History

bpf: Add probe_read_{user, kernel} and probe_read_{user, kernel}_str helpers

The current bpf_probe_read() and bpf_probe_read_str() helpers are broken in that they assume they can be used for probing memory access for kernel space addresses /as well as/ user space addresses. However, plain use of probe_kernel_read() for both cases will attempt to always access kernel space address space given access is performed under KERNEL_DS and some archs in-fact have overlapping address spaces where a kernel pointer and user pointer would have the /same/ address value and therefore accessing application memory via bpf_probe_read{,_str}() would read garbage values. Lets fix BPF side by making use of recently added 3d7081822f7f ("uaccess: Add non-pagefault user-space read functions"). Unfortunately, the only way to fix this status quo is to add dedicated bpf_probe_read_{user,kernel}() and bpf_probe_read_{user,kernel}_str() helpers. The bpf_probe_read{,_str}() helpers are kept as-is to retain their current behavior. The two *_user() variants attempt the access always under USER_DS set, the two *_kernel() variants will -EFAULT when accessing user memory if the underlying architecture has non-overlapping address ranges, also avoiding throwing the kernel warning via 00c42373d397 ("x86-64: add warning for non-canonical user access address dereferences").

Daniel Borkmann committed 7 years ago

Commit 6ae08ae1 parent eb1b6683 files · +299 −126Browse files

Showing the changes to include/uapi/linux (1 of 3 files). Show all

Unified · Split

include/uapi/linux/bpf.h+82−40
@@ -563,10 +563,13 @@ union bpf_attr { · 562 unmodified lines
563563 * Return
564564 * 0 on success, or a negative error in case of failure.
565565 *
566− * int bpf_probe_read(void *dst, u32 size, const void *src)
566+ * int bpf_probe_read(void *dst, u32 size, const void *unsafe_ptr)
567567 * Description
568568 * For tracing programs, safely attempt to read *size* bytes from
569− * address *src* and store the data in *dst*.
569+ * kernel space address *unsafe_ptr* and store the data in *dst*.
570+ *
571+ * Generally, use bpf_probe_read_user() or bpf_probe_read_kernel()
572+ * instead.
570573 * Return
571574 * 0 on success, or a negative error in case of failure.
572575 *
@@ -1428,45 +1431,14 @@ union bpf_attr { · 855 unmodified lines
14281431 * Return
14291432 * 0 on success, or a negative error in case of failure.
14301433 *
1431− * int bpf_probe_read_str(void *dst, int size, const void *unsafe_ptr)
1434+ * int bpf_probe_read_str(void *dst, u32 size, const void *unsafe_ptr)
14321435 * Description
1433− * Copy a NUL terminated string from an unsafe address
1434− * *unsafe_ptr* to *dst*. The *size* should include the
1435− * terminating NUL byte. In case the string length is smaller than
1436− * *size*, the target is not padded with further NUL bytes. If the
1437− * string length is larger than *size*, just *size*-1 bytes are
1438− * copied and the last byte is set to NUL.
1439− *
1440− * On success, the length of the copied string is returned. This
1441− * makes this helper useful in tracing programs for reading
1442− * strings, and more importantly to get its length at runtime. See
1443− * the following snippet:
1444− *
1445− * ::
1446− *
1447− * SEC("kprobe/sys_open")
1448− * void bpf_sys_open(struct pt_regs *ctx)
1449− * {
1450− * char buf[PATHLEN]; // PATHLEN is defined to 256
1451− * int res = bpf_probe_read_str(buf, sizeof(buf),
1452− * ctx->di);
1453− *
1454− * // Consume buf, for example push it to
1455− * // userspace via bpf_perf_event_output(); we
1456− * // can use res (the string length) as event
1457− * // size, after checking its boundaries.
1458− * }
1459− *
1460− * In comparison, using **bpf_probe_read()** helper here instead
1461− * to read the string would require to estimate the length at
1462− * compile time, and would often result in copying more memory
1463− * than necessary.
1436+ * Copy a NUL terminated string from an unsafe kernel address
1437+ * *unsafe_ptr* to *dst*. See bpf_probe_read_kernel_str() for
1438+ * more details.
14641439 *
1465− * Another useful use case is when parsing individual process
1466− * arguments or individual environment variables navigating
