From nobody Tue Sep 29 04:43:03 2026 Received: from mail-wm1-f54.google.com (mail-wm1-f54.google.com [209.85.128.54]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 845E84322E6 for ; Wed, 12 Aug 2026 11:12:13 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.54 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786533135; cv=none; b=UncV6PtZrhNCQr6Q77Z3tx/jsdeAQoTk1NzaNEzixq9/g87Md89uAjGlVUnmR5FrhaR83sxHwmyMKYFanHB0fLQrz3qDvuLCJRBegaMxVxgbz3GxFztD8X7tsm3bnIkmcoAWWZ8dTxvSVMIGQx73yvWcnleRv1YDEk6PgpZTX2Y= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786533135; c=relaxed/simple; bh=Ty3tl6DwZMXaLu228b7+91HZQ42Gjl03IlpTNOGQSVM=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=W4ER3AXgzaDigrUXa+BkEXF1QW1N16jlCaJgCCM2OMF1lmtd8UX+A6eQQN7/pNLenbw5Pixlj5qVxYS2DrR+02ad25dhn8doMbMRhw11LBzP4kqcegGkkvAbuo18lnIOm0e/r+QoFcLaQPcDDavQckPRw3JsAfMoRGfIDlWTQc0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=h8a/Ncas; arc=none smtp.client-ip=209.85.128.54 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="h8a/Ncas" Received: by mail-wm1-f54.google.com with SMTP id 5b1f17b1804b1-4954dff6536so6322275e9.0 for ; Wed, 12 Aug 2026 04:12:13 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1786533132; x=1787137932; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=HnziYhdT7UChl1G7MKYkZ/8e/rooUTVlGFzd76e4LeU=; b=h8a/NcasdlogzzOjC+UZbXFUTGEcqGjHlyMLD9MG86cgxbtb3lU+YQh/cVXtAipXnL evp5PyPDdroXVPbBnVtVAtIV4drEqQlrjIDH6hus9/89pPoAot1BxO9eRwUPzdcLcbJz PPiRARL4jSDRBS8z/lVuXvia6oLGSFqqTrt1uLhU7QAZ6e5vc4pfoJhhe8gSnyeZoxHq KQT7wFV5TGPCcWb0mEMh1v79RDhX+XNBDW8qjO/cmNuPqV7Xvli2NLIl7yqzKFqDRcgw Wc7EHDol2M4HZikrT5R1vqG0amcWNQQ21TjAL1pgRBxgl8S9C5VQr7Yrrm6c1t5agtLu gWLA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786533132; x=1787137932; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=HnziYhdT7UChl1G7MKYkZ/8e/rooUTVlGFzd76e4LeU=; b=OCmd7ah2jMDhr1qqMAyjFwIpqXd3iqIaZFC3EhI/ktQL1eA9ZIqpi2KasvcpTIt0aS GnsDy36WRwSDh9ofXenXTp3eVpst7nHyhSDyINade5hRTAqN06rS2QKwHRXKP/jInPpl ItLUVNUJOuTn60PfXcHXAKZ3+3Jio2IzErYcIIgnyzhs8IJ+VTEQV6zMqE1v3yg8KBkz UjRGPyeJzlot8MABezDN13lJc+5cfApOBnvv5h3lLQroEsR8mq9BcT9AVRFvR1Ukokd+ PTzj7B0HdymWVCaxvYzJNv5ShSKBQZ+vGFJqt+HRP2EY9JftRCeTmCWh97vqgNIPWlU2 ea1g== X-Gm-Message-State: AOJu0YwQIoRKCYUSIEPpSJR8XGcGGBGxhz0wGTVpKsAFsrDBnbSYFf6u 2JTR8TNtESjmap0s8V4C61YAGzIbJF6f9JwvamVkGlRwesM7QEoMstHY3+T9cdXW X-Gm-Gg: AR+sD12cINU+TE6OMppsjL3oMwELdCcqicO2VOTrtk4LwuKLQk8otPJaPfc834DBd9Q q64aCG3qL9AOhDsle+xypS6EtCpFW04nrbPNENNOc8zv0DXitjUJDjYfOGS554PdenrOEf0XO6a sWDhKd39Yxpvfn1602R2okhji3aiShPAnVK3DFc3RjDCdU7TbpsOeWk0znHzTZigu6bzGzGcqsN DnSAHH1gdvtnFrwgAXWi1oa63+/HLCKesaEsnrnWtClKd8C/rfUQWKz3T6ArXDRmjoKZc5spgia DLQu4U0IHyG4y59uyEwL1VRAJoSwharvWMYvWe+8xuyN7PEwETLDKgzV5tw1nsNgXmz2OtrnurN xnWS1KzrPa4TFE0xBb+dgC2v+dOE2hMadtA/3m7cHemVaGMSLTX+bhEZVMrHu465TZEruVWtos0 vNKQrSepPBorNuzilJ7Tp63IX6im39Hw76YdvoR7LGj4D73Aw5KAwX+js9a2pDn+hfiF0k9APeS jRD X-Received: by 2002:a05:600c:4690:b0:490:c6c2:52 with SMTP id 5b1f17b1804b1-4997c0fe67cmr52327655e9.3.1786533131316; Wed, 