Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[PW_SID:379653] net: avoid to remove module when its debugfs is being used #56

Closed
wants to merge 25 commits into from

Conversation

tedd-an
Copy link
Owner

@tedd-an tedd-an commented Nov 7, 2020

When debugfs file is opened, its module should not be removed until
it's closed.
Because debugfs internally uses the module's data.
So, it could access freed memory.

In order to avoid panic, it just sets .owner to THIS_MODULE.
So that all modules will be held when its debugfs file is opened.

Test commands:
cat < open.c
#include <unistd.h>
#include <fcntl.h>
#include <stdio.h>

int main(int argc, char *argv[])
{
int fd = open(argv[1], O_RDONLY);

if(fd < 0) {
printf("failed to open\n");
return 1;
}

usleep(3000000);

close(fd);
return 0;
}
EOF
gcc -o open open.c
modprobe netdevsim
echo 1 > /sys/bus/netdevsim/new_device
./open /sys/kernel/debug/netdevsim/netdevsim1/take_snapshot &
modprobe -rv netdevsim

Splat looks like:
[ 75.305876][ T662] BUG: unable to handle page fault for address: fffffbfff8096db4
[ 75.308979][ T662] #PF: supervisor read access in kernel mode
[ 75.311311][ T662] #PF: error_code(0x0000) - not-present page
[ 75.313737][ T662] PGD 1237ee067 P4D 1237ee067 PUD 123612067 PMD 100ba7067 PTE 0
[ 75.316858][ T662] Oops: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN PTI
[ 75.319389][ T662] CPU: 1 PID: 662 Comm: open Not tainted 5.10.0-rc2+ #785
[ 75.322312][ T662] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014
[ 75.326429][ T662] RIP: 0010:full_proxy_release+0xca/0x290
[ 75.328712][ T662] Code: c1 ea 03 80 3c 02 00 0f 85 60 01 00 00 49 8d bc 24 80 00 00 00 4c 8b 73 28 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 71 01 00 00 49 8b 84 24 80 00 00 00 48 85 c0 0f
[ 75.336716][ T662] RSP: 0018:ffff88800400fe48 EFLAGS: 00010a06
[ 75.339153][ T662] RAX: dffffc0000000000 RBX: ffff88810139de00 RCX: ffff88810139de28
[ 75.342419][ T662] RDX: 1ffffffff8096db4 RSI: ffff88810139de00 RDI: ffffffffc04b6da0
[ 75.345629][ T662] RBP: ffff8881168342b0 R08: ffff8881168342b0 R09: ffff888110765300
[ 75.348804][ T662] R10: ffff88800400fe88 R11: ffffed1022ac648a R12: ffffffffc04b6d20
[ 75.352052][ T662] R13: ffff88810139de28 R14: ffff8881054a6d00 R15: ffff888110765300
[ 75.355325][ T662] FS: 00007f937b80f4c0(0000) GS:ffff888118e00000(0000) knlGS:0000000000000000
[ 75.358955][ T662] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 75.361634][ T662] CR2: fffffbfff8096db4 CR3: 0000000004292002 CR4: 00000000003706e0
[ 75.364847][ T662] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 75.368003][ T662] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 75.371259][ T662] Call Trace:
[ 75.372655][ T662] __fput+0x1ff/0x820
[ 75.374316][ T662] ? _raw_spin_unlock_irq+0x24/0x30
[ 75.376454][ T662] task_work_run+0xd3/0x170
[ 75.378268][ T662] exit_to_user_mode_prepare+0x14b/0x150
[ 75.380586][ T662] syscall_exit_to_user_mode+0x40/0x250
[ 75.383015][ T662] entry_SYSCALL_64_after_hwframe+0x44/0xa9
[ 75.385427][ T662] RIP: 0033:0x7f937b3159e4
[ ... ]

v1 -> v2:

