Re: [PATCH bpf-next 3/3] bpf: Force cookies array to follow symbols sorting

[Andrii Nakryiko]

On Fri, May 27, 2022 at 1:57 PM Jiri Olsa <jolsa@xxxxxxxxxx> wrote:
>
> When user specifies symbols and cookies for kprobe_multi link
> interface it's very likely the cookies will be misplaced and
> returned to wrong functions (via get_attach_cookie helper).
>
> The reason is that to resolve the provided functions we sort
> them before passing them to ftrace_lookup_symbols, but we do
> not do the same sort on the cookie values.
>
> Fixing this by using sort_r function with custom swap callback
> that swaps cookie values as well.
>
> Fixes: 0236fec57a15 ("bpf: Resolve symbols with ftrace_lookup_symbols for kprobe multi link")
> Signed-off-by: Jiri Olsa <jolsa@xxxxxxxxxx>
> ---
>  kernel/trace/bpf_trace.c | 65 ++++++++++++++++++++++++++++++----------
>  1 file changed, 50 insertions(+), 15 deletions(-)
>
> diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
> index 10b157a6d73e..e5c423b835ab 100644
> --- a/kernel/trace/bpf_trace.c
> +++ b/kernel/trace/bpf_trace.c
> @@ -2423,7 +2423,12 @@ kprobe_multi_link_handler(struct fprobe *fp, unsigned long entry_ip,
>         kprobe_multi_link_prog_run(link, entry_ip, regs);
>  }
>
> -static int symbols_cmp(const void *a, const void *b)
> +struct multi_symbols_sort {
> +       const char **funcs;
> +       u64 *cookies;
> +};
> +
> +static int symbols_cmp_r(const void *a, const void *b, const void *priv)
>  {
>         const char **str_a = (const char **) a;
>         const char **str_b = (const char **) b;
> @@ -2431,6 +2436,25 @@ static int symbols_cmp(const void *a, const void *b)
>         return strcmp(*str_a, *str_b);
>  }
>
> +static void symbols_swap_r(void *a, void *b, int size, const void *priv)
> +{
> +       const struct multi_symbols_sort *data = priv;
> +       const char **name_a = a, **name_b = b;
> +       u64 *cookie_a, *cookie_b;
> +
> +       cookie_a = data->cookies + (name_a - data->funcs);
> +       cookie_b = data->cookies + (name_b - data->funcs);
> +
> +       /* swap name_a/name_b and cookie_a/cookie_b values */
> +       swap(*name_a, *name_b);
> +       swap(*cookie_a, *cookie_b);
> +}
> +
> +static int symbols_cmp(const void *a, const void *b)
> +{
> +       return symbols_cmp_r(a, b, NULL);
> +}
> +
>  int bpf_kprobe_multi_link_attach(const union bpf_attr *attr, struct bpf_prog *prog)
>  {
>         struct bpf_kprobe_multi_link *link = NULL;
> @@ -2468,6 +2492,19 @@ int bpf_kprobe_multi_link_attach(const union bpf_attr *attr, struct bpf_prog *pr
>         if (!addrs)
>                 return -ENOMEM;
>
> +       ucookies = u64_to_user_ptr(attr->link_create.kprobe_multi.cookies);
> +       if (ucookies) {
> +               cookies = kvmalloc(size, GFP_KERNEL);
> +               if (!cookies) {
> +                       err = -ENOMEM;
> +                       goto error;
> +               }
> +               if (copy_from_user(cookies, ucookies, size)) {
> +                       err = -EFAULT;
> +                       goto error;
> +               }
> +       }
> +
>         if (uaddrs) {
>                 if (copy_from_user(addrs, uaddrs, size)) {
>                         err = -EFAULT;
> @@ -2480,26 +2517,24 @@ int bpf_kprobe_multi_link_attach(const union bpf_attr *attr, struct bpf_prog *pr
>                 if (err)
>                         goto error;
>
> -               sort(us.syms, cnt, sizeof(*us.syms), symbols_cmp, NULL);
> +               if (cookies) {
> +                       struct multi_symbols_sort data = {
> +                               .cookies = cookies,
> +                               .funcs = us.syms,
> +                       };
> +
> +                       sort_r(us.syms, cnt, sizeof(*us.syms), symbols_cmp_r,
> +                              symbols_swap_r, &data);
> +               } else {
> +                       sort(us.syms, cnt, sizeof(*us.syms), symbols_cmp, NULL);
> +               }

maybe just always do sort_r, swap callback can just check if cookie
array is NULL and if not, additionally swap cookies? why have all
these different callbacks and complicate the code unnecessarily?

> +
>                 err = ftrace_lookup_symbols(us.syms, cnt, addrs);
>                 free_user_syms(&us);
>                 if (err)
>                         goto error;
>         }
>
> -       ucookies = u64_to_user_ptr(attr->link_create.kprobe_multi.cookies);
> -       if (ucookies) {
> -               cookies = kvmalloc(size, GFP_KERNEL);
> -               if (!cookies) {
> -                       err = -ENOMEM;
> -                       goto error;
> -               }
> -               if (copy_from_user(cookies, ucookies, size)) {
> -                       err = -EFAULT;
> -                       goto error;
> -               }
> -       }
> -
>         link = kzalloc(sizeof(*link), GFP_KERNEL);
>         if (!link) {
>                 err = -ENOMEM;
> --
> 2.35.3
>