12 Aug 2026 04:12:11 -0700 (PDT) Received: from dell-desktop ([2a02:587:4b5e:1100:7303:647d:7cc4:8552]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4997c9417bcsm54830855e9.4.2026.08.12.04.12.09 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 12 Aug 2026 04:12:10 -0700 (PDT) From: Anastasios Papagiannis To: bpf@vger.kernel.org Cc: linux-kernel@vger.kernel.org, linux-mm@kvack.org, linux-fsdevel@vger.kernel.org, viro@zeniv.linux.org.uk, brauner@kernel.org, akpm@linux-foundation.org, david@kernel.org, ast@kernel.org, daniel@iogearbox.net, andrii@kernel.org, eddyz87@gmail.com, memxor@gmail.com, kpsingh@kernel.org, matt@bobrowski.net, song@kernel.org, tasos.papagiannnis@gmail.com Subject: [PATCH bpf-next 1/3] mm: Add copy_remote_mm_str() Date: Wed, 12 Aug 2026 14:11:38 +0300 Message-ID: <20260812111140.7762-2-tasos.papagiannnis@gmail.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260812111140.7762-1-tasos.papagiannnis@gmail.com> References: <20260812111140.7762-1-tasos.papagiannnis@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" copy_remote_vm_str() gets the target address space from a struct task_struct. This does not work for an address space that exists but is not yet associated with a task_struct, such as the mm held by struct linux_binprm during exec. Add copy_remote_mm_str(), which operates directly on a struct mm_struct. Signed-off-by: Anastasios Papagiannis --- include/linux/mm.h | 2 ++ mm/memory.c | 25 ++++++++++++++++++++++++- mm/nommu.c | 25 ++++++++++++++++++++++++- 3 files changed, 50 insertions(+), 2 deletions(-) diff --git a/include/linux/mm.h b/include/linux/mm.h index 485df9c2dbdd..eede435bf4a3 100644 --- a/include/linux/mm.h +++ b/include/linux/mm.h @@ -3222,6 +3222,8 @@ extern int access_remote_vm(struct mm_struct *mm, uns= igned long addr, void *buf, int len, unsigned int gup_flags); =20 #ifdef CONFIG_BPF_SYSCALL +extern int copy_remote_mm_str(struct mm_struct *mm, unsigned long addr, + void *buf, int len, unsigned int gup_flags); extern int copy_remote_vm_str(struct task_struct *tsk, unsigned long addr, void *buf, int len, unsigned int gup_flags); #endif diff --git a/mm/memory.c b/mm/memory.c index 6b8280cfc1db..a70c43d9b17e 100644 --- a/mm/memory.c +++ b/mm/memory.c @@ -7218,6 +7218,29 @@ static int __copy_remote_vm_str(struct mm_struct *mm= , unsigned long addr, return buf - old_buf; } =20 +/** + * copy_remote_mm_str - copy a string from a remote address space. + * @mm: the remote address space + * @addr: start address to read from + * @buf: destination buffer + * @len: number of bytes to copy + * @gup_flags: flags modifying lookup behaviour + * + * The caller must hold a reference on @mm. + * + * Return: number of bytes copied from @addr (source) to @buf (destination= ), + * not including the trailing NUL. Always guarantees a NUL-terminated buff= er. + * On any error, return -EFAULT. + */ +int copy_remote_mm_str(struct mm_struct *mm, unsigned long addr, + void *buf, int len, unsigned int gup_flags) +{ + if (unlikely(len =3D=3D 0)) + return 0; + + return __copy_remote_vm_str(mm, addr, buf, len, gup_flags); +} + /** * copy_remote_vm_str - copy a string from another process's address space. * @tsk: the task of the target address space @@ -7247,7 +7270,7 @@ int copy_remote_vm_str(struct task_struct *tsk, unsig= ned long addr, return -EFAULT; } =20 - ret =3D __copy_remote_vm_str(mm, addr, buf, len, gup_flags); + ret =3D copy_remote_mm_str(mm, addr, buf, len, gup_flags); =20 mmput(mm); =20 diff --git a/mm/nommu.c b/mm/nommu.c index ed3934bc2de4..8fbe6306d074 100644 --- a/mm/nommu.c +++ b/mm/nommu.c @@ -1752,6 +1752,29 @@ static int __copy_remote_vm_str(struct mm_struct *mm= , unsigned long addr, return ret; } =20 +/** + * copy_remote_mm_str - copy a string from a remote address space. + * @mm: the remote address space + * @addr: start address to read from + * @buf: destination buffer + * @len: number of bytes to copy + * @gup_flags: flags modifying lookup behaviour (unused) + * + * The caller must hold a reference on @mm. + * + * Return: number of bytes copied from @addr (source) to @buf (destination= ), + * not including the trailing NUL. Always guarantees a NUL-terminated buff= er. + * On any error, return -EFAULT. + */ +int copy_remote_mm_str(struct mm_struct *mm, unsigned long addr, + void *buf, int len, unsigned int gup_flags) +{ + if (unlikely(len =3D=3D 0)) + return 0; + + return __copy_remote_vm_str(mm, addr, buf, len); +} + /** * copy_remote_vm_str - copy a string from another process's address space. * @tsk: the task of the target address space @@ -1781,7 +1804,7 @@ int copy_remote_vm_str(struct task_struct *tsk, unsig= ned long addr, return -EFAULT; } =20 - ret =3D __copy_remote_vm_str(mm, addr, buf, len); + ret =3D copy_remote_mm_str(mm, addr, buf, len, gup_flags); =20 mmput(mm); =20 --=20 2.55.0 From nobody Tue Sep 29 04:43:03 2026 Received: from mail-wr1-f44.google.com (mail-wr1-f44.google.com [209.85.221.44]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D1E42431E4F for ; Wed, 12 Aug 2026 11:12:16 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.221.44 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786533138; cv=none; b=uDMf9oTJe0EktF8nZwwS7qNERdUSyJ4/63DYI4MfF9AINaZ90Te8xrqCt85xTg10owSedTYLxyGsfsGDkKyWS/IcvCmvMX5biQ60HZx7vJN5KFxeg7JD5ykDOOfBDoEn79HwG8ycoHqwq+79jthtVmQwcWTrFbodWytD1rUhr/M= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786533138; c=relaxed/simple; bh=k8/yplRnzE3pBIdaL5LYAtd3u12jn0e747+hUY3CrZE=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=C71+lA3+NXc27sxfVPL43K/W1rnnNP8iofs2m3O4gmZr2aBL8sIGrbqQKuT9PkeuGMczGENY24FohyKxWy106J1n0hh9jxDRtMYBQShU3PrQ4q2drbHNe0s69qQc9f6aG6QT+iijIc6jlMbyThL7f7ex1mKKNtTo02lKjUa+Im0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=rFFTb4HY; arc=none smtp.client-ip=209.85.221.44 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="rFFTb4HY" Received: by mail-wr1-f44.google.com with SMTP id ffacd0b85a97d-47db714766aso1213564f8f.0 for ; Wed, 12 Aug 2026 04:12:16 