bpf: Force cookies array to follow symbols sorting

When user specifies symbols and cookies for kprobe_multi link
interface it's very likely the cookies will be misplaced and
returned to wrong functions (via get_attach_cookie helper).

The reason is that to resolve the provided functions we sort
them before passing them to ftrace_lookup_symbols, but we do
not do the same sort on the cookie values.

Fixing this by using sort_r function with custom swap callback
that swaps cookie values as well.

Fixes: 0236fec57a15 ("bpf: Resolve symbols with ftrace_lookup_symbols for kprobe multi link")
Signed-off-by: Jiri Olsa <jolsa@kernel.org>
Link: https://lore.kernel.org/r/20220615112118.497303-4-jolsa@kernel.org
Signed-off-by: Alexei Starovoitov <ast@kernel.org>

diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
index 7a13e6a..88589d7 100644 (file)
--- a/kernel/trace/bpf_trace.c
+++ b/kernel/trace/bpf_trace.c
@@ -2423,7 +2423,7 @@ kprobe_multi_link_handler(struct fprobe *fp, unsigned long entry_ip,
        kprobe_multi_link_prog_run(link, entry_ip, regs);
 }
 
-static int symbols_cmp(const void *a, const void *b)
+static int symbols_cmp_r(const void *a, const void *b, const void *priv)
 {
        const char **str_a = (const char **) a;
        const char **str_b = (const char **) b;
@@ -2431,6 +2431,28 @@ static int symbols_cmp(const void *a, const void *b)
        return strcmp(*str_a, *str_b);
 }
 
+struct multi_symbols_sort {
+       const char **funcs;
+       u64 *cookies;
+};
+
+static void symbols_swap_r(void *a, void *b, int size, const void *priv)
+{
+       const struct multi_symbols_sort *data = priv;
+       const char **name_a = a, **name_b = b;
+
+       swap(*name_a, *name_b);
+
+       /* If defined, swap also related cookies. */
+       if (data->cookies) {
+               u64 *cookie_a, *cookie_b;
+
+               cookie_a = data->cookies + (name_a - data->funcs);
+               cookie_b = data->cookies + (name_b - data->funcs);
+               swap(*cookie_a, *cookie_b);
+       }
+}
+
 int bpf_kprobe_multi_link_attach(const union bpf_attr *attr, struct bpf_prog *prog)
 {
        struct bpf_kprobe_multi_link *link = NULL;
@@ -2468,38 +2490,46 @@ int bpf_kprobe_multi_link_attach(const union bpf_attr *attr, struct bpf_prog *pr
        if (!addrs)
                return -ENOMEM;
 
+       ucookies = u64_to_user_ptr(attr->link_create.kprobe_multi.cookies);
+       if (ucookies) {
+               cookies = kvmalloc_array(cnt, sizeof(*addrs), GFP_KERNEL);
+               if (!cookies) {
+                       err = -ENOMEM;
+                       goto error;
+               }
+               if (copy_from_user(cookies, ucookies, size)) {
+                       err = -EFAULT;
+                       goto error;
+               }
+       }
+
        if (uaddrs) {
                if (copy_from_user(addrs, uaddrs, size)) {
                        err = -EFAULT;
                        goto error;
                }
        } else {
+               struct multi_symbols_sort data = {
+                       .cookies = cookies,
+               };
                struct user_syms us;
 
                err = copy_user_syms(&us, usyms, cnt);
                if (err)
                        goto error;
 
-               sort(us.syms, cnt, sizeof(*us.syms), symbols_cmp, NULL);
+               if (cookies)
+                       data.funcs = us.syms;
+
+               sort_r(us.syms, cnt, sizeof(*us.syms), symbols_cmp_r,
+                      symbols_swap_r, &data);
+
                err = ftrace_lookup_symbols(us.syms, cnt, addrs);
                free_user_syms(&us);
                if (err)
                        goto error;
        }
 
-       ucookies = u64_to_user_ptr(attr->link_create.kprobe_multi.cookies);
-       if (ucookies) {
-               cookies = kvmalloc_array(cnt, sizeof(*addrs), GFP_KERNEL);
-               if (!cookies) {
-                       err = -ENOMEM;
-                       goto error;
-               }
-               if (copy_from_user(cookies, ucookies, size)) {
-                       err = -EFAULT;
-                       goto error;
-               }
-       }
-
        link = kzalloc(sizeof(*link), GFP_KERNEL);
        if (!link) {
                err = -ENOMEM;