Received: by 2002:a6b:fb09:0:0:0:0:0 with SMTP id h9csp403988iog; Wed, 15 Jun 2022 04:51:33 -0700 (PDT) X-Google-Smtp-Source: AGRyM1sC2/Qy+xyN/iPdHjY0BzBGrpVq5ICggwaTJSV7YG82WF5Y6etTx4ddncVoCpYQ/HjaYCw1 X-Received: by 2002:a17:902:f682:b0:164:3d5:74c1 with SMTP id l2-20020a170902f68200b0016403d574c1mr9095144plg.60.1655293893637; Wed, 15 Jun 2022 04:51:33 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1655293893; cv=none; d=google.com; s=arc-20160816; b=rCn4gOjsj9M6j15oS679SkQm3UIgBTwXrGam28pXglPPOpYkGCLY6lnJRwobdRmN+s lwzVWupzDTL80aVowO+MS0u9foicx1RTBNSLVpTv/e7DL6HynAtz76w36OnEnMSNYwbD yva/mIuTBa3ZCbBpuU39xW0TAjU0hg7OapNz0zqhvTX1GrpKyN9ubVZrQUereLuxs/Q3 Vv5noB0LbOH/3AWLtCcKvxUdyE1ZfSQHPQr/4q1+qHn6qiAPXkGh5IX7qlgv8new7THf sc5clLG4YBWVAInA9hPYWqsU/dGmzaE64GaXvpfBm4FIjx0rdBuDkn1A/xANXBcPbB8V yPVw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=VDaNvow+kjDcdyCQBAzdhoXUCxRe7VFJ01knaKQhPFs=; b=WZ4AoOmZKgBgTdn6auYzl2Uosk0YRyFms8Ygm5I1OiVDgEhzJJI6pP/di8Vk8SF9U9 aPW6KCC/WWLchGck18CV78qP/aFQn+XiThn/rGSAFwtp4RjoZp6T3IA1h6IdOpdoVkQ0 sAktm5piv9HMVmbUo0P1gDCsnfG4ooviUyyQ1GCjLZijNr8Wc8cFFT7271rCxP7DaDBX TgoXsZ0Xogu+Ujytl+faR3D7CbC/lx6BLH/HzEtRbVxCstIOpgX741kp+rztrsVoERBn E7CIyc7wAWKisUXpb/wXve20eFNGx6OJA0IcQXXQIXzMx5pNBnNwlkvytscCQaZ0BLcP Y6EQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=k20201202 header.b=MnHg00ev; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=kernel.org Return-Path: Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id r9-20020a635d09000000b0040014ad5b21si17905209pgb.661.2022.06.15.04.51.22; Wed, 15 Jun 2022 04:51:33 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=k20201202 header.b=MnHg00ev; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1344251AbiFOLWN (ORCPT + 99 others); Wed, 15 Jun 2022 07:22:13 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46888 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S245341AbiFOLWC (ORCPT ); Wed, 15 Jun 2022 07:22:02 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 9EC5345522; Wed, 15 Jun 2022 04:21:59 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 3BA4361764; Wed, 15 Jun 2022 11:21:59 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 684AFC34115; Wed, 15 Jun 2022 11:21:55 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1655292118; bh=cJTxSqeBvt+JJkPbIdLUDtBvVOBvVbK0lR/sV13qNIs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=MnHg00evDfTS/JPd6z38T2J8wFuLxZicf/k9Plm6Mqk4hDt5pyKpa76NGggXtIDg/ we4GS7UKLjkMFDLeSpPvjhCWMHcJeb8frwXyWcmOuNDucioj+gsSkNDSgW+6vrh9Rn B+eRkymwTgwGDruzSdx2Ro7bEhev34FEQIyH6e7feJGBh49wUhbwtPo8QJyXRd+vBT Bi3IfMIwnQsn0sD06eM/OV0xdYQBS/yjy4VTK+MCaXD56ayU+O+NcnYhPL2f54o0lo zar+kv+mQ5jsqHr3szvrN+Ga1gfk2pGxXHZt5zJcvQHjMoUA+xBo3TtWa5YUoC5CZX kiDi1ODVDlyjQ== From: Jiri Olsa To: Alexei Starovoitov , Daniel Borkmann , Andrii Nakryiko Cc: netdev@vger.kernel.org, bpf@vger.kernel.org, lkml , Martin KaFai Lau , Song Liu , Yonghong Song , John Fastabend , KP Singh , Steven Rostedt , Masami Hiramatsu Subject: [PATCHv3 bpf 3/4] bpf: Force cookies array to follow symbols sorting Date: Wed, 15 Jun 2022 13:21:17 +0200 Message-Id: <20220615112118.497303-4-jolsa@kernel.org> X-Mailer: git-send-email 2.35.3 In-Reply-To: <20220615112118.497303-1-jolsa@kernel.org> References: <20220615112118.497303-1-jolsa@kernel.org> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Spam-Status: No, score=-8.3 