  • Rebase
  • Squash patches into per-driver/subsystem

Taehee Yoo (21):
net: set .owner to THIS_MODULE
mac80211: set .owner to THIS_MODULE
cfg80211: set .owner to THIS_MODULE
netdevsim: set .owner to THIS_MODULE
ieee802154: set .owner to THIS_MODULE
i2400m: set .owner to THIS_MODULE
wlcore: set .owner to THIS_MODULE
wl1251: set .owner to THIS_MODULE
iwlwifi: set .owner to THIS_MODULE
iwlegacy: set .owner to THIS_MODULE
rtlwifi: set .owner to THIS_MODULE
ath11k: set .owner to THIS_MODULE
ath10k: set .owner to THIS_MODULE
wcn36xx: set .owner to THIS_MODULE
wil6210: set .owner to THIS_MODULE
cw1200: set .owner to THIS_MODULE
brcmfmac: set .owner to THIS_MODULE
b43legacy: set .owner to THIS_MODULE
b43: set .owner to THIS_MODULE
mwifiex: mwifiex: set .owner to THIS_MODULE
Bluetooth: set .owner to THIS_MODULE

drivers/net/ieee802154/ca8210.c | 3 ++-
drivers/net/netdevsim/dev.c | 2 ++
drivers/net/netdevsim/health.c | 1 +
drivers/net/netdevsim/udp_tunnels.c | 1 +
drivers/net/wimax/i2400m/debugfs.c | 2 ++

apandit and others added 25 commits October 1, 2020 09:02
WCN3991 supports connectable advertisements so we need to add the valid
le states quirk so the 'central-peripheral' role is exposed in
userspace.

Signed-off-by: Abhishek Pandit-Subedi <abhishekpandit@chromium.org>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
AMP_MGR is getting derefernced in hci_phy_link_complete_evt(), when called
from hci_event_packet() and there is a possibility, that hcon->amp_mgr may
not be found when accessing after initialization of hcon.

- net/bluetooth/hci_event.c:4945
The bug seems to get triggered in this line:

bredr_hcon = hcon->amp_mgr->l2cap_conn->hcon;

Fix it by adding a NULL check for the hcon->amp_mgr before checking the ev-status.

Fixes: d5e9119 ("Bluetooth: AMP: Process Physical Link Complete evt")
Reported-and-tested-by: syzbot+0bef568258653cff272f@syzkaller.appspotmail.com
Link: https://syzkaller.appspot.com/bug?extid=0bef568258653cff272f
Signed-off-by: Anmol Karn <anmol.karan123@gmail.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
When h5_close() gets called, the memory allocated for the hu gets
freed only if hu->serdev doesn't exist. This leads to a memory leak.
So when h5_close() is requested, close the serdev device instance and
free the memory allocated to the hu entirely instead.

Fixes: https://syzkaller.appspot.com/bug?extid=6ce141c55b2f7aafd1c4
Reported-by: syzbot+6ce141c55b2f7aafd1c4@syzkaller.appspotmail.com
Tested-by: syzbot+6ce141c55b2f7aafd1c4@syzkaller.appspotmail.com
Signed-off-by: Anant Thazhemadam <anant.thazhemadam@gmail.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
This patch adds workflow files for ci:

[schedule_work.yml]
 - The workflow file for scheduled work
 - Sync the repo with upstream repo and rebase the workflow branch
 - Review the patches in the patchwork and creates the PR if needed

[ci.yml]
 - The workflow file for CI tasks
 - Run CI tests when PR is created
If THIS_MODULE is not set, the module would be removed while debugfs is
being used.
It eventually makes kernel panic.

Fixes: 9e46625 ("batman-adv: Prefix bat_debugfs local static functions with batadv_")
Fixes: 5609c18 ("6lowpan: iphc: add support for stateful compression")
Signed-off-by: Taehee Yoo <ap420073@gmail.com>
If THIS_MODULE is not set, the module would be removed while debugfs is
being used.
It eventually makes kernel panic.

