Re: [PATCH v2 bpf-next 04/11] bpf: Protect probed address based on kptr_restrict setting

From: Andrii Nakryiko <andrii.nakryiko@gmail.com>
To: Yafang Shao <laoar.shao@gmail.com>
Cc: ast@kernel.org, daniel@iogearbox.net, andrii@kernel.org,
	 martin.lau@linux.dev, song@kernel.org, yhs@fb.com,
	john.fastabend@gmail.com,  kpsingh@kernel.org, sdf@google.com,
	haoluo@google.com, jolsa@kernel.org,  quentin@isovalent.com,
	bpf@vger.kernel.org
Subject: Re: [PATCH v2 bpf-next 04/11] bpf: Protect probed address based on kptr_restrict setting
Date: Thu, 8 Jun 2023 16:08:52 -0700	[thread overview]
Message-ID: <CAEf4BzYMnhqguqYCXBfKLzh8S+nAKScqBiG6pFxC8ay2KzfLLw@mail.gmail.com> (raw)
In-Reply-To: <20230608103523.102267-5-laoar.shao@gmail.com>

On Thu, Jun 8, 2023 at 3:35 AM Yafang Shao <laoar.shao@gmail.com> wrote:
>
> The probed address can be accessed by userspace through querying the task
> file descriptor (fd). However, it is crucial to adhere to the kptr_restrict
> setting and refrain from exposing the address if it is not permitted.
>
> Signed-off-by: Yafang Shao <laoar.shao@gmail.com>
> ---
>  kernel/trace/trace_kprobe.c | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
>
> diff --git a/kernel/trace/trace_kprobe.c b/kernel/trace/trace_kprobe.c
> index 59cda19..6564541 100644
> --- a/kernel/trace/trace_kprobe.c
> +++ b/kernel/trace/trace_kprobe.c
> @@ -1551,7 +1551,10 @@ int bpf_get_kprobe_info(const struct perf_event *event, u32 *fd_type,
>         } else {
>                 *symbol = NULL;
>                 *probe_offset = 0;
> -               *probe_addr = (unsigned long)tk->rp.kp.addr;
> +               if (kptr_restrict != 2)
> +                       *probe_addr = (unsigned long)tk->rp.kp.addr;
> +               else
> +                       *probe_addr = 0;

kallsyms_show_value ?

>         }
>         return 0;
>  }
> --
> 1.8.3.1
>