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1786533135; x=1787137935; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=9ZYIXmkyCBXJa09C5v4nt5nRF4vm0/NWKF3uSvZo5n4=; b=rFFTb4HYHa+0hm+npsiUYCcbS0IkUUWJmYJDmPduhEuyWbALQOGMPe3h8d6yi1+P6Y PL2fgHbNLpPQ5ZZaXCC1NJdzXjJ43nIzpZC8D5aUFGKKdNeSeS2/ZiD73QaUfVY3U+CQ 4oHoITtChUXaqWVKeIT+fYNJ0KcTVYfh4CyTM2kRusiuim8sg2NOrz3yC33IcoKRQiMw gE0WblKqbekFE3uGWtE4vcZWdJwP9otr331udA0NnrfeANzrHo3G0/FDyrk9sNlzoTEr sAHfB5/VvODwsGdkIdhGlrna5mhflMD1D5DK1GOMmx3oSeCUSSwBGHjCkO3zxrST9YmJ G46g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786533135; x=1787137935; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=9ZYIXmkyCBXJa09C5v4nt5nRF4vm0/NWKF3uSvZo5n4=; b=D1f769zztkCSnz2K2pi6zSFfkIKMzlIYcX8FhPLi2snqtKhm1ucx/4vwQAlc8nVhPs YCqPJufmYqeAxsSL0bql0l/K/n4oNWNhLPYmHBwqkYPOYENKUfOgxSnI+D5xi/ydb4a3 mh2m7mR59K42qFZ9bTF14n3OKQcHeUfcW8j8UqQam57D5ycGKXvtOXd+ViIPUMS6vfmQ IJq+M3wBQlSjAHFxzKaGgQarhl5XYxG2jZ0BmN0okXV88nsVxDkdtqProrHBm+e0NLQa fzO2+dvbyW+SbIMZFU4RwPczCTiHq3RwqObQx7o3ojxsmt+DWO32+U6WxaodCUQD21T2 iEQQ== X-Gm-Message-State: AOJu0Yw69XdymMDZjCpt5FP6JSO6M/JpBf1ED9hKfYrnYw3n0ttNMHNb RdeLcN5Dasim4DkCrVPq/Xswlp7CsiRatOjKs80Hjc2wPNlqh+805e1ZjmEmDvN/ X-Gm-Gg: AR+sD11NBTBNtCY7GVFCd5/HxtZ2q5vsVRWCKvuclepnaNm1pIvEius6ENPn1+5sFfM UhsY4pdMens1LAI83bWt6poYrv4RtgBlJV1j/fMe5LX8bI3lUvBvu3jQuS3u4FcQiqAtD68wAGF Hcd9duqK1B+Fi/EhiXGruPvnFvHUzBq7jy1Wye4wzpWTweSwfNuus2+AFoO1V6ZBsk8q9i9GiJ+ V8kCFMk/LG+L3OV+TBkHBNA8Bw8NNrc4WRKMUEaGMTsstYwvtCDg7Glw6B7DMACk7NXyOvaxTUS Bq62yZaAd0WtMVS6xToPW2JzjwzWHxSeydsNUkcifGOxh7/7E6W5/mInM8fqq9277IUTZCaVy4b bG2XoOwzSFQSZQbBvM9uEDt4XxCL2/HLZWsw7jGHiSUBJDLOCJTYo9yOy0KT7ZrAip/wgZX/1tP 0n0bhqyAvEXcOqucnY3kt3R3j44O7RvSHsMP6B8+UsmsuHxYW6Y9Hhi0EVvek3bSElJOpV4WpLd hOo X-Received: by 2002:a05:600c:1d0a:b0:499:59fd:dbfc with SMTP id 5b1f17b1804b1-4997c379313mr43300375e9.1.1786533134636; Wed, 12 Aug 2026 04:12:14 -0700 (PDT) Received: from dell-desktop ([2a02:587:4b5e:1100:7303:647d:7cc4:8552]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4997c9417bcsm54830855e9.4.2026.08.12.04.12.13 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 12 Aug 2026 04:12:14 -0700 (PDT) From: Anastasios Papagiannis To: bpf@vger.kernel.org Cc: linux-kernel@vger.kernel.org, linux-mm@kvack.org, linux-fsdevel@vger.kernel.org, viro@zeniv.linux.org.uk, brauner@kernel.org, akpm@linux-foundation.org, david@kernel.org, ast@kernel.org, daniel@iogearbox.net, andrii@kernel.org, eddyz87@gmail.com, memxor@gmail.com, kpsingh@kernel.org, matt@bobrowski.net, song@kernel.org, tasos.papagiannnis@gmail.com Subject: [PATCH bpf-next 2/3] bpf: Add user memory access kfuncs for linux_binprm Date: Wed, 12 Aug 2026 14:11:39 +0300 Message-ID: <20260812111140.7762-3-tasos.papagiannnis@gmail.