Fixes: e9f207f ("[MAC80211]: Add debugfs attributes.")
Fixes: 4b7679a ("mac80211: clean up rate control API")
Fixes: ec8aa66 ("mac80211: add the minstrel_ht rate control algorithm")
Fixes: 2cae0b6 ("mac80211: add new Minstrel-HT statistic output via csv")
Fixes: d0a77c6 ("mac80211: allow writing TX PN in debugfs")
Fixes: 8f20fc2 ("[MAC80211]: embed key conf in key, fix driver interface")
Fixes: a75b436 ("mac80211: allow controlling aggregation manually")
Fixes: 9399b86 ("mac80211: add debug knobs for fair queuing")
Fixes: e322c07 ("mac80211: debugfs: improve airtime_flags handler readability")
Fixes: 3ace10f ("mac80211: Implement Airtime-based Queue Limit (AQL)")
Fixes: 276d9e8 ("mac80211: debugfs option to force TX status frames")
Fixes: 827b1fb ("mac80211: resume properly, add suspend/resume test")
Signed-off-by: Taehee Yoo <ap420073@gmail.com>
If THIS_MODULE is not set, the module would be removed while debugfs is
being used.
It eventually makes kernel panic.

Fixes: 1ac6130 ("mac80211/cfg80211: move wiphy specific debugfs entries to cfg80211")
Fixes: 80a3511 ("cfg80211: add debugfs HT40 allow map")
Signed-off-by: Taehee Yoo <ap420073@gmail.com>
If THIS_MODULE is not set, the module would be removed while debugfs is
being used.
It eventually makes kernel panic.

Fixes: 82c93a8 ("netdevsim: implement couple of testing devlink health reporters")
Fixes: 424be63 ("netdevsim: add UDP tunnel port offload support")
Fixes: 4418f86 ("netdevsim: implement support for devlink region and snapshots")
Fixes: d3cbb90 ("netdevsim: add ACL trap reporting cookie as a metadata")
Signed-off-by: Taehee Yoo <ap420073@gmail.com>
If THIS_MODULE is not set, the module would be removed while debugfs is
being used.
It eventually makes kernel panic.

Fixes: ded845a ("ieee802154: Add CA8210 IEEE 802.15.4 device driver")
Signed-off-by: Taehee Yoo <ap420073@gmail.com>
If THIS_MODULE is not set, the module would be removed while debugfs is
being used.
It eventually makes kernel panic.

Fixes: c71228c ("i2400m: debugfs controls")
Signed-off-by: Taehee Yoo <ap420073@gmail.com>
If THIS_MODULE is not set, the module would be removed while debugfs is
being used.
It eventually makes kernel panic.

Fixes: f5fc0f8 ("wl1271: add wl1271 driver files")
Fixes: bcca1bb ("wlcore: add debugfs macro to help print fw statistics arrays")
Signed-off-by: Taehee Yoo <ap420073@gmail.com>
If THIS_MODULE is not set, the module would be removed while debugfs is
being used.
It eventually makes kernel panic.

Fixes: 2f01a1f ("wl12xx: add driver")
Fixes: b7339b1 ("wl1251: add tx queue status to debugfs")
Signed-off-by: Taehee Yoo <ap420073@gmail.com>
If THIS_MODULE is not set, the module would be removed while debugfs is
being used.
It eventually makes kernel panic.

Fixes: 5ae212c ("[PATCH] iwlwifi: add read rate scale table debugfs function")
Fixes: 0209dc1 ("[PATCH] iwlwifi: add debugfs rate scale stats")
Fixes: 712b6cf ("iwlwifi: Add debugfs to iwl core")
Fixes: 189a2b5 ("iwlwifi: trigger event log from debugfs")
Fixes: 8ca151b ("iwlwifi: add the MVM driver")
Fixes: 757cf23 ("iwlwifi: mvm: add per rate tx stats")
Fixes: 2b55f43 ("iwlwifi: mvm: Add mem debugfs entry")
Fixes: 93b167c ("iwlwifi: runtime: sync FW and host clocks for logs")
Fixes: 3816745 ("iwlagn: show current rate scale data in debugfs")
Fixes: 87e5666 ("iwlagn: transport handler can register debugfs entries")
Fixes: 16db88b ("iwlagn: move dump_csr and dump_fh to transport layer")
Signed-off-by: Taehee Yoo <ap420073@gmail.com>
If THIS_MODULE is not set, the module would be removed while debugfs is
being used.
It eventually makes kernel panic.

