The current bpf_probe_read() and bpf_probe_read_str() helpers are broken in that they assume they can be used for probing memory access for kernel space addresses /as well as/ user space addresses. However, plain use of probe_kernel_read() for both cases will attempt to always access kernel space address space given access is performed under KERNEL_DS and some archs in-fact have overlapping address spaces where a kernel pointer and user pointer would have the /same/ address value and therefore accessing application memory via bpf_probe_read{,_str}() would read garbage values. Lets fix BPF side by making use of recently added 3d7081822f7f ("uaccess: Add non-pagefault user-space read functions"). Unfortunately, the only way to fix this status quo is to add dedicated bpf_probe_read_{user,kernel}() and bpf_probe_read_{user,kernel}_str() helpers. The bpf_probe_read{,_str}() helpers are kept as-is to retain their current behavior. The two *_user() variants attempt the access always under USER_DS set, the two *_kernel() variants will -EFAULT when accessing user memory if the underlying architecture has non-overlapping address ranges, also avoiding throwing the kernel warning via 00c42373d397 ("x86-64: add warning for non-canonical user access address dereferences").
Showing the changes to include/uapi/linux (1 of 3 files). Show all
Unified · Split
| @@ -563,10 +563,13 @@ union bpf_attr { · 562 unmodified lines | |||
| 563 | * Return | 563 | * Return |
| 564 | * 0 on success, or a negative error in case of failure. | 564 | * 0 on success, or a negative error in case of failure. |
| 565 | * | 565 | * |
| 566 | * int bpf_probe_read(void *dst, u32 size, const void *src) | 566 | * int bpf_probe_read(void *dst, u32 size, const void *unsafe_ptr) |
| 567 | * Description | 567 | * Description |
| 568 | * For tracing programs, safely attempt to read *size* bytes from | 568 | * For tracing programs, safely attempt to read *size* bytes from |
| 569 | * address *src* and store the data in *dst*. | 569 | * kernel space address *unsafe_ptr* and store the data in *dst*. |
| 570 | * | ||
| 571 | * Generally, use bpf_probe_read_user() or bpf_probe_read_kernel() | ||
| 572 | * instead. | ||
| 570 | * Return | 573 | * Return |
| 571 | * 0 on success, or a negative error in case of failure. | 574 | * 0 on success, or a negative error in case of failure. |
| 572 | * | 575 | * |
| @@ -1428,45 +1431,14 @@ union bpf_attr { · 855 unmodified lines | |||
| 1428 | * Return | 1431 | * Return |
| 1429 | * 0 on success, or a negative error in case of failure. | 1432 | * 0 on success, or a negative error in case of failure. |
| 1430 | * | 1433 | * |
| 1431 | * int bpf_probe_read_str(void *dst, int size, const void *unsafe_ptr) | 1434 | * int bpf_probe_read_str(void *dst, u32 size, const void *unsafe_ptr) |
| 1432 | * Description | 1435 | * Description |
| 1433 | * Copy a NUL terminated string from an unsafe address | 1436 | * Copy a NUL terminated string from an unsafe kernel address |
| 1434 | * *unsafe_ptr* to *dst*. The *size* should include the | 1437 | * *unsafe_ptr* to *dst*. See bpf_probe_read_kernel_str() for |
| 1435 | * terminating NUL byte. In case the string length is smaller than | 1438 | * more details. |
| 1436 | * *size*, the target is not padded with further NUL bytes. If the | ||
| 1437 | * string length is larger than *size*, just *size*-1 bytes are | ||
| 1438 | * copied and the last byte is set to NUL. | ||
| 1439 | * | ||
| 1440 | * On success, the length of the copied string is returned. This | ||
| 1441 | * makes this helper useful in tracing programs for reading | ||
| 1442 | * strings, and more importantly to get its length at runtime. See | ||
| 1443 | * the following snippet: | ||
| 1444 | * | ||
| 1445 | * :: | ||
| 1446 | * | ||
| 1447 | * SEC("kprobe/sys_open") | ||
| 1448 | * void bpf_sys_open(struct pt_regs *ctx) | ||
| 1449 | * { | ||
| 1450 | * char buf[PATHLEN]; // PATHLEN is defined to 256 | ||
| 1451 | * int res = bpf_probe_read_str(buf, sizeof(buf), | ||
| 1452 | * ctx->di); | ||
| 1453 | * | ||
| 1454 | * // Consume buf, for example push it to | ||
| 1455 | * // userspace via bpf_perf_event_output(); we | ||
| 1456 | * // can use res (the string length) as event | ||
| 1457 | * // size, after checking its boundaries. | ||
| 1458 | * } | ||
| 1459 | * | ||
| 1460 | * In comparison, using **bpf_probe_read()** helper here instead | ||
| 1461 | * to read the string would require to estimate the length at | ||
| 1462 | * compile time, and would often result in copying more memory | ||
| 1463 | * than necessary. | ||
| 1464 | * | 1439 | * |
| 1465 | * Another useful use case is when parsing individual process | 1440 | * Generally, use bpf_probe_read_user_str() or bpf_probe_read_kernel_str() |
| 1466 | * arguments or individual environment variables navigating | 1441 | * instead. |
| 1467 | * *current*\ **->mm->arg_start** and *current*\ | ||
| 1468 | * **->mm->env_start**: using this helper and the return value, | ||
| 1469 | * one can quickly iterate at the right offset of the memory area. | ||