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260812111140.7762-1-tasos.papagiannnis@gmail.com> References: <20260812111140.7762-1-tasos.papagiannnis@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" When security_bprm_check runs, the arg and env strings for the exec have been copied into bprm->mm. The new address space has not been associated yet with a task_struct until exec_mmap(), so existing BPF user memory helpers can only read from the calling task's old address space. This patch adds bpf_copy_from_user_bprm() and bpf_copy_from_user_bprm_str() kfuncs. Both use the mm_struct provided by struct linux_binprm. Register these kfuncs only when CONFIG_MMU is enabled. On NOMMU systems, exec arguments are staged in bprm->page[] rather than mapped in bprm->mm, so these accessors cannot read them. bpf_copy_from_user_bprm() has similar semantics as bpf_copy_from_user_task(). bpf_copy_from_user_bprm_str() copies one NUL-terminated string and returns its size including the NUL terminator. It accepts BPF_F_PAD_ZEROS to clear unused destination bytes on success. This patch registers both kfuncs with KF_SLEEPABLE because accessing the remote address space can fault. This allows BPF LSM programs attached to security_bprm_check to read arguments beginning at bprm->p and reject an exec based on its command-line arguments. Signed-off-by: Anastasios Papagiannis --- fs/bpf_fs_kfuncs.c | 112 +++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 112 insertions(+) diff --git a/fs/bpf_fs_kfuncs.c b/fs/bpf_fs_kfuncs.c index f1863a891db6..74befdadad68 100644 --- a/fs/bpf_fs_kfuncs.c +++ b/fs/bpf_fs_kfuncs.c @@ -1,6 +1,7 @@ // SPDX-License-Identifier: GPL-2.0 /* Copyright (c) 2024 Google LLC. */ =20 +#include #include #include #include @@ -379,6 +380,112 @@ __bpf_kfunc struct inode *bpf_real_data_inode(struct = file *file) return d_real_inode(file_dentry(file)); } =20 +/** + * bpf_copy_from_user_bprm - Copy data from a binary parameter address spa= ce + * @dst: Destination address, in kernel space + * @dst__sz: Number of bytes to copy + * @unsafe_ptr__ign: Source address in the binary parameter address space + * @bprm: Binary parameters whose address space will be used + * @flags: Reserved for future use; must be zero + * + * Copies data from the nascent address space associated with @bprm. This = is + * useful for reading the argument and environment strings before the new + * address space is installed by exec_mmap(). For example, at the + * bprm_check_security LSM hook, @bprm->p points at the first argument str= ing. + * + * The destination is zeroed if the requested number of bytes cannot be co= pied + * in full. + * + * Return: 0 on success, -EINVAL if @flags is non-zero, or -EFAULT if the = copy + * fails or is partial. + */ +__bpf_kfunc int bpf_copy_from_user_bprm(void *dst, u32 dst__sz, + const void __user *unsafe_ptr__ign, + const struct linux_binprm *bprm, u64 flags) +{ + struct mm_struct *mm; + int ret; + + if (unlikely(flags)) + return -EINVAL; + + if (unlikely(!dst__sz)) + return 0; + + mm =3D bprm->mm; + if (!mm) { + memset(dst, 0, dst__sz); + return -EFAULT; + } + + ret =3D access_remote_vm(mm, (unsigned long)unsafe_ptr__ign, + dst, dst__sz, 0); + if (ret !