Fixes: be663ab ("iwlwifi: split the drivers for agn and legacy devices 3945/4965")
Fixes: 4bc85c1 ("Revert "iwlwifi: split the drivers for agn and legacy devices 3945/4965"")
Signed-off-by: Taehee Yoo <ap420073@gmail.com>
If THIS_MODULE is not set, the module would be removed while debugfs is
being used.
It eventually makes kernel panic.

Fixes: 610247f ("rtlwifi: Improve debugging by using debugfs")
Signed-off-by: Taehee Yoo <ap420073@gmail.com>
If THIS_MODULE is not set, the module would be removed while debugfs is
being used.
It eventually makes kernel panic.

Fixes: d5c6515 ("ath11k: driver for Qualcomm IEEE 802.11ax devices")
Signed-off-by: Taehee Yoo <ap420073@gmail.com>
If THIS_MODULE is not set, the module would be removed while debugfs is
being used.
It eventually makes kernel panic.

Fixes: 9017445 ("ath10k: add support to configure pktlog filter")
Fixes: 63fb32d ("ath10k: add debugfs entry to configure quiet period")
Fixes: 844fa57 ("ath10k: debugfs file to enable Bluetooth coexistence feature")
Fixes: 348cd95 ("ath10k: add debugfs entry to enable extended tx stats")
Fixes: cc61a1b ("ath10k: enable debugfs provision to enable Peer Stats feature")
Signed-off-by: Taehee Yoo <ap420073@gmail.com>
If THIS_MODULE is not set, the module would be removed while debugfs is
being used.
It eventually makes kernel panic.

Fixes: 8e84c25 ("wcn36xx: mac80211 driver for Qualcomm WCN3660/WCN3680 hardware")
Signed-off-by: Taehee Yoo <ap420073@gmail.com>
If THIS_MODULE is not set, the module would be removed while debugfs is
being used.
It eventually makes kernel panic.

Fixes: 2be7d22 ("wireless: add new wil6210 802.11ad 60GHz driver")
Fixes: 0b39aaf ("wil6210: Tx mgmt frame from debugfs")
Fixes: c5b3a65 ("wil6210: Add support for setting RBUFCAP configuration")
Fixes: 3277213 ("wil6210: ADDBA/DELBA flows")
Fixes: dc16427 ("wil6210: Add pmc debug mechanism memory management")
Fixes: 977c45a ("wil6210: add debugfs to show PMC ring content")
Fixes: ff974e4 ("wil6210: debugfs interface to send raw WMI command")
Fixes: c33407a ("wil6210: manual FW error recovery mode")
Fixes: a24a3d6 ("wil6210: add TX latency statistics")
Fixes: 0c936b3 ("wil6210: add support for link statistics")
Fixes: 10d599a ("wil6210: add support for device led configuration")
Fixes: 12bace7 ("wil6210: extract firmware capabilities from FW file")
Fixes: 13cd9f7 ("wil6210: extract firmware version from file header")
Fixes: fe9ee51 ("wil6210: add support for PCIe D3hot in system suspend")
Fixes: 96c9358 ("wil6210: initialize TX and RX enhanced DMA rings")
Signed-off-by: Taehee Yoo <ap420073@gmail.com>
If THIS_MODULE is not set, the module would be removed while debugfs is
being used.
It eventually makes kernel panic.

