History

Merge branch 'bpf-fix-kptr-checks'

Martin KaFai Lau says: ==================== This patch set removes the bpf_dump_raw_ok() guard for the func_info and line_info during bpf_prog_get_info_by_fd(). ====================

Daniel Borkmann committed 7 years ago

Commit 0ad379f2 parents 00842be 177e7714 files · +13 −39Browse files

Unified · Split

4 files
  1. kernel/bpf/syscall.c +12 −20
  2. tools/bpf/bpftool/prog.c +0 −7
  3. tools/lib/bpf/bpf_prog_linfo.c +1 −5
  4. tools/testing/selftests/bpf/test_btf.c +0 −7
kernel/bpf/syscall.c+12−20
@@ -2272,33 +2272,25 @@ static int bpf_prog_get_info_by_fd(struct bpf_prog *prog, · 2271 unmodified lines
2272 ulen = info.nr_func_info;2272 ulen = info.nr_func_info;
2273 info.nr_func_info = prog->aux->func_info_cnt;2273 info.nr_func_info = prog->aux->func_info_cnt;
2274 if (info.nr_func_info && ulen) {2274 if (info.nr_func_info && ulen) {
2275 if (bpf_dump_raw_ok()) {2275 char __user *user_finfo;
2276 char __user *user_finfo;
2277 2276
2278 user_finfo = u64_to_user_ptr(info.func_info);2277 user_finfo = u64_to_user_ptr(info.func_info);
2279 ulen = min_t(u32, info.nr_func_info, ulen);2278 ulen = min_t(u32, info.nr_func_info, ulen);
2280 if (copy_to_user(user_finfo, prog->aux->func_info,2279 if (copy_to_user(user_finfo, prog->aux->func_info,
2281 info.func_info_rec_size * ulen))2280 info.func_info_rec_size * ulen))
2282 return -EFAULT;2281 return -EFAULT;
2283 } else {
2284 info.func_info = 0;
2285 }
2286 }2282 }
2287 2283
2288 ulen = info.nr_line_info;2284 ulen = info.nr_line_info;
2289 info.nr_line_info = prog->aux->nr_linfo;2285 info.nr_line_info = prog->aux->nr_linfo;
2290 if (info.nr_line_info && ulen) {2286 if (info.nr_line_info && ulen) {
2291 if (bpf_dump_raw_ok()) {2287 __u8 __user *user_linfo;
2292 __u8 __user *user_linfo;
2293 2288
2294 user_linfo = u64_to_user_ptr(info.line_info);2289 user_linfo = u64_to_user_ptr(info.line_info);
2295 ulen = min_t(u32, info.nr_line_info, ulen);2290 ulen = min_t(u32, info.nr_line_info, ulen);
2296 if (copy_to_user(user_linfo, prog->aux->linfo,2291 if (copy_to_user(user_linfo, prog->aux->linfo,
2297 info.line_info_rec_size * ulen))2292 info.line_info_rec_size * ulen))
2298 return -EFAULT;2293 return -EFAULT;
2299 } else {
2300 info.line_info = 0;
2301 }
2302 }2294 }
2303 2295
2304 ulen = info.nr_jited_line_info;2296 ulen = info.nr_jited_line_info;
tools/bpf/bpftool/prog.c+0−7
@@ -596,13 +596,6 @@ static int do_dump(int argc, char **argv) · 595 unmodified lines
596 goto err_free;596 goto err_free;
597 }597 }
598 598
599 if (func_info && !info.func_info) {
600 /* kernel.kptr_restrict is set. No func_info available. */
601 free(func_info);
602 func_info = NULL;
603 nr_finfo = 0;
604 }
605
606 if (linfo && info.nr_line_info != nr_linfo) {599 if (linfo && info.nr_line_info != nr_linfo) {
607 p_err("incorrect nr_line_info %u vs. expected %u",600 p_err("incorrect nr_line_info %u vs. expected %u",
608 info.nr_line_info, nr_linfo);601 info.nr_line_info, nr_linfo);
tools/lib/bpf/bpf_prog_linfo.c+1−5
@@ -107,11 +107,7 @@ struct bpf_prog_linfo *bpf_prog_linfo__new(const struct bpf_prog_info *info) · 106 unmodified lines
107 107
108 nr_linfo = info->nr_line_info;108 nr_linfo = info->nr_line_info;
109 109
110 /*110 if (!nr_linfo)
111 * Test !info->line_info because the kernel may NULL
112 * the ptr if kernel.kptr_restrict is set.
113 */
114 if (!nr_linfo || !info->line_info)
115 return NULL;111 return NULL;
116 112
117 /*113 /*
tools/testing/selftests/bpf/test_btf.c+0−7
@@ -3948,12 +3948,6 @@ static int test_get_finfo(const struct prog_info_raw_test *test, · 3947 unmodified lines
3948 goto done;3948 goto done;
3949 }3949 }
3950 3950
3951 if (CHECK(!info.func_info,
3952 "info.func_info == 0. kernel.kptr_restrict is set?")) {
3953 err = -1;
3954 goto done;
3955 }
3956
3957 finfo = func_info;3951 finfo = func_info;
3958 for (i = 0; i < test->func_info_cnt; i++) {3952 for (i = 0; i < test->func_info_cnt; i++) {
3959 if (CHECK(finfo->type_id != test->func_info[i][1],3953 if (CHECK(finfo->type_id != test->func_info[i][1],
@@ -4077,7 +4071,6 @@ static int test_get_linfo(const struct prog_info_raw_test *test, · 117 unmodified lines
4077 * Other fields are not the concern of this test.4071 * Other fields are not the concern of this test.
4078 */4072 */
4079 if (CHECK(err == -1 ||4073 if (CHECK(err == -1 ||
4080 !info.line_info ||
4081 info.nr_line_info != cnt ||4074 info.nr_line_info != cnt ||
4082 (jited_cnt && !info.jited_line_info) ||4075 (jited_cnt && !info.jited_line_info) ||
4083 info.nr_jited_line_info != jited_cnt ||4076 info.nr_jited_line_info != jited_cnt ||