=3D dst__sz) { + memset(dst, 0, dst__sz); + return -EFAULT; + } + + return 0; +} + +/** + * bpf_copy_from_user_bprm_str - Copy a string from binary parameter memory + * @dst: Destination address, in kernel space. This buffer mus= t be + * at least @dst__sz bytes long + * @dst__sz: Maximum number of bytes to copy, including the traili= ng NUL + * @unsafe_ptr__ign: Source address in the binary parameter address space + * @bprm: Binary parameters whose address space will be used + * @flags: The only supported flag is BPF_F_PAD_ZEROS + * + * Copies a NUL-terminated string from the nascent address space associated + * with @bprm. If the string is too long, @dst is still NUL-terminated unl= ess + * @dst__sz is zero. + * + * If BPF_F_PAD_ZEROS is set, the unused portion of @dst is cleared on suc= cess + * and all of @dst is cleared on failure. + * + * Return: The number of copied bytes including the NUL terminator on succ= ess, + * or a negative error code on failure. + */ +__bpf_kfunc int bpf_copy_from_user_bprm_str(void *dst, u32 dst__sz, + const void __user *unsafe_ptr__ign, + const struct linux_binprm *bprm, + u64 flags) +{ + struct mm_struct *mm; + int ret; + + if (unlikely(flags & ~BPF_F_PAD_ZEROS)) + return -EINVAL; + + if (unlikely(!dst__sz)) + return 0; + + mm =3D bprm->mm; + if (!mm) { + if (flags & BPF_F_PAD_ZEROS) + memset(dst, 0, dst__sz); + else + *(char *)dst =3D '\0'; + + return -EFAULT; + } + + ret =3D copy_remote_mm_str(mm, (unsigned long)unsafe_ptr__ign, + dst, dst__sz, 0); + if (ret < 0) { + if (flags & BPF_F_PAD_ZEROS) + memset(dst, 0, dst__sz); + + return ret; + } + + if (flags & BPF_F_PAD_ZEROS) + memset(dst + ret, 0, dst__sz - ret); + + return ret + 1; +} + __bpf_kfunc_end_defs(); =20 BTF_KFUNCS_START(bpf_fs_kfunc_set_ids) @@ -390,6 +497,11 @@ BTF_ID_FLAGS(func, bpf_get_file_xattr, KF_SLEEPABLE) BTF_ID_FLAGS(func, bpf_set_dentry_xattr, KF_SLEEPABLE) BTF_ID_FLAGS(func, bpf_remove_dentry_xattr, KF_SLEEPABLE) BTF_ID_FLAGS(func, bpf_real_data_inode, KF_SLEEPABLE | KF_RET_NULL) +#ifdef CONFIG_MMU +/* NOMMU keeps the staged arguments in bprm->page[], not bprm->mm. */ +BTF_ID_FLAGS(func, bpf_copy_from_user_bprm, KF_SLEEPABLE) +BTF_ID_FLAGS(func, bpf_copy_from_user_bprm_str, KF_SLEEPABLE) +#endif BTF_KFUNCS_END(bpf_fs_kfunc_set_ids) =20 static int bpf_fs_kfuncs_filter(const struct bpf_prog *prog, u32 kfunc_id) --=20 2.55.0 From nobody Tue Sep 29 04:43:03 2026 Received: from mail-wm1-f41.google.com (mail-wm1-f41.google.com [209.85.128.41]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 78E30432BC2 for ; Wed, 12 Aug 2026 11:12:19 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.41 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786533141; cv=none; b=OI4RKfxf/YFP20VPSTRPzoocQf4OQSQ8y5EP/BQBiT0066kQJxAQ6k8sWB1V7iByT6KCr3E+HmbOtyXkLZV8fpELV309XCRymJm2yNb4oCAqx9h6B1ZtaRN8CcKNXmmMIXy+kIHATVANnX5VRBmWUwMFgzUOm8eaErWXk19MKP0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786533141; c=relaxed/simple; bh=Vt4B7VdAPzg3HHiMRpJdUpbR4PPcaOpFgQUR4MjJ044=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=lwmEpmFN4JTQ9KB/RcNsiiXO+0aHMCY+bAIwnuGGElHXNoWHtfYi7BQLTbXoQnaGbFe2kUKl5zWDcyePr1NW4vd4W9gLFnVmb2lAWdsRVvHiuPQYXL0Rd98xCDk3qnGB/1bwlL9qg4TPrNhaBd0HNkCcn/dXadZexHi9fMLK+uY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=JlY9sLDW; arc=none