mirror of
https://github.com/torvalds/linux.git
synced 2024-12-01 00:21:32 +00:00
75a1a607bb
Add two new probe_kernel_read_strict() and strncpy_from_unsafe_strict()
helpers which by default alias to the __probe_kernel_read() and the
__strncpy_from_unsafe(), respectively, but can be overridden by archs
which have non-overlapping address ranges for kernel space and user
space in order to bail out with -EFAULT when attempting to probe user
memory including non-canonical user access addresses [0]:
4-level page tables:
user-space mem: 0x0000000000000000 - 0x00007fffffffffff
non-canonical: 0x0000800000000000 - 0xffff7fffffffffff
5-level page tables:
user-space mem: 0x0000000000000000 - 0x00ffffffffffffff
non-canonical: 0x0100000000000000 - 0xfeffffffffffffff
The idea is that these helpers are complementary to the probe_user_read()
and strncpy_from_unsafe_user() which probe user-only memory. Both added
helpers here do the same, but for kernel-only addresses.
Both set of helpers are going to be used for BPF tracing. They also
explicitly avoid throwing the splat for non-canonical user addresses from
00c42373d3 ("x86-64: add warning for non-canonical user access address
dereferences").
For compat, the current probe_kernel_read() and strncpy_from_unsafe() are
left as-is.
[0] Documentation/x86/x86_64/mm.txt
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: x86@kernel.org
Link: https://lore.kernel.org/bpf/eefeefd769aa5a013531f491a71f0936779e916b.1572649915.git.daniel@iogearbox.net
44 lines
1.1 KiB
C
44 lines
1.1 KiB
C
// SPDX-License-Identifier: GPL-2.0-only
|
|
|
|
#include <linux/uaccess.h>
|
|
#include <linux/kernel.h>
|
|
|
|
#ifdef CONFIG_X86_64
|
|
static __always_inline u64 canonical_address(u64 vaddr, u8 vaddr_bits)
|
|
{
|
|
return ((s64)vaddr << (64 - vaddr_bits)) >> (64 - vaddr_bits);
|
|
}
|
|
|
|
static __always_inline bool invalid_probe_range(u64 vaddr)
|
|
{
|
|
/*
|
|
* Range covering the highest possible canonical userspace address
|
|
* as well as non-canonical address range. For the canonical range
|
|
* we also need to include the userspace guard page.
|
|
*/
|
|
return vaddr < TASK_SIZE_MAX + PAGE_SIZE ||
|
|
canonical_address(vaddr, boot_cpu_data.x86_virt_bits) != vaddr;
|
|
}
|
|
#else
|
|
static __always_inline bool invalid_probe_range(u64 vaddr)
|
|
{
|
|
return vaddr < TASK_SIZE_MAX;
|
|
}
|
|
#endif
|
|
|
|
long probe_kernel_read_strict(void *dst, const void *src, size_t size)
|
|
{
|
|
if (unlikely(invalid_probe_range((unsigned long)src)))
|
|
return -EFAULT;
|
|
|
|
return __probe_kernel_read(dst, src, size);
|
|
}
|
|
|
|
long strncpy_from_unsafe_strict(char *dst, const void *unsafe_addr, long count)
|
|
{
|
|
if (unlikely(invalid_probe_range((unsigned long)unsafe_addr)))
|
|
return -EFAULT;
|
|
|
|
return __strncpy_from_unsafe(dst, unsafe_addr, count);
|
|
}
|