Re: [PATCH 11/18] maccess: remove strncpy_from_unsafe

[Daniel Borkmann]

On 5/14/20 1:03 AM, Linus Torvalds wrote:
> On Wed, May 13, 2020 at 3:36 PM Daniel Borkmann <daniel@xxxxxxxxxxxxx> wrote:
> > It's used for both.
>
> Daniel, BPF real;ly needs to make up its mind about that.
>
> You *cannot* use ti for both.
>
> Yes, it happens to work on x86 and some other architectures.
>
> But on other architectures, the exact same pointer value can be a
> kernel pointer or a user pointer.

Right, it has the same issue as with the old probe helper. I was merely stating that
there are existing users (on x86) out there that use it this way, even though broken
generally.

> > Given this is enabled on pretty much all program types, my
> > assumption would be that usage is still more often on kernel memory than user one.
>
> You need to pick one.
>
> If you know it is a user pointer, use strncpy_from_user() (possibly
> with disable_pagefault() aka strncpy_from_user_nofault()).
>
> And if you know it is a kernel pointer, use strncpy_from_unsafe() (aka
> strncpy_from_kernel_nofault()).
>
> You really can't pick the "randomly one or the other guess what I mean " option.

My preference would be to have %s, %sK, %sU for bpf_trace_printk() where the latter two
result in an explicit strncpy_from_kernel_nofault() or strncpy_from_user_nofault()
choice while the %s is converted as per your suggestion and it would still allow for a
grace period to convert existing users to the new variants, similar with what we did on
the bpf_probe_read_kernel() and bpf_probe_read_user() helpers to get this sorted out.

Thanks,
Daniel