1467− * *current*\ **->mm->arg_start** and *current*\
1468− * **->mm->env_start**: using this helper and the return value,
1469− * one can quickly iterate at the right offset of the memory area.
1440+ * Generally, use bpf_probe_read_user_str() or bpf_probe_read_kernel_str()
1441+ * instead.
14701442 * Return
14711443 * On success, the strictly positive length of the string,
14721444 * including the trailing NUL character. On error, a negative
@@ -2777,6 +2749,72 @@ union bpf_attr { · 1304 unmodified lines
27772749 * restricted to raw_tracepoint bpf programs.
27782750 * Return
27792751 * 0 on success, or a negative error in case of failure.
2752+ *
2753+ * int bpf_probe_read_user(void *dst, u32 size, const void *unsafe_ptr)
2754+ * Description
2755+ * Safely attempt to read *size* bytes from user space address
2756+ * *unsafe_ptr* and store the data in *dst*.
2757+ * Return
2758+ * 0 on success, or a negative error in case of failure.
2759+ *
2760+ * int bpf_probe_read_kernel(void *dst, u32 size, const void *unsafe_ptr)
2761+ * Description
2762+ * Safely attempt to read *size* bytes from kernel space address
2763+ * *unsafe_ptr* and store the data in *dst*.
2764+ * Return
2765+ * 0 on success, or a negative error in case of failure.
2766+ *
2767+ * int bpf_probe_read_user_str(void *dst, u32 size, const void *unsafe_ptr)
2768+ * Description
2769+ * Copy a NUL terminated string from an unsafe user address
2770+ * *unsafe_ptr* to *dst*. The *size* should include the
2771+ * terminating NUL byte. In case the string length is smaller than
2772+ * *size*, the target is not padded with further NUL bytes. If the
2773+ * string length is larger than *size*, just *size*-1 bytes are
2774+ * copied and the last byte is set to NUL.
2775+ *
2776+ * On success, the length of the copied string is returned. This
2777+ * makes this helper useful in tracing programs for reading
2778+ * strings, and more importantly to get its length at runtime. See
2779+ * the following snippet:
2780+ *
2781+ * ::
2782+ *
2783+ * SEC("kprobe/sys_open")
2784+ * void bpf_sys_open(struct pt_regs *ctx)
2785+ * {
2786+ * char buf[PATHLEN]; // PATHLEN is defined to 256
2787+ * int res = bpf_probe_read_user_str(buf, sizeof(buf),
2788+ * ctx->di);
2789+ *
2790+ * // Consume buf, for example push it to
2791+ * // userspace via bpf_perf_event_output(); we
2792+ * // can use res (the string length) as event
2793+ * // size, after checking its boundaries.
2794+ * }
2795+ *
2796+ * In comparison, using **bpf_probe_read_user()** helper here
2797+ * instead to read the string would require to estimate the length
2798+ * at compile time, and would often result in copying more memory
2799+ * than necessary.
2800+ *
2801+ * Another useful use case is when parsing individual process
2802+ * arguments or individual environment variables navigating
2803+ * *current*\ **->mm->arg_start** and *current*\
2804+ * **->mm->env_start**: using this helper and the return value,
2805+ * one can quickly iterate at the right offset of the memory area.
2806+ * Return
2807+ * On success, the strictly positive length of the string,
2808+ * including the trailing NUL character. On error, a negative
2809+ * value.
2810+ *
2811+ * int bpf_probe_read_kernel_str(void *dst, u32 size, const void *unsafe_ptr)
2812+ * Description
2813+ * Copy a NUL terminated string from an unsafe kernel address *unsafe_ptr*
2814+ * to *dst*. Same semantics as with bpf_probe_read_user_str() apply.
2815+ * Return
2816+ * On success, the strictly positive length of the string, including
2817+ * the trailing NUL character. On error, a negative value.
27802818 */
27812819 #define __BPF_FUNC_MAPPER(FN) \
27822820 FN(unspec), \
@@ -2890,7 +2928,11 @@ union bpf_attr { · 107 unmodified lines
28902928 FN(sk_storage_delete), \
28912929 FN(send_signal), \
28922930 FN(tcp_gen_syncookie), \
2893− FN(skb_output),
2931+ FN(skb_output), \
2932+ FN(probe_read_user), \
2933+ FN(probe_read_kernel), \
2934+ FN(probe_read_user_str), \
2935+ FN(probe_read_kernel_str),
28942936
28952937 /* integer value in 'imm' field of BPF_CALL instruction selects which helper
28962938 * function eBPF program intends to call