History

Merge branch 'bpf-fix-kptr-checks'

Martin KaFai Lau says: ==================== This patch set removes the bpf_dump_raw_ok() guard for the func_info and line_info during bpf_prog_get_info_by_fd(). ====================

Daniel Borkmann committed 7 years ago

Commit 0ad379f2 parents 00842be 177e7714 files · +13 −39Browse files

Unified · Split

4 files
  1. kernel/bpf/syscall.c +12 −20
  2. tools/bpf/bpftool/prog.c +0 −7
  3. tools/lib/bpf/bpf_prog_linfo.c +1 −5
  4. tools/testing/selftests/bpf/test_btf.c +0 −7
kernel/bpf/syscall.c+12−20
@@ -2272,33 +2272,25 @@ static int bpf_prog_get_info_by_fd(struct bpf_prog *prog, · 2271 unmodified lines
22722272 ulen = info.nr_func_info;
22732273 info.nr_func_info = prog->aux->func_info_cnt;
22742274 if (info.nr_func_info && ulen) {
2275− if (bpf_dump_raw_ok()) {
2276− char __user *user_finfo;
2275+ char __user *user_finfo;
22772276
2278− user_finfo = u64_to_user_ptr(info.func_info);
2279− ulen = min_t(u32, info.nr_func_info, ulen);
2280− if (copy_to_user(user_finfo, prog->aux->func_info,
2281− info.func_info_rec_size * ulen))
2282− return -EFAULT;
2283− } else {
2284− info.func_info = 0;
2285− }
2277+ user_finfo = u64_to_user_ptr(info.func_info);
2278+ ulen = min_t(u32, info.nr_func_info, ulen);
2279+ if (copy_to_user(user_finfo, prog->aux->func_info,
2280+ info.func_info_rec_size * ulen))
2281+ return -EFAULT;
22862282 }
22872283
22882284 ulen = info.nr_line_info;
22892285 info.nr_line_info = prog->aux->nr_linfo;
22902286 if (info.nr_line_info && ulen) {
2291− if (bpf_dump_raw_ok()) {
2292− __u8 __user *user_linfo;
2287+ __u8 __user *user_linfo;
22932288
2294− user_linfo = u64_to_user_ptr(info.line_info);
2295− ulen = min_t(u32, info.nr_line_info, ulen);
2296− if (copy_to_user(user_linfo, prog->aux->linfo,
2297− info.line_info_rec_size * ulen))
2298− return -EFAULT;
2299− } else {
2300− info.line_info = 0;
2301− }
2289+ user_linfo = u64_to_user_ptr(info.line_info);
2290+ ulen = min_t(u32, info.nr_line_info, ulen);
2291+ if (copy_to_user(user_linfo, prog->aux->linfo,
2292+ info.line_info_rec_size * ulen))
2293+ return -EFAULT;
23022294 }
23032295
23042296 ulen = info.nr_jited_line_info;
tools/bpf/bpftool/prog.c+0−7
@@ -596,13 +596,6 @@ static int do_dump(int argc, char **argv) · 595 unmodified lines
596596 goto err_free;
597597 }
598598
599− if (func_info && !info.func_info) {
600− /* kernel.kptr_restrict is set. No func_info available. */
601− free(func_info);
602− func_info = NULL;
603− nr_finfo = 0;
604− }
605−
606599 if (linfo && info.nr_line_info != nr_linfo) {
607600 p_err("incorrect nr_line_info %u vs. expected %u",
608601 info.nr_line_info, nr_linfo);
tools/lib/bpf/bpf_prog_linfo.c+1−5
@@ -107,11 +107,7 @@ struct bpf_prog_linfo *bpf_prog_linfo__new(const struct bpf_prog_info *info) · 106 unmodified lines
107107
108108 nr_linfo = info->nr_line_info;
109109
110− /*
111− * Test !info->line_info because the kernel may NULL
112− * the ptr if kernel.kptr_restrict is set.
113− */
114− if (!nr_linfo || !info->line_info)
110+ if (!nr_linfo)
115111 return NULL;
116112
117113 /*
tools/testing/selftests/bpf/test_btf.c+0−7
@@ -3948,12 +3948,6 @@ static int test_get_finfo(const struct prog_info_raw_test *test, · 3947 unmodified lines
39483948 goto done;
39493949 }
39503950
3951− if (CHECK(!info.func_info,
3952− "info.func_info == 0. kernel.kptr_restrict is set?")) {
3953− err = -1;
3954− goto done;
3955− }
3956−
39573951 finfo = func_info;
39583952 for (i = 0; i < test->func_info_cnt; i++) {
39593953 if (CHECK(finfo->type_id != test->func_info[i][1],
@@ -4077,7 +4071,6 @@ static int test_get_linfo(const struct prog_info_raw_test *test, · 117 unmodified lines
40774071 * Other fields are not the concern of this test.
40784072 */
40794073 if (CHECK(err == -1 ||
4080− !info.line_info ||
40814074 info.nr_line_info != cnt ||
40824075 (jited_cnt && !info.jited_line_info) ||
40834076 info.nr_jited_line_info != jited_cnt ||