• Daniel Borkmann's avatar
    bpf: Restrict bpf_trace_printk()'s %s usage and add %pks, %pus specifier · b2a5212f
    Daniel Borkmann authored
    Usage of plain %s conversion specifier in bpf_trace_printk() suffers from the
    very same issue as bpf_probe_read{,str}() helpers, that is, it is broken on
    archs with overlapping address ranges.
    
    While the helpers have been addressed through work in 6ae08ae3 ("bpf: Add
    probe_read_{user, kernel} and probe_read_{user, kernel}_str helpers"), we need
    an option for bpf_trace_printk() as well to fix it.
    
    Similarly as with the helpers, force users to make an explicit choice by adding
    %pks and %pus specifier to bpf_trace_printk() which will then pick the corresponding
    strncpy_from_unsafe*() variant to perform the access under KERNEL_DS or USER_DS.
    The %pk* (kernel specifier) and %pu* (user specifier) can later also be extended
    for other objects aside strings that are probed and printed under tracing, and
    reused out of other facilities like bpf_seq_printf() or BTF based type printing.
    
    Existing behavior of %s for current users is still kept working for archs where it
    is not broken and therefore gated through CONFIG_ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE.
    For archs not having this property we fall-back to pick probing under KERNEL_DS as
    a sensible default.
    
    Fixes: 8d3b7dce ("bpf: add support for %s specifier to bpf_trace_printk()")
    Reported-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
    Reported-by: default avatarChristoph Hellwig <hch@lst.de>
    Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
    Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
    Cc: Masami Hiramatsu <mhiramat@kernel.org>
    Cc: Brendan Gregg <brendan.d.gregg@gmail.com>
    Link: https://lore.kernel.org/bpf/20200515101118.6508-4-daniel@iogearbox.net
    b2a5212f
vsprintf.c 81.3 KB