smtp.client-ip=209.85.128.41 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="JlY9sLDW" Received: by mail-wm1-f41.google.com with SMTP id 5b1f17b1804b1-496bb7cdf51so9303455e9.2 for ; Wed, 12 Aug 2026 04:12:19 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1786533138; x=1787137938; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=DniDtpSNvo/ABReRZwqLfy9Ok6b/HLHOLbbY3qeelds=; b=JlY9sLDWDtDapzTzws3QQeLPVJ+VVeOlPjxwE00g4ai3iQtK5L6n8BXAJjWVpV9w8b PC+t3v+TzJiDZBwZkQ6syADHGJbeCWPZwpyIklzbqZhP2JHQNCjpRMGbglPsPv0MdE1Q EsfP52vfTlZaeZMXVZ8+5H9KQKForG8MkEwMb5i6fl/O7cUSE3Mi/HLfbZmT6CXyTR1O MMqe1WLuAg1FasxZxabEGHPue6w7yM2hzeOwX9KQNivzpL7aDp/dxQvb42Yr8mtkyCqC cP1++Fnv8XGOf94gJ4hMkzPY4z/8EbVQ7yV4KB+Ho1t9Va7kpv6k18fJYlxSzp1S5p/i 0qCQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786533138; x=1787137938; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=DniDtpSNvo/ABReRZwqLfy9Ok6b/HLHOLbbY3qeelds=; b=XxJ0nXfL/dpmLDVTRPjflZgeXr6U5zgUvsOk4CWx7s6FxdUFPoZ1cLtyD2qXumI4iu v4Qm4vIlwxro9tZp3KUdup1KRfrcIcbvCoHMNQfKl7/VqJi/l6xzvIcz6ZAFQsDysNK7 iY+S9Owvdh6UV5nRlaL14YqqQZ9dLFvRxM2u31KUbPYy4952lG99Rx+LJZIAYx36OoUa Bp70eJ2IZx994oyguk+LM+7903o+9trmjUzrF7lFXXeCptL2KjFpjwH+zU4+AYhv9qn6 jJGUbRCWLwslrkeX75tUsuynTqDxhE3Ex5N4kdspqng14h4pJd8kfN9MlpqB1yzpXZsY AMzQ== X-Gm-Message-State: AOJu0Yy6lgOvXc9wQhe/cZ9zAeeDqmnPp1Hq4ssn9kSPOK9CFPqkJFMu tw3B64KSQWA9+ovasEFkeG2IPL3rmD9/oxMj8Nf1kf1UhsdCcACZU37u X-Gm-Gg: AR+sD10TauNvb1z7MZRgHx9JgNpElT9fDRFbrq8FB8Mp9h+N+4zA5mT6BbRg5Dn68iq gZhbbrex80afyovQM9RbR/76dtbe3Kbx5VyoCrBNfGkxZb2Rh4ArmuDRA3sFO/2pQXEmUStkU5K Hhcswn7mSUqCDDACXbdScvOIgv9kodw4WuCVThhn1j9alkq3vRaHIW1e0g1+7bhc9NAAxN+MqH1 IGCrpo4oG4O09bT+J604Y+SZp6mL/fjaqZV4EsbTYi9+3wNeZjZ0m+1ztWSDLbHBU0P9HvWvp6/ n8vne2+sg9xRv7jtjXmOMyzg/Xr1iLGMR4WxPA3emczR4gFgQW4DzcrKBeX+CCgPHBCSMksFyIW 4hrCuYBsFzeiFrGH4ElOl8DRLIZ/Twfk+1cjK7l54G8zO4oE5nobTYIZmlga6W4KjNNeEL51jrU LPyLtA1zyyobwm8n+pWo+yKBQIA6nKT4nWiu4vQQUkeAOy0WVhKBgGwRE6JcshzRjfGvYvHreGl R3l3nDnAm/lkXw= X-Received: by 2002:a05:600c:6305:b0:495:6396:8b67 with SMTP id 5b1f17b1804b1-4997c0d7658mr46390285e9.4.1786533137639; Wed, 12 Aug 2026 04:12:17 -0700 (PDT) Received: from dell-desktop ([2a02:587:4b5e:1100:7303:647d:7cc4:8552]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4997c9417bcsm54830855e9.4.2026.08.12.04.12.16 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 12 Aug 2026 04:12:17 -0700 (PDT) From: Anastasios Papagiannis To: bpf@vger.kernel.org Cc: linux-kernel@vger.kernel.org, linux-mm@kvack.org, linux-fsdevel@vger.kernel.org, viro@zeniv.linux.org.uk, brauner@kernel.org, akpm@linux-foundation.org, david@kernel.org, ast@kernel.org, daniel@iogearbox.net, andrii@kernel.org, eddyz87@gmail.com, memxor@gmail.com, kpsingh@kernel.org, matt@bobrowski.net, song@kernel.org, tasos.papagiannnis@gmail.com Subject: [PATCH bpf-next 3/3] selftests/bpf: Test linux_binprm user memory kfuncs Date: Wed, 12 Aug 2026 14:11:40 +0300 Message-ID: <20260812111140.7762-4-tasos.papagiannnis@gmail.