Received-SPF: pass (google.com: domain of linux-kernel+bounces-206517-linux.lists.archive=gmail.com@vger.kernel.org designates 147.75.80.249 as permitted sender) client-ip=147.75.80.249;
Precedence: bulk
MIME-Version: 1.0
References: <20240607-hid_bpf_struct_ops-v2-0-3f95f4d02292@kernel.org> <20240607-hid_bpf_struct_ops-v2-15-3f95f4d02292@kernel.org>
In-Reply-To: <20240607-hid_bpf_struct_ops-v2-15-3f95f4d02292@kernel.org>
From: Alexei Starovoitov <alexei.starovoitov@gmail.com>
Date: Fri, 7 Jun 2024 09:57:20 -0700
Message-ID: <CAADnVQ+xPtq=kw_MKPaQkeAhdPndhJs1S5DRBGtByBQ-BgdFmA@mail.gmail.com>
Subject: Re: [PATCH HID v2 15/16] HID: bpf: rework hid_bpf_ops_btf_struct_access
To: Benjamin Tissoires <bentiss@kernel.org>
Cc: Shuah Khan <shuah@kernel.org>, Jiri Kosina <jikos@kernel.org>, Jonathan Corbet <corbet@lwn.net>, 
	Alexei Starovoitov <ast@kernel.org>, 
	"open list:KERNEL SELFTEST FRAMEWORK" <linux-kselftest@vger.kernel.org>, LKML <linux-kernel@vger.kernel.org>, 
	bpf <bpf@vger.kernel.org>, 
	"open list:HID CORE LAYER" <linux-input@vger.kernel.org>, 
	"open list:DOCUMENTATION" <linux-doc@vger.kernel.org>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Fri, Jun 7, 2024 at 8:29=E2=80=AFAM Benjamin Tissoires <bentiss@kernel.o=
rg> wrote:
>
> The idea is to provide a list of stucts and their editable fields.
>
> Currently no functional changes are introduced here, we will add some
> more writeable fields in the next patch.
>
> Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
>
> ---
>
> new in v2
> ---
>  drivers/hid/bpf/hid_bpf_struct_ops.c | 91 +++++++++++++++++++++++++++---=
------
>  1 file changed, 69 insertions(+), 22 deletions(-)
>
> diff --git a/drivers/hid/bpf/hid_bpf_struct_ops.c b/drivers/hid/bpf/hid_b=
pf_struct_ops.c
> index 056d05d96962..944e6d91a36b 100644
> --- a/drivers/hid/bpf/hid_bpf_struct_ops.c
> +++ b/drivers/hid/bpf/hid_bpf_struct_ops.c
> @@ -16,6 +16,7 @@
>  #include <linux/hid_bpf.h>
>  #include <linux/init.h>
>  #include <linux/module.h>
> +#include <linux/stddef.h>
>  #include <linux/workqueue.h>
>  #include "hid_bpf_dispatch.h"
>
> @@ -52,40 +53,86 @@ static int hid_bpf_ops_check_member(const struct btf_=
type *t,
>         return 0;
>  }
>
> +struct hid_bpf_offset_write_range {
> +       const char *struct_name;
> +       u32 struct_length;
> +       u32 start;
> +       u32 end;
> +};
> +
>  static int hid_bpf_ops_btf_struct_access(struct bpf_verifier_log *log,
>                                            const struct bpf_reg_state *re=
g,
>                                            int off, int size)
>  {
> -       const struct btf_type *state;
> -       const struct btf_type *t;
> -       s32 type_id;
> +#define WRITE_RANGE(_name, _field, _start_offset, _end_offset)          =
       \
> +       {                                                                =
       \
> +               .struct_name =3D #_name,                                 =
         \
> +               .struct_length =3D sizeof(struct _name),                 =
         \
> +               .start =3D offsetof(struct _name, _field) + _start_offset=
,        \
> +               .end =3D offsetofend(struct _name, _field) + _end_offset,=
         \
> +       }

reading comment /* minus 1 to ensure \0 at the end */
in the next patch...
I don't see this logic below.
In general the manual byte offset adjustment
looks like a footgun. Maybe add a flag for \0 and avoid
messing with offsets?

>
> -       type_id =3D btf_find_by_name_kind(reg->btf, "hid_bpf_ctx",
> -                                       BTF_KIND_STRUCT);
> -       if (type_id < 0)
> -               return -EINVAL;
> +       const struct hid_bpf_offset_write_range write_ranges[] =3D {
> +               WRITE_RANGE(hid_bpf_ctx, retval, 0, 0),
> +       };
> +#undef WRITE_RANGE
> +       const struct btf_type *state =3D NULL;
> +       const struct btf_type *t;
> +       const char *cur =3D NULL;
> +       int i;
>
>         t =3D btf_type_by_id(reg->btf, reg->btf_id);
> -       state =3D btf_type_by_id(reg->btf, type_id);
> -       if (t !=3D state) {
> -               bpf_log(log, "only access to hid_bpf_ctx is supported\n")=
;
> -               return -EACCES;
> -       }
>
> -       /* out-of-bound access in hid_bpf_ctx */
> -       if (off + size > sizeof(struct hid_bpf_ctx)) {
> -               bpf_log(log, "write access at off %d with size %d\n", off=
, size);
> -               return -EACCES;
> +       for (i =3D 0; i < ARRAY_SIZE(write_ranges); i++) {
> +               const struct hid_bpf_offset_write_range *write_range =3D =
&write_ranges[i];
> +               s32 type_id;
> +
> +               /* we already found a writeable struct, but there is a
> +                * new one, let's break the loop.
> +                */
> +               if (t =3D=3D state && write_range->struct_name !=3D cur)
> +                       break;
> +
> +               /* new struct to look for */
> +               if (write_range->struct_name !=3D cur) {
> +                       type_id =3D btf_find_by_name_kind(reg->btf, write=
_range->struct_name,
> +                                                       BTF_KIND_STRUCT);
> +                       if (type_id < 0)
> +                               return -EINVAL;
> +
> +                       state =3D btf_type_by_id(reg->btf, type_id);
> +               }
> +
> +               /* this is not the struct we are looking for */
> +               if (t !=3D state) {
> +                       cur =3D write_range->struct_name;
> +                       continue;
> +               }
> +
> +               /* first time we see this struct, check for out of bounds=
 */
> +               if (cur !=3D write_range->struct_name &&
> +                   off + size > write_range->struct_length) {
> +                       bpf_log(log, "write access for struct %s at off %=
d with size %d\n",
> +                               write_range->struct_name, off, size);
> +                       return -EACCES;
> +               }
> +
> +               /* now check if we are in our boundaries */
> +               if (off >=3D write_range->start && off + size <=3D write_=
range->end)
> +                       return NOT_INIT;
> +
> +               cur =3D write_range->struct_name;
>         }
>
> -       if (off < offsetof(struct hid_bpf_ctx, retval)) {
> +
> +       if (t !=3D state)
> +               bpf_log(log, "write access to this struct is not supporte=
d\n");
> +       else
>                 bpf_log(log,
> -                       "write access at off %d with size %d on read-only=
 part of hid_bpf_ctx\n",
> -                       off, size);
> -               return -EACCES;
> -       }
> +                       "write access at off %d with size %d on read-only=
 part of %s\n",
> +                       off, size, cur);
>
> -       return NOT_INIT;
> +       return -EACCES;
>  }
>
>  static const struct bpf_verifier_ops hid_bpf_verifier_ops =3D {
>
> --
> 2.44.0
>