQ_PRINTF(seq, "%s\n", info); + return 0; + } + } + } + + /* Longer length than the string that crosses a page boundary */ + ret = bpf_copy_from_user_task_str(big_str2, 5005, user_ptr_long, task, BPF_F_PAD_ZEROS); + if (bpf_strncmp(big_str2, 4, "baba") != 0 || ret != 5000 + || bpf_strncmp(big_str2 + 4996, 5, "bab\0\0") != 0) { + BPF_SEQ_PRINTF(seq, "%s\n", info); + return 0; + } + + /* Shorter length than the string that crosses a page boundary */ + ret = bpf_copy_from_user_task_str(big_str3, 4996, user_ptr_long, task, 0); + if (bpf_strncmp(big_str3, 4, "baba") != 0 || ret != 4996 + || bpf_strncmp(big_str3 + 4992, 4, "bab\0") != 0) { + BPF_SEQ_PRINTF(seq, "%s\n", info); + return 0; + } + + ++num_success_copy_from_user_task_str; + if (ctx->meta->seq_num == 0) BPF_SEQ_PRINTF(seq, " tgid gid data\n"); diff --git a/tools/testing/selftests/bpf/progs/read_vsyscall.c b/tools/testing/selftests/bpf/progs/read_vsyscall.c index 39ebef430059..395591374d4f 100644 --- a/tools/testing/selftests/bpf/progs/read_vsyscall.c +++ b/tools/testing/selftests/bpf/progs/read_vsyscall.c @@ -8,14 +8,16 @@ int target_pid = 0; void *user_ptr = 0; -int read_ret[9]; +int read_ret[10]; char _license[] SEC("license") = "GPL"; /* - * This is the only kfunc, the others are helpers + * These are the kfuncs, the others are helpers */ int bpf_copy_from_user_str(void *dst, u32, const void *, u64) __weak __ksym; +int bpf_copy_from_user_task_str(void *dst, u32, const void *, + struct task_struct *, u64) __weak __ksym; SEC("fentry/" SYS_PREFIX "sys_nanosleep") int do_probe_read(void *ctx) @@ -47,6 +49,11 @@ int do_copy_from_user(void *ctx) read_ret[7] = bpf_copy_from_user_task(buf, sizeof(buf), user_ptr, bpf_get_current_task_btf(), 0); read_ret[8] = bpf_copy_from_user_str((char *)buf, sizeof(buf), user_ptr, 0); + read_ret[9] = bpf_copy_from_user_task_str((char *)buf, + sizeof(buf), + user_ptr, + bpf_get_current_task_btf(), + 0); return 0; }