Commit eb5fb032 authored by Jiri Olsa's avatar Jiri Olsa Committed by Alexei Starovoitov
Browse files

bpf: Force cookies array to follow symbols sorting 



When user specifies symbols and cookies for kprobe_multi link
interface it's very likely the cookies will be misplaced and
returned to wrong functions (via get_attach_cookie helper).

The reason is that to resolve the provided functions we sort
them before passing them to ftrace_lookup_symbols, but we do
not do the same sort on the cookie values.

Fixing this by using sort_r function with custom swap callback
that swaps cookie values as well.

Fixes: 0236fec5 ("bpf: Resolve symbols with ftrace_lookup_symbols for kprobe multi link")
Signed-off-by: default avatarJiri Olsa <jolsa@kernel.org>
Link: https://lore.kernel.org/r/20220615112118.497303-4-jolsa@kernel.org


Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
parent eb1b2985

kernel/trace/bpf_trace.c

+45 −15
Original line number Diff line number Diff line
@@ -2423,7 +2423,7 @@ kprobe_multi_link_handler(struct fprobe *fp, unsigned long entry_ip, 
	kprobe_multi_link_prog_run(link, entry_ip, regs);

}



static int symbols_cmp(const void *a, const void *b)

static int symbols_cmp_r(const void *a, const void *b, const void *priv)

{

	const char **str_a = (const char **) a;

	const char **str_b = (const char **) b;
@@ -2431,6 +2431,28 @@ static int symbols_cmp(const void *a, const void *b) 
	return strcmp(*str_a, *str_b);

}



struct multi_symbols_sort {

	const char **funcs;

	u64 *cookies;

};



static void symbols_swap_r(void *a, void *b, int size, const void *priv)

{

	const struct multi_symbols_sort *data = priv;

	const char **name_a = a, **name_b = b;



	swap(*name_a, *name_b);



	/* If defined, swap also related cookies. */

	if (data->cookies) {

		u64 *cookie_a, *cookie_b;



		cookie_a = data->cookies + (name_a - data->funcs);

		cookie_b = data->cookies + (name_b - data->funcs);

		swap(*cookie_a, *cookie_b);

	}

}



int bpf_kprobe_multi_link_attach(const union bpf_attr *attr, struct bpf_prog *prog)

{

	struct bpf_kprobe_multi_link *link = NULL;
@@ -2468,38 +2490,46 @@ int bpf_kprobe_multi_link_attach(const union bpf_attr *attr, struct bpf_prog *pr 
	if (!addrs)

		return -ENOMEM;



	ucookies = u64_to_user_ptr(attr->link_create.kprobe_multi.cookies);

	if (ucookies) {

		cookies = kvmalloc_array(cnt, sizeof(*addrs), GFP_KERNEL);

		if (!cookies) {

			err = -ENOMEM;

			goto error;

		}

		if (copy_from_user(cookies, ucookies, size)) {

			err = -EFAULT;

			goto error;

		}

	}



	if (uaddrs) {

		if (copy_from_user(addrs, uaddrs, size)) {

			err = -EFAULT;

			goto error;

		}

	} else {

		struct multi_symbols_sort data = {

			.cookies = cookies,

		};

		struct user_syms us;



		err = copy_user_syms(&us, usyms, cnt);

		if (err)

			goto error;



		sort(us.syms, cnt, sizeof(*us.syms), symbols_cmp, NULL);

		if (cookies)

			data.funcs = us.syms;



		sort_r(us.syms, cnt, sizeof(*us.syms), symbols_cmp_r,

		       symbols_swap_r, &data);



		err = ftrace_lookup_symbols(us.syms, cnt, addrs);

		free_user_syms(&us);

		if (err)

			goto error;

	}



	ucookies = u64_to_user_ptr(attr->link_create.kprobe_multi.cookies);

	if (ucookies) {

		cookies = kvmalloc_array(cnt, sizeof(*addrs), GFP_KERNEL);

		if (!cookies) {

			err = -ENOMEM;

			goto error;

		}

		if (copy_from_user(cookies, ucookies, size)) {

			err = -EFAULT;

			goto error;

		}

	}



	link = kzalloc(sizeof(*link), GFP_KERNEL);

	if (!link) {

		err = -ENOMEM;