Fixes: a910e4a ("cw1200: add driver for the ST-E CW1100 & CW1200 WLAN chipsets")
Signed-off-by: Taehee Yoo <ap420073@gmail.com>
If THIS_MODULE is not set, the module would be removed while debugfs is
being used.
It eventually makes kernel panic.

Fixes: 2f8c8e6 ("brcmfmac: add "reset" debugfs entry for testing reset")
Signed-off-by: Taehee Yoo <ap420073@gmail.com>
If THIS_MODULE is not set, the module would be removed while debugfs is
being used.
It eventually makes kernel panic.

Fixes: 75388ac ("[B43LEGACY]: add mac80211-based driver for legacy BCM43xx devices")
Signed-off-by: Taehee Yoo <ap420073@gmail.com>
If THIS_MODULE is not set, the module would be removed while debugfs is
being used.
It eventually makes kernel panic.

Fixes: e4d6b79 ("[B43]: add mac80211-based driver for modern BCM43xx devices")
Signed-off-by: Taehee Yoo <ap420073@gmail.com>
If THIS_MODULE is not set, the module would be removed while debugfs is
being used.
It eventually makes kernel panic.

Fixes: 5e6e3a9 ("wireless: mwifiex: initial commit for Marvell mwifiex driver")
Signed-off-by: Taehee Yoo <ap420073@gmail.com>
If THIS_MODULE is not set, the module would be removed while debugfs is
being used.
It eventually makes kernel panic.

Fixes: 4b4148e ("Bluetooth: Add support for setting DUT mode")
Fixes: 4b4113d ("Bluetooth: Add debugfs entry for setting vendor diagnostic mode")
Fixes: 300acfd ("Bluetooth: Introduce force_bredr_smp debugfs option for testing")
Fixes: 64dd374 ("Bluetooth: Export SMP selftest result in debugfs")
Fixes: 0886aea ("Bluetooth: Expose debug keys usage setting via debugfs")
Fixes: 134c2a8 ("Bluetooth: Add debugfs entry to show Secure Connections Only mode")
Fixes: b55d1ab ("Bluetooth: Expose quirks through debugfs")
Fixes: 6e07231 ("Bluetooth: Expose Secure Simple Pairing debug mode setting in debugfs")
Fixes: ac34581 ("Bluetooth: Expose current identity information in debugfs")
Fixes: c2aa30d ("Bluetooth: debugfs option to unset MITM flag")
Fixes: 6b8d4a6 ("Bluetooth: 6LoWPAN: Use connected oriented channel instead of fixed one")
Fixes: 6de50f9 ("Bluetooth: Export ECDH selftest result in debugfs")
Signed-off-by: Taehee Yoo <ap420073@gmail.com>
@github-actions
Copy link

github-actions bot commented Nov 7, 2020

checkpatch: PASS

@github-actions
Copy link

github-actions bot commented Nov 7, 2020

checkgitlint: FAIL

Output:

net: set .owner to THIS_MODULE
7: B1 Line exceeds max length (90>80): "Fixes: 9e466250ede3 ("batman-adv: Prefix bat_debugfs local static functions with batadv_")"

mac80211: set .owner to THIS_MODULE
15: B1 Line exceeds max length (84>80): "Fixes: e322c07f8371 ("mac80211: debugfs: improve airtime_flags handler readability")"

cfg80211: set .owner to THIS_MODULE
7: B1 Line exceeds max length (90>80): "Fixes: 1ac61302dcd1 ("mac80211/cfg80211: move wiphy specific debugfs entries to cfg80211")"

netdevsim: set .owner to THIS_MODULE
7: B1 Line exceeds max length (87>80): "Fixes: 82c93a87bf8b ("netdevsim: implement couple of testing devlink health reporters")"
9: B1 Line exceeds max length (85>80): "Fixes: 4418f862d675 ("netdevsim: implement support for devlink region and snapshots")"

wlcore: set .owner to THIS_MODULE
8: B1 Line exceeds max length (84>80): "Fixes: bcca1bbdd412 ("wlcore: add debugfs macro to help print fw statistics arrays")"

