[PATCH bpf] bpf: Force kprobe multi expected_attach_type for kprobe_multi link

[PATCH bpf] bpf: Force kprobe multi expected_attach_type for kprobe_multi link

[Jiri Olsa]

We currently allow to create perf link for program with
expected_attach_type == BPF_TRACE_KPROBE_MULTI.

This will cause crash when we call helpers like get_attach_cookie or
get_func_ip in such program, because it will call the kprobe_multi's
version (current->bpf_ctx context setup) of those helpers while it
expects perf_link's current->bpf_ctx context setup.

Making sure that we use BPF_TRACE_KPROBE_MULTI expected_attach_type
only for programs attaching through kprobe_multi link.

Fixes: ca74823c6e16 ("bpf: Add cookie support to programs attached with kprobe multi link")
Signed-off-by: Jiri Olsa <jolsa@kernel.org>
---
 kernel/bpf/syscall.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index 0c21d0d8efe4..e8fe04a5db93 100644
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -4675,6 +4675,11 @@ static int link_create(union bpf_attr *attr, bpfptr_t uattr)
 		ret = bpf_perf_link_attach(attr, prog);
 		break;
 	case BPF_PROG_TYPE_KPROBE:
+		if (prog->expected_attach_type == BPF_TRACE_KPROBE_MULTI &&
+		    attr->link_create.attach_type != BPF_TRACE_KPROBE_MULTI) {
+			ret = -EINVAL;
+			goto out;
+		}
 		if (attr->link_create.attach_type == BPF_PERF_EVENT)
 			ret = bpf_perf_link_attach(attr, prog);
 		else
-- 
2.40.1

Re: [PATCH bpf] bpf: Force kprobe multi expected_attach_type for kprobe_multi link

[Yonghong Song]

On 6/13/23 4:31 AM, Jiri Olsa wrote:
> We currently allow to create perf link for program with
> expected_attach_type == BPF_TRACE_KPROBE_MULTI.
> 
> This will cause crash when we call helpers like get_attach_cookie or
> get_func_ip in such program, because it will call the kprobe_multi's
> version (current->bpf_ctx context setup) of those helpers while it
> expects perf_link's current->bpf_ctx context setup.
> 
> Making sure that we use BPF_TRACE_KPROBE_MULTI expected_attach_type
> only for programs attaching through kprobe_multi link.
> 
> Fixes: ca74823c6e16 ("bpf: Add cookie support to programs attached with kprobe multi link")
> Signed-off-by: Jiri Olsa <jolsa@kernel.org>

Acked-by: Yonghong Song <yhs@fb.com>

Re: [PATCH bpf] bpf: Force kprobe multi expected_attach_type for kprobe_multi link

[Andrii Nakryiko]

On Tue, Jun 13, 2023 at 4:31 AM Jiri Olsa <jolsa@kernel.org> wrote:
>
> We currently allow to create perf link for program with
> expected_attach_type == BPF_TRACE_KPROBE_MULTI.
>
> This will cause crash when we call helpers like get_attach_cookie or
> get_func_ip in such program, because it will call the kprobe_multi's
> version (current->bpf_ctx context setup) of those helpers while it
> expects perf_link's current->bpf_ctx context setup.
>
> Making sure that we use BPF_TRACE_KPROBE_MULTI expected_attach_type
> only for programs attaching through kprobe_multi link.
>
> Fixes: ca74823c6e16 ("bpf: Add cookie support to programs attached with kprobe multi link")
> Signed-off-by: Jiri Olsa <jolsa@kernel.org>
> ---
>  kernel/bpf/syscall.c | 5 +++++
>  1 file changed, 5 insertions(+)
>
> diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
> index 0c21d0d8efe4..e8fe04a5db93 100644
> --- a/kernel/bpf/syscall.c
> +++ b/kernel/bpf/syscall.c
> @@ -4675,6 +4675,11 @@ static int link_create(union bpf_attr *attr, bpfptr_t uattr)
>                 ret = bpf_perf_link_attach(attr, prog);
>                 break;
>         case BPF_PROG_TYPE_KPROBE:
> +               if (prog->expected_attach_type == BPF_TRACE_KPROBE_MULTI &&
> +                   attr->link_create.attach_type != BPF_TRACE_KPROBE_MULTI) {
> +                       ret = -EINVAL;
> +                       goto out;
> +               }

there is a separate expected attach type validation switch above this,
shouldn't this go there? We also have
bpf_prog_attach_check_attach_type() call above as well, and tbh by now
I'm not sure why we have like three places to check conditions like
this... But I'd put this check in either
bpf_prog_attach_check_attach_type() or in the dedicated switch for
attach_type checks.


>                 if (attr->link_create.attach_type == BPF_PERF_EVENT)
>                         ret = bpf_perf_link_attach(attr, prog);
>                 else
> --
> 2.40.1
>

Re: [PATCH bpf] bpf: Force kprobe multi expected_attach_type for kprobe_multi link

[Jiri Olsa]

On Fri, Jun 16, 2023 at 09:53:00AM -0700, Andrii Nakryiko wrote:
> On Tue, Jun 13, 2023 at 4:31 AM Jiri Olsa <jolsa@kernel.org> wrote:
> >
> > We currently allow to create perf link for program with
> > expected_attach_type == BPF_TRACE_KPROBE_MULTI.
> >
> > This will cause crash when we call helpers like get_attach_cookie or
> > get_func_ip in such program, because it will call the kprobe_multi's
> > version (current->bpf_ctx context setup) of those helpers while it
> > expects perf_link's current->bpf_ctx context setup.
> >
> > Making sure that we use BPF_TRACE_KPROBE_MULTI expected_attach_type
> > only for programs attaching through kprobe_multi link.
> >
> > Fixes: ca74823c6e16 ("bpf: Add cookie support to programs attached with kprobe multi link")
> > Signed-off-by: Jiri Olsa <jolsa@kernel.org>
> > ---
> >  kernel/bpf/syscall.c | 5 +++++
> >  1 file changed, 5 insertions(+)
> >
> > diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
> > index 0c21d0d8efe4..e8fe04a5db93 100644
> > --- a/kernel/bpf/syscall.c
> > +++ b/kernel/bpf/syscall.c
> > @@ -4675,6 +4675,11 @@ static int link_create(union bpf_attr *attr, bpfptr_t uattr)
> >                 ret = bpf_perf_link_attach(attr, prog);
> >                 break;
> >         case BPF_PROG_TYPE_KPROBE:
> > +               if (prog->expected_attach_type == BPF_TRACE_KPROBE_MULTI &&
> > +                   attr->link_create.attach_type != BPF_TRACE_KPROBE_MULTI) {
> > +                       ret = -EINVAL;
> > +                       goto out;
> > +               }
> 
> there is a separate expected attach type validation switch above this,
> shouldn't this go there? We also have
> bpf_prog_attach_check_attach_type() call above as well, and tbh by now
> I'm not sure why we have like three places to check conditions like
> this... But I'd put this check in either
> bpf_prog_attach_check_attach_type() or in the dedicated switch for
> attach_type checks.
> 

bpf_prog_attach_check_attach_type looks good, will move it there

thanks,
jirka