* [PATCH bpf v3 1/2] lib/strncpy_from_user.c: Don't overcopy bytes after NUL terminator
2020-11-05 19:29 [PATCH bpf v3 0/2] Fix bpf_probe_read_user_str() overcopying Daniel Xu
@ 2020-11-05 19:29 ` Daniel Xu
2020-11-05 19:29 ` [PATCH bpf v3 2/2] selftest/bpf: Test bpf_probe_read_user_str() strips trailing bytes after NUL Daniel Xu
1 sibling, 0 replies; 3+ messages in thread
From: Daniel Xu @ 2020-11-05 19:29 UTC (permalink / raw)
To: bpf, linux-kernel, ast, daniel, songliubraving; +Cc: Daniel Xu, kernel-team
do_strncpy_from_user() may copy some extra bytes after the NUL
terminator into the destination buffer. This usually does not matter for
normal string operations. However, when BPF programs key BPF maps with
strings, this matters a lot.
A BPF program may read strings from user memory by calling the
bpf_probe_read_user_str() helper which eventually calls
do_strncpy_from_user(). The program can then key a map with the
resulting string. BPF map keys are fixed-width and string-agnostic,
meaning that map keys are treated as a set of bytes.
The issue is when do_strncpy_from_user() overcopies bytes after the NUL
terminator, it can result in seemingly identical strings occupying
multiple slots in a BPF map. This behavior is subtle and totally
unexpected by the user.
This commit uses the proper word-at-a-time APIs to avoid overcopying.
Fixes: 6ae08ae3dea2 ("bpf: Add probe_read_{user, kernel} and probe_read_{user, kernel}_str helpers")
Signed-off-by: Daniel Xu <dxu@dxuuu.xyz>
---
lib/strncpy_from_user.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
diff --git a/lib/strncpy_from_user.c b/lib/strncpy_from_user.c
index e6d5fcc2cdf3..82a67dde136b 100644
--- a/lib/strncpy_from_user.c
+++ b/lib/strncpy_from_user.c
@@ -35,17 +35,22 @@ static inline long do_strncpy_from_user(char *dst, const char __user *src,
goto byte_at_a_time;
while (max >= sizeof(unsigned long)) {
- unsigned long c, data;
+ unsigned long c, data, mask, *out;
/* Fall back to byte-at-a-time if we get a page fault */
unsafe_get_user(c, (unsigned long __user *)(src+res), byte_at_a_time);
- *(unsigned long *)(dst+res) = c;
if (has_zero(c, &data, &constants)) {
data = prep_zero_mask(c, data, &constants);
data = create_zero_mask(data);
+ mask = zero_bytemask(data);
+ out = (unsigned long *)(dst+res);
+ *out = (*out & ~mask) | (c & mask);
return res + find_zero(data);
}
+
+ *(unsigned long *)(dst+res) = c;
+
res += sizeof(unsigned long);
max -= sizeof(unsigned long);
}
--
2.28.0
^ permalink raw reply related [flat|nested] 3+ messages in thread* [PATCH bpf v3 2/2] selftest/bpf: Test bpf_probe_read_user_str() strips trailing bytes after NUL
2020-11-05 19:29 [PATCH bpf v3 0/2] Fix bpf_probe_read_user_str() overcopying Daniel Xu
2020-11-05 19:29 ` [PATCH bpf v3 1/2] lib/strncpy_from_user.c: Don't overcopy bytes after NUL terminator Daniel Xu
@ 2020-11-05 19:29 ` Daniel Xu
1 sibling, 0 replies; 3+ messages in thread
From: Daniel Xu @ 2020-11-05 19:29 UTC (permalink / raw)
To: bpf, linux-kernel, ast, daniel, songliubraving; +Cc: Daniel Xu, kernel-team
Previously, bpf_probe_read_user_str() could potentially overcopy the
trailing bytes after the NUL due to how do_strncpy_from_user() does the
copy in long-sized strides. The issue has been fixed in the previous
commit.
This commit adds a selftest that ensures we don't regress
bpf_probe_read_user_str() again.