iwlwifi: set .owner to THIS_MODULE
7: B1 Line exceeds max length (83>80): "Fixes: 5ae212c9273d ("[PATCH] iwlwifi: add read rate scale table debugfs function")"

iwlegacy: set .owner to THIS_MODULE
7: B1 Line exceeds max length (87>80): "Fixes: be663ab67077 ("iwlwifi: split the drivers for agn and legacy devices 3945/4965")"
8: B1 Line exceeds max length (96>80): "Fixes: 4bc85c1324aa ("Revert "iwlwifi: split the drivers for agn and legacy devices 3945/4965"")"

ath10k: set .owner to THIS_MODULE
9: B1 Line exceeds max length (84>80): "Fixes: 844fa5722712 ("ath10k: debugfs file to enable Bluetooth coexistence feature")"
11: B1 Line exceeds max length (85>80): "Fixes: cc61a1bbbc0e ("ath10k: enable debugfs provision to enable Peer Stats feature")"

wcn36xx: set .owner to THIS_MODULE
7: B1 Line exceeds max length (86>80): "Fixes: 8e84c2582169 ("wcn36xx: mac80211 driver for Qualcomm WCN3660/WCN3680 hardware")"

cw1200: set .owner to THIS_MODULE
7: B1 Line exceeds max length (85>80): "Fixes: a910e4a94f69 ("cw1200: add driver for the ST-E CW1100 & CW1200 WLAN chipsets")"

b43legacy: set .owner to THIS_MODULE
7: B1 Line exceeds max length (89>80): "Fixes: 75388acd0cd8 ("[B43LEGACY]: add mac80211-based driver for legacy BCM43xx devices")"

b43: set .owner to THIS_MODULE
7: B1 Line exceeds max length (83>80): "Fixes: e4d6b7951812 ("[B43]: add mac80211-based driver for modern BCM43xx devices")"

mwifiex: mwifiex: set .owner to THIS_MODULE
7: B1 Line exceeds max length (84>80): "Fixes: 5e6e3a92b9a4 ("wireless: mwifiex: initial commit for Marvell mwifiex driver")"

Bluetooth: set .owner to THIS_MODULE
8: B1 Line exceeds max length (87>80): "Fixes: 4b4113d6dbdb ("Bluetooth: Add debugfs entry for setting vendor diagnostic mode")"
9: B1 Line exceeds max length (87>80): "Fixes: 300acfdec916 ("Bluetooth: Introduce force_bredr_smp debugfs option for testing")"
12: B1 Line exceeds max length (89>80): "Fixes: 134c2a89af22 ("Bluetooth: Add debugfs entry to show Secure Connections Only mode")"
14: B1 Line exceeds max length (93>80): "Fixes: 6e07231a80de ("Bluetooth: Expose Secure Simple Pairing debug mode setting in debugfs")"
15: B1 Line exceeds max length (81>80): "Fixes: ac345813c4ac ("Bluetooth: Expose current identity information in debugfs")"
17: B1 Line exceeds max length (95>80): "Fixes: 6b8d4a6a0314 ("Bluetooth: 6LoWPAN: Use connected oriented channel instead of fixed one")"

@github-actions
Copy link

github-actions bot commented Nov 7, 2020

checkbuildk: PASS

@github-actions github-actions bot force-pushed the workflow branch 2 times, most recently from 3fe3859 to cd5e346 Compare November 10, 2020 08:56
@github-actions github-actions bot force-pushed the workflow branch 25 times, most recently from 76d93ad to 02be5f1 Compare December 7, 2020 15:40
@tedd-an tedd-an closed this Dec 9, 2020
@tedd-an tedd-an deleted the 379653 branch December 9, 2020 07:50
github-actions bot pushed a commit that referenced this pull request Feb 22, 2021
This is required for the qualification test L2CAP/LE/CFC/BV-15-C

Implementation does not allow to set different key size for SMP and
L2CAP, which is needed for a current specification of the test. This fix
workarounds it with the debugfs variable le_l2cap_min_key_size.

