From: Yonghong Song <yonghong.song@linux.dev>
To: Hou Tao <houtao@huaweicloud.com>, x86@kernel.org, bpf@vger.kernel.org
Cc: Dave Hansen <dave.hansen@linux.intel.com>,
Andy Lutomirski <luto@kernel.org>,
Peter Zijlstra <peterz@infradead.org>,
Thomas Gleixner <tglx@linutronix.de>,
Ingo Molnar <mingo@redhat.com>, Borislav Petkov <bp@alien8.de>,
"H . Peter Anvin" <hpa@zytor.com>,
linux-kernel@vger.kernel.org, xingwei lee <xrivendell7@gmail.com>,
Jann Horn <jannh@google.com>, Sohil Mehta <sohil.mehta@intel.com>,
houtao1@huawei.com
Subject: Re: [PATCH bpf v2 3/3] selftest/bpf: Test the read of vsyscall page under x86-64
Date: Fri, 26 Jan 2024 11:36:48 -0800 [thread overview]
Message-ID: <d4859e88-d105-4de2-b19c-f59bf7bd5e88@linux.dev> (raw)
In-Reply-To: <20240126115423.3943360-4-houtao@huaweicloud.com>
On 1/26/24 3:54 AM, Hou Tao wrote:
> From: Hou Tao <houtao1@huawei.com>
>
> Under x86-64, when using bpf_probe_read_kernel{_str}() or
> bpf_probe_read{_str}() to read vsyscall page, the read may trigger oops,
> so add one test case to ensure that the problem is fixed. Beside those
> four bpf helpers mentioned above, testing the read of vsyscall page by
> using bpf_probe_read_user{_str} and bpf_copy_from_user{_task}() as well.
>
> The test case passes the address of vsyscall page to these six helpers
> and checks whether the returned values are expected:
>
> 1) For bpf_probe_read_kernel{_str}()/bpf_probe_read{_str}(), the
> expected return value is -ERANGE as shown below:
>
> bpf_probe_read_kernel_common
> copy_from_kernel_nofault
> // false, return -ERANGE
> copy_from_kernel_nofault_allowed
>
> 2) For bpf_probe_read_user{_str}(), the expected return value is -EFAULT
> as show below:
>
> bpf_probe_read_user_common
> copy_from_user_nofault
> // false, return -EFAULT
> __access_ok
>
> 3) For bpf_copy_from_user(), the expected return value is -EFAULT:
>
> // return -EFAULT
> bpf_copy_from_user
> copy_from_user
> _copy_from_user
> // return false
> access_ok
>
> 4) For bpf_copy_from_user_task(), the expected return value is -EFAULT:
>
> // return -EFAULT
> bpf_copy_from_user_task
> access_process_vm
> // return 0
> vma_lookup()
> // return 0
> expand_stack()
>
> The occurrence of oops depends on the availability of CPU SMAP [1]
> feature and there are three possible configurations of vsyscall page in
> boot cmd-line: vsyscall={xonly|none|emulate}, so there are totally six
> possible combinations. Under all these combinations, the running of the
> test case succeeds.
>
> [1]: https://en.wikipedia.org/wiki/Supervisor_Mode_Access_Prevention
>
> Signed-off-by: Hou Tao <houtao1@huawei.com>
The first two patches look good to me but I think it would be better
if x86 folks can ack on them. The selftest patch LGTM.
Acked-by: Yonghong Song <yonghong.song@linux.dev>
prev parent reply other threads:[~2024-01-26 19:36 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-01-26 11:54 [PATCH bpf v2 0/3] Fix the read of vsyscall page through bpf Hou Tao
2024-01-26 11:54 ` [PATCH bpf v2 1/3] x86/mm: Move is_vsyscall_vaddr() into asm/vsyscall.h Hou Tao
2024-01-29 23:56 ` Sohil Mehta
2024-01-30 4:20 ` Hou Tao
2024-01-26 11:54 ` [PATCH bpf v2 2/3] x86/mm: Disallow vsyscall page read for copy_from_kernel_nofault() Hou Tao
2024-01-29 23:50 ` Sohil Mehta
2024-01-30 4:18 ` Hou Tao
2024-01-26 11:54 ` [PATCH bpf v2 3/3] selftest/bpf: Test the read of vsyscall page under x86-64 Hou Tao
2024-01-26 19:36 ` Yonghong Song [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=d4859e88-d105-4de2-b19c-f59bf7bd5e88@linux.dev \
--to=yonghong.song@linux.dev \
--cc=bp@alien8.de \
--cc=bpf@vger.kernel.org \
--cc=dave.hansen@linux.intel.com \
--cc=houtao1@huawei.com \
--cc=houtao@huaweicloud.com \
--cc=hpa@zytor.com \
--cc=jannh@google.com \
--cc=linux-kernel@vger.kernel.org \
--cc=luto@kernel.org \
--cc=mingo@redhat.com \
--cc=peterz@infradead.org \
--cc=sohil.mehta@intel.com \
--cc=tglx@linutronix.de \
--cc=x86@kernel.org \
--cc=xrivendell7@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).