Signed-off-by: Daniel Xu <dxu@dxuuu.xyz>
---
.../bpf/prog_tests/probe_read_user_str.c | 60 +++++++++++++++++++
.../bpf/progs/test_probe_read_user_str.c | 34 +++++++++++
2 files changed, 94 insertions(+)
create mode 100644 tools/testing/selftests/bpf/prog_tests/probe_read_user_str.c
create mode 100644 tools/testing/selftests/bpf/progs/test_probe_read_user_str.c
diff --git a/tools/testing/selftests/bpf/prog_tests/probe_read_user_str.c b/tools/testing/selftests/bpf/prog_tests/probe_read_user_str.c
new file mode 100644
index 000000000000..7c6422901b78
--- /dev/null
+++ b/tools/testing/selftests/bpf/prog_tests/probe_read_user_str.c
@@ -0,0 +1,60 @@
+// SPDX-License-Identifier: GPL-2.0
+#include <test_progs.h>
+#include "test_probe_read_user_str.skel.h"
+
+static const char str[] = "mestring";
+
+void test_probe_read_user_str(void)
+{
+ struct test_probe_read_user_str *skel;
+ int fd, err, duration = 0;
+ char buf[256];
+ ssize_t n;
+
+ skel = test_probe_read_user_str__open_and_load();
+ if (CHECK(!skel, "test_probe_read_user_str__open_and_load",
+ "skeleton open and load failed\n"))
+ return;
+
+ /* Give pid to bpf prog so it doesn't read from anyone else */
+ skel->bss->pid = getpid();
+
+ err = test_probe_read_user_str__attach(skel);
+ if (CHECK(err, "test_probe_read_user_str__attach",
+ "skeleton attach failed: %d\n", err))
+ goto out;
+
+ fd = open("/dev/null", O_WRONLY);
+ if (CHECK(fd < 0, "open", "open /dev/null failed: %d\n", fd))
+ goto out;
+
+ /* Ensure bytes after string are ones */
+ memset(buf, 1, sizeof(buf));
+ memcpy(buf, str, sizeof(str));
+
+ /* Trigger tracepoint */
+ n = write(fd, buf, sizeof(buf));
+ if (CHECK(n != sizeof(buf), "write", "write failed: %ld\n", n))
+ goto fd_out;
+
+ /* Did helper fail? */
+ if (CHECK(skel->bss->ret < 0, "prog_ret", "prog returned: %ld\n",
+ skel->bss->ret))
+ goto fd_out;
+
+ /* Check that string was copied correctly */
+ err = memcmp(skel->bss->buf, str, sizeof(str));
+ if (CHECK(err, "memcmp", "prog copied wrong string"))
+ goto fd_out;
+
+ /* Now check that no extra trailing bytes were copied */
+ memset(buf, 0, sizeof(buf));
+ err = memcmp(skel->bss->buf + sizeof(str), buf, sizeof(buf) - sizeof(str));
+ if (CHECK(err, "memcmp", "trailing bytes were not stripped"))
+ goto fd_out;
+
+fd_out:
+ close(fd);
+out:
+ test_probe_read_user_str__destroy(skel);
+}
diff --git a/tools/testing/selftests/bpf/progs/test_probe_read_user_str.c b/tools/testing/selftests/bpf/progs/test_probe_read_user_str.c
new file mode 100644
index 000000000000..5da764a8bf85
--- /dev/null
+++ b/tools/testing/selftests/bpf/progs/test_probe_read_user_str.c
@@ -0,0 +1,34 @@
+// SPDX-License-Identifier: GPL-2.0
+
+#include <linux/bpf.h>
+#include <bpf/bpf_helpers.h>
+#include <bpf/bpf_tracing.h>
+
+#include <sys/types.h>
+
+struct sys_enter_write_args {
+ unsigned long long pad;
+ int syscall_nr;
+ int pad1; /* 4 byte hole */
+ unsigned int fd;
+ int pad2; /* 4 byte hole */
+ const char *buf;
+ size_t count;
+};
+
+pid_t pid = 0;
+long ret = 0;
+char buf[256] = {};
+
+SEC("tracepoint/syscalls/sys_enter_write")
+int on_write(struct sys_enter_write_args *ctx)
+{
+ if (pid != (bpf_get_current_pid_tgid() >> 32))
+ return 0;
+
+ ret = bpf_probe_read_user_str(buf, sizeof(buf), ctx->buf);
+
+ return 0;
+}
+
+char _license[] SEC("license") = "GPL";
--
2.28.0
^ permalink raw reply related [flat|nested] 3+ messages in thread