Logs from the test when the IUT uses a min and max l2cap encryption key size 16.
$ echo 16 > /sys/kernel/debug/bluetooth/hci0/le_l2cap_min_key_size
The lower tester uses a key size 7.

> ACL Data RX: Handle 99 flags 0x02 dlen 11                #34 [hci0] 25.007392
      SMP: Pairing Request (0x01) len 6
        IO capability: DisplayYesNo (0x01)
        OOB data: Authentication data not present (0x00)
        Authentication requirement: Bonding, No MITM, SC, No Keypresses (0x09)
        Max encryption key size: 7
        Initiator key distribution: <none> (0x00)
        Responder key distribution: <none> (0x00)
< ACL Data TX: Handle 99 flags 0x00 dlen 11                #35 [hci0] 25.007591
      SMP: Pairing Response (0x02) len 6
        IO capability: KeyboardDisplay (0x04)
        OOB data: Authentication data not present (0x00)
        Authentication requirement: Bonding, No MITM, SC, No Keypresses (0x09)
        Max encryption key size: 16
        Initiator key distribution: <none> (0x00)
        Responder key distribution: <none> (0x00)
@ MGMT Event: New Long Term Key (0x000a) plen 37      {0x0001} [hci0] 28.788872
        Store hint: Yes (0x01)
        LE Address: C0:DE:C0:FF:FF:01 (OUI C0-DE-C0)
        Key type: Unauthenticated key from P-256 (0x02)
        Master: 0x00
        Encryption size: 7
        Diversifier: 0000
        Randomizer: 0000000000000000
        Key: 529e11e8c7b9f5000000000000000000

<snip>

After pairing with key size 7, L2CAP connection is requested which
requires key size 16.

> ACL Data RX: Handle 99 flags 0x02 dlen 18                #56 [hci0] 34.998084
      LE L2CAP: LE Connection Request (0x14) ident 3 len 10
        PSM: 244 (0x00f4)
        Source CID: 64
        MTU: 256
        MPS: 284
        Credits: 1
< ACL Data TX: Handle 99 flags 0x00 dlen 18                #57 [hci0] 34.998325
      LE L2CAP: LE Connection Response (0x15) ident 3 len 10
        Destination CID: 0
        MTU: 0
        MPS: 0
        Credits: 0
        Result: Connection refused - insufficient encryption key size (0x0007)

Signed-off-by: Magdalena Kasenberg <magdalena.kasenberg@codecoup.pl>
Reviewed-by: Szymon Janc <szymon.janc@codecoup.pl>
Cc: Szymon Janc <szymon.janc@codecoup.pl>
github-actions bot pushed a commit that referenced this pull request Apr 15, 2022
The BPF STX/LDX instruction uses offset relative to the FP to address
stack space. Since the BPF_FP locates at the top of the frame, the offset
is usually a negative number. However, arm64 str/ldr immediate instruction
requires that offset be a positive number.  Therefore, this patch tries to
convert the offsets.

The method is to find the negative offset furthest from the FP firstly.
Then add it to the FP, calculate a bottom position, called FPB, and then
adjust the offsets in other STR/LDX instructions relative to FPB.

FPB is saved using the callee-saved register x27 of arm64 which is not
used yet.

Before adjusting the offset, the patch checks every instruction to ensure
that the FP does not change in run-time. If the FP may change, no offset
is adjusted.

