hi,
we see broken access to user space with bpf_probe_read/bpf_probe_read_str
helpers on arm64 with 5.4 kernel. The problem is that both helpers try to
read user memory by calling probe_kernel_read, which seems to work on x86
but fails on arm64.
There are several fixes after v5.4 to address this issue.
There was an attempt to fix that in past [1], but it deviated far from
upstream changes.
This patchset tries to follow the upstream changes with 2 notable exceptions:
1) bpf: Add probe_read_{user, kernel} and probe_read_{user, kernel}_str helpers
- this upsgream patch adds new helpers, which we don't need to do,
we just need following functions (and related helper's glue):
bpf_probe_read_kernel_common
bpf_probe_read_kernel_str_common
that implement bpf_probe_read* helpers and receive fix in next
patch below, ommiting any other hunks
2) bpf: rework the compat kernel probe handling
- taking only fixes for functions and realted helper's glue that we took
from patch above, ommiting any other hunks
It's possible to add new helpers and keep the patches closer to upstream,
but I thought trying this way first as RFC without adding any new helpers
into stable kernel, which might possibly end up later with additional fixes.
Also I'm sending this as RFC, because I might be missing some mm related
dependency change, that I'm not aware of.
We tested new kernel with our use case on arm64 and x86.
thanks,
jirka
[1] https://yhbt.net/lore/all/YHGMFzQlHomDtZYG@kroah.com/t/
---
Andrii Nakryiko (1):
bpf: bpf_probe_read_kernel_str() has to return amount of data read on success
Christoph Hellwig (4):
maccess: clarify kerneldoc comments
maccess: rename strncpy_from_unsafe_user to strncpy_from_user_nofault
maccess: rename strncpy_from_unsafe_strict to strncpy_from_kernel_nofault
bpf: rework the compat kernel probe handling
Daniel Borkmann (3):
uaccess: Add strict non-pagefault kernel-space read function
bpf: Add probe_read_{user, kernel} and probe_read_{user, kernel}_str helpers
bpf: Restrict bpf_probe_read{, str}() only to archs where they work
arch/arm/Kconfig | 1 +
arch/arm64/Kconfig | 1 +
arch/x86/Kconfig | 1 +
arch/x86/mm/Makefile | 2 +-
arch/x86/mm/maccess.c | 43 ++++++++++++++++++++++++++++++++++++++
include/linux/uaccess.h | 8 +++++--
init/Kconfig | 3 +++
kernel/trace/bpf_trace.c | 140 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++-----------------------------------------
kernel/trace/trace_kprobe.c | 2 +-
mm/maccess.c | 63 ++++++++++++++++++++++++++++++++++++++++++++++++-------
10 files changed, 207 insertions(+), 57 deletions(-)
create mode 100644 arch/x86/mm/maccess.c
---------- Forwarded message ---------
From: beld zhang
Date: Sun, May 28, 2023 at 2:07 PM
Subject: Re: 6.1.30: thunderbolt: Clear registers properly when auto
clear isn't in use cause call trace after resume
To: Mario Limonciello
On Sun, May 28, 2023 at 8:55 AM Mario Limonciello
<mario.limonciello(a)amd.com> wrote:
>
> This is specific resuming from s2idle, doesn't happen at boot?
>
> Does it happen with hot-plugging or hot-unplugging a TBT3 or USB4 dock too?
>
> In addition to checking mainline, can you please attach a full dmesg to
> somewhere ephemeral like a kernel bugzilla with thunderbolt.dyndbg='+p'
> on the kernel command line set?
>
6.4-rc4:
*) test 1~4 was done with usb hub with ethernet plugged-in
model: UE330, usb 3.0 3-port hub & GIgabit Ether adapter
a rapoo wireless mouse in one of the ports
1) no crash at boot
until [169.099024]
2) no crash after plug an extra usb dock
from [297.004691]
3) no crash after remove it
from [373.273511]
4) crash after suspend/resume: 2 call-stacks
from [438.356253]
5) removed that hub(only ac-power left): NO crash after resume
from [551.820333]
6) plug in the hub(no mouse): NO crash after resume
from [1250.256607]
7) put on mouse: CRASH after resume
from [1311.400963]
mouse model: Rapoo Wireless Optical Mouse 1620
sorry I have no idea how to fill a proper bug report at kernel
bugzilla, hope these shared links work.
btw I have no TB devices to test.
dmesg:
https://drive.google.com/file/d/1bUWnV7q2ziM4tdTzmuGiVuvEzaLcdfKm/view?usp=…
config:
https://drive.google.com/file/d/1It75_AV5tOzfkXXBAX5zAiZMoeJAe0Au/view?usp=…