| 1470 | * Return | 1442 | * Return |
| 1471 | * On success, the strictly positive length of the string, | 1443 | * On success, the strictly positive length of the string, |
| 1472 | * including the trailing NUL character. On error, a negative | 1444 | * including the trailing NUL character. On error, a negative |
| @@ -2777,6 +2749,72 @@ union bpf_attr { · 1304 unmodified lines | |||
| 2777 | * restricted to raw_tracepoint bpf programs. | 2749 | * restricted to raw_tracepoint bpf programs. |
| 2778 | * Return | 2750 | * Return |
| 2779 | * 0 on success, or a negative error in case of failure. | 2751 | * 0 on success, or a negative error in case of failure. |
| 2752 | * | ||
| 2753 | * int bpf_probe_read_user(void *dst, u32 size, const void *unsafe_ptr) | ||
| 2754 | * Description | ||
| 2755 | * Safely attempt to read *size* bytes from user space address | ||
| 2756 | * *unsafe_ptr* and store the data in *dst*. | ||
| 2757 | * Return | ||
| 2758 | * 0 on success, or a negative error in case of failure. | ||
| 2759 | * | ||
| 2760 | * int bpf_probe_read_kernel(void *dst, u32 size, const void *unsafe_ptr) | ||
| 2761 | * Description | ||
| 2762 | * Safely attempt to read *size* bytes from kernel space address | ||
| 2763 | * *unsafe_ptr* and store the data in *dst*. | ||
| 2764 | * Return | ||
| 2765 | * 0 on success, or a negative error in case of failure. | ||
| 2766 | * | ||
| 2767 | * int bpf_probe_read_user_str(void *dst, u32 size, const void *unsafe_ptr) | ||
| 2768 | * Description | ||
| 2769 | * Copy a NUL terminated string from an unsafe user address | ||
| 2770 | * *unsafe_ptr* to *dst*. The *size* should include the | ||
| 2771 | * terminating NUL byte. In case the string length is smaller than | ||
| 2772 | * *size*, the target is not padded with further NUL bytes. If the | ||
| 2773 | * string length is larger than *size*, just *size*-1 bytes are | ||
| 2774 | * copied and the last byte is set to NUL. | ||
| 2775 | * | ||
| 2776 | * On success, the length of the copied string is returned. This | ||
| 2777 | * makes this helper useful in tracing programs for reading | ||
| 2778 | * strings, and more importantly to get its length at runtime. See | ||
| 2779 | * the following snippet: | ||
| 2780 | * | ||
| 2781 | * :: | ||
| 2782 | * | ||
| 2783 | * SEC("kprobe/sys_open") | ||
| 2784 | * void bpf_sys_open(struct pt_regs *ctx) | ||
| 2785 | * { | ||
| 2786 | * char buf[PATHLEN]; // PATHLEN is defined to 256 | ||
| 2787 | * int res = bpf_probe_read_user_str(buf, sizeof(buf), | ||
| 2788 | * ctx->di); | ||
| 2789 | * | ||
| 2790 | * // Consume buf, for example push it to | ||
| 2791 | * // userspace via bpf_perf_event_output(); we | ||
| 2792 | * // can use res (the string length) as event | ||
| 2793 | * // size, after checking its boundaries. | ||
| 2794 | * } | ||
| 2795 | * | ||
| 2796 | * In comparison, using **bpf_probe_read_user()** helper here | ||
| 2797 | * instead to read the string would require to estimate the length | ||
| 2798 | * at compile time, and would often result in copying more memory | ||
| 2799 | * than necessary. | ||
| 2800 | * | ||
| 2801 | * Another useful use case is when parsing individual process | ||
| 2802 | * arguments or individual environment variables navigating | ||
| 2803 | * *current*\ **->mm->arg_start** and *current*\ | ||
| 2804 | * **->mm->env_start**: using this helper and the return value, | ||
| 2805 | * one can quickly iterate at the right offset of the memory area. | ||
| 2806 | * Return | ||
| 2807 | * On success, the strictly positive length of the string, | ||
| 2808 | * including the trailing NUL character. On error, a negative | ||
| 2809 | * value. | ||
| 2810 | * | ||
| 2811 | * int bpf_probe_read_kernel_str(void *dst, u32 size, const void *unsafe_ptr) | ||
| 2812 | * Description | ||
| 2813 | * Copy a NUL terminated string from an unsafe kernel address *unsafe_ptr* | ||
| 2814 | * to *dst*. Same semantics as with bpf_probe_read_user_str() apply. | ||
| 2815 | * Return | ||
| 2816 | * On success, the strictly positive length of the string, including | ||
| 2817 | * the trailing NUL character. On error, a negative value. | ||
| 2780 | */ | 2818 | */ |
| 2781 | #define __BPF_FUNC_MAPPER(FN) \ | 2819 | #define __BPF_FUNC_MAPPER(FN) \ |
| 2782 | FN(unspec), \ | 2820 | FN(unspec), \ |
| @@ -2890,7 +2928,11 @@ union bpf_attr { · 107 unmodified lines | |||
| 2890 | FN(sk_storage_delete), \ | 2928 | FN(sk_storage_delete), \ |
| 2891 | FN(send_signal), \ | 2929 | FN(send_signal), \ |
| 2892 | FN(tcp_gen_syncookie), \ | 2930 | FN(tcp_gen_syncookie), \ |
| 2893 | FN(skb_output), | 2931 | FN(skb_output), \ |
| 2932 | FN(probe_read_user), \ | ||
| 2933 | FN(probe_read_kernel), \ | ||
| 2934 | FN(probe_read_user_str), \ | ||
| 2935 | FN(probe_read_kernel_str), | ||
| 2894 | 2936 | ||
| 2895 | /* integer value in 'imm' field of BPF_CALL instruction selects which helper | 2937 | /* integer value in 'imm' field of BPF_CALL instruction selects which helper |
| 2896 | * function eBPF program intends to call | 2938 | * function eBPF program intends to call |