For example, for the following bpftrace command:

  bpftrace -e 'kprobe:do_sys_open { printf("opening: %s\n", str(arg1)); }'

Without this patch, jited code(fragment):

   0:   bti     c
   4:   stp     x29, x30, [sp, #-16]!
   8:   mov     x29, sp
   c:   stp     x19, x20, [sp, #-16]!
  10:   stp     x21, x22, [sp, #-16]!
  14:   stp     x25, x26, [sp, #-16]!
  18:   mov     x25, sp
  1c:   mov     x26, #0x0                       // #0
  20:   bti     j
  24:   sub     sp, sp, #0x90
  28:   add     x19, x0, #0x0
  2c:   mov     x0, #0x0                        // #0
  30:   mov     x10, #0xffffffffffffff78        // #-136
  34:   str     x0, [x25, x10]
  38:   mov     x10, #0xffffffffffffff80        // #-128
  3c:   str     x0, [x25, x10]
  40:   mov     x10, #0xffffffffffffff88        // #-120
  44:   str     x0, [x25, x10]
  48:   mov     x10, #0xffffffffffffff90        // #-112
  4c:   str     x0, [x25, x10]
  50:   mov     x10, #0xffffffffffffff98        // #-104
  54:   str     x0, [x25, x10]
  58:   mov     x10, #0xffffffffffffffa0        // #-96
  5c:   str     x0, [x25, x10]
  60:   mov     x10, #0xffffffffffffffa8        // #-88
  64:   str     x0, [x25, x10]
  68:   mov     x10, #0xffffffffffffffb0        // #-80
  6c:   str     x0, [x25, x10]
  70:   mov     x10, #0xffffffffffffffb8        // #-72
  74:   str     x0, [x25, x10]
  78:   mov     x10, #0xffffffffffffffc0        // #-64
  7c:   str     x0, [x25, x10]
  80:   mov     x10, #0xffffffffffffffc8        // #-56
  84:   str     x0, [x25, x10]
  88:   mov     x10, #0xffffffffffffffd0        // #-48
  8c:   str     x0, [x25, x10]
  90:   mov     x10, #0xffffffffffffffd8        // #-40
  94:   str     x0, [x25, x10]
  98:   mov     x10, #0xffffffffffffffe0        // #-32
  9c:   str     x0, [x25, x10]
  a0:   mov     x10, #0xffffffffffffffe8        // #-24
  a4:   str     x0, [x25, x10]
  a8:   mov     x10, #0xfffffffffffffff0        // #-16
  ac:   str     x0, [x25, x10]
  b0:   mov     x10, #0xfffffffffffffff8        // #-8
  b4:   str     x0, [x25, x10]
  b8:   mov     x10, #0x8                       // #8
  bc:   ldr     x2, [x19, x10]
  [...]

With this patch, jited code(fragment):

   0:   bti     c
   4:   stp     x29, x30, [sp, #-16]!
   8:   mov     x29, sp
   c:   stp     x19, x20, [sp, #-16]!
  10:   stp     x21, x22, [sp, #-16]!
  14:   stp     x25, x26, [sp, #-16]!
  18:   stp     x27, x28, [sp, #-16]!
  1c:   mov     x25, sp
  20:   sub     x27, x25, #0x88
  24:   mov     x26, #0x0                       // #0
  28:   bti     j
  2c:   sub     sp, sp, #0x90
  30:   add     x19, x0, #0x0
  34:   mov     x0, #0x0                        // #0
  38:   str     x0, [x27]
  3c:   str     x0, [x27, #8]
  40:   str     x0, [x27, #16]
  44:   str     x0, [x27, #24]
  48:   str     x0, [x27, #32]
  4c:   str     x0, [x27, #40]
  50:   str     x0, [x27, #48]
  54:   str     x0, [x27, #56]
  58:   str     x0, [x27, #64]
  5c:   str     x0, [x27, #72]
  60:   str     x0, [x27, #80]
  64:   str     x0, [x27, #88]
  68:   str     x0, [x27, #96]
  6c:   str     x0, [x27, #104]
  70:   str     x0, [x27, #112]
  74:   str     x0, [x27, #120]
  78:   str     x0, [x27, #128]
  7c:   ldr     x2, [x19, #8]
  [...]

Signed-off-by: Xu Kuohai <xukuohai@huawei.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/bpf/20220321152852.2334294-4-xukuohai@huawei.com
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

5 participants