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_HI, SPF_HELO_NONE,SPF_PASS,T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org When user specifies symbols and cookies for kprobe_multi link interface it's very likely the cookies will be misplaced and returned to wrong functions (via get_attach_cookie helper). The reason is that to resolve the provided functions we sort them before passing them to ftrace_lookup_symbols, but we do not do the same sort on the cookie values. Fixing this by using sort_r function with custom swap callback that swaps cookie values as well. Fixes: 0236fec57a15 ("bpf: Resolve symbols with ftrace_lookup_symbols for kprobe multi link") Signed-off-by: Jiri Olsa --- kernel/trace/bpf_trace.c | 60 ++++++++++++++++++++++++++++++---------- 1 file changed, 45 insertions(+), 15 deletions(-) diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c index 7a13e6ac6327..88589d74a892 100644 --- a/kernel/trace/bpf_trace.c +++ b/kernel/trace/bpf_trace.c @@ -2423,7 +2423,7 @@ kprobe_multi_link_handler(struct fprobe *fp, unsigned long entry_ip, kprobe_multi_link_prog_run(link, entry_ip, regs); } -static int symbols_cmp(const void *a, const void *b) +static int symbols_cmp_r(const void *a, const void *b, const void *priv) { const char **str_a = (const char **) a; const char **str_b = (const char **) b; @@ -2431,6 +2431,28 @@ static int symbols_cmp(const void *a, const void *b) return strcmp(*str_a, *str_b); } +struct multi_symbols_sort { + const char **funcs; + u64 *cookies; +}; + +static void symbols_swap_r(void *a, void *b, int size, const void *priv) +{ + const struct multi_symbols_sort *data = priv; + const char **name_a = a, **name_b = b; + + swap(*name_a, *name_b); + + /* If defined, swap also related cookies. */ + if (data->cookies) { + u64 *cookie_a, *cookie_b; + + cookie_a = data->cookies + (name_a - data->funcs); + cookie_b = data->cookies + (name_b - data->funcs); + swap(*cookie_a, *cookie_b); + } +} + int bpf_kprobe_multi_link_attach(const union bpf_attr *attr, struct bpf_prog *prog) { struct bpf_kprobe_multi_link *link = NULL; @@ -2468,38 +2490,46 @@ int bpf_kprobe_multi_link_attach(const union bpf_attr *attr, struct bpf_prog *pr if (!addrs) return -ENOMEM; + ucookies = u64_to_user_ptr(attr->link_create.kprobe_multi.cookies); + if (ucookies) { + cookies = kvmalloc_array(cnt, sizeof(*addrs), GFP_KERNEL); + if (!cookies) { + err = -ENOMEM; + goto error; + } + if (copy_from_user(cookies, ucookies, size)) { + err = -EFAULT; + goto error; + } + } + if (uaddrs) { if (copy_from_user(addrs, uaddrs, size)) { err = -EFAULT; goto error; } } else { + struct multi_symbols_sort data = { + .cookies = cookies, + }; struct user_syms us; err = copy_user_syms(&us, usyms, cnt); if (err) goto error; - sort(us.syms, cnt, sizeof(*us.syms), symbols_cmp, NULL); + if (cookies) + data.funcs = us.syms; + + sort_r(us.syms, cnt, sizeof(*us.syms), symbols_cmp_r, + symbols_swap_r, &data); + err = ftrace_lookup_symbols(us.syms, cnt, addrs); free_user_syms(&us); if (err) goto error; } - ucookies = u64_to_user_ptr(attr->link_create.kprobe_multi.cookies); - if (ucookies) { - cookies = kvmalloc_array(cnt, sizeof(*addrs), GFP_KERNEL); - if (!cookies) { - err = -ENOMEM; - goto error; - } - if (copy_from_user(cookies, ucookies, size)) { - err = -EFAULT; - goto error; - } - } - link = kzalloc(sizeof(*link), GFP_KERNEL); if (!link) { err = -ENOMEM; -- 2.35.3