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260812111140.7762-1-tasos.papagiannnis@gmail.com> References: <20260812111140.7762-1-tasos.papagiannnis@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" This patch adds a sleepable BPF LSM program attached to bprm_check_security to test bpf_copy_from_user_bprm() and bpf_copy_from_user_bprm_str(). Starting at bprm->p, verify that bpf_copy_from_user_bprm() can copy the contiguous NUL-separated argument data. Then use bpf_copy_from_user_bprm_str() to read each argument separately, by advancing the offset based on the returned length. Signed-off-by: Anastasios Papagiannis --- .../bpf/prog_tests/copy_from_user_bprm.c | 52 +++++++++++++ .../selftests/bpf/progs/copy_from_user_bprm.c | 74 +++++++++++++++++++ 2 files changed, 126 insertions(+) create mode 100644 tools/testing/selftests/bpf/prog_tests/copy_from_user_b= prm.c create mode 100644 tools/testing/selftests/bpf/progs/copy_from_user_bprm.c diff --git a/tools/testing/selftests/bpf/prog_tests/copy_from_user_bprm.c b= /tools/testing/selftests/bpf/prog_tests/copy_from_user_bprm.c new file mode 100644 index 000000000000..3d5080a3975e --- /dev/null +++ b/tools/testing/selftests/bpf/prog_tests/copy_from_user_bprm.c @@ -0,0 +1,52 @@ +// SPDX-License-Identifier: GPL-2.0 + +#include +#include +#include + +#include + +#include "copy_from_user_bprm.skel.h" + +void test_copy_from_user_bprm(void) +{ + struct copy_from_user_bprm *skel; + pid_t child; + int status; + + skel =3D copy_from_user_bprm__open_and_load(); + if (!ASSERT_OK_PTR(skel, "open_and_load")) + return; + + if (!ASSERT_OK(copy_from_user_bprm__attach(skel), "attach")) + goto out; + + child =3D fork(); + if (!ASSERT_GE(child, 0, "fork")) + goto out; + + if (!child) { + char *const argv[] =3D { "first", "second-argument", NULL }; + + skel->bss->monitored_pid =3D getpid(); + execv("/bin/true", argv); + _exit(errno); + } + + if (!ASSERT_EQ(waitpid(child, &status, 0), child, "waitpid")) + goto out; + + if (ASSERT_TRUE(WIFEXITED(status), "child_exited")) + ASSERT_EQ(WEXITSTATUS(status), EPERM, "exec_errno"); + + ASSERT_EQ(skel->bss->bprm_argc, 2, "bprm_argc"); + ASSERT_EQ(skel->bss->invalid_flags_ret, -EINVAL, "invalid_flags_ret"); + ASSERT_EQ(skel->bss->copy_ret, 0, "copy_ret"); + ASSERT_EQ(skel->bss->str_arg0_ret, 6, "str_arg0_ret"); + ASSERT_EQ(skel->bss->str_arg1_ret, 16, "str_arg1_ret"); + ASSERT_EQ(skel->bss->args_match, 1, "args_match"); + ASSERT_EQ(skel->bss->str_args_match, 1, "str_args_match"); + +out: + copy_from_user_bprm__destroy(skel); +} diff --git a/tools/testing/selftests/bpf/progs/copy_from_user_bprm.c b/tool= s/testing/selftests/bpf/progs/copy_from_user_bprm.c new file mode 100644 index 000000000000..679363811edc --- /dev/null +++ b/tools/testing/selftests/bpf/progs/copy_from_user_bprm.c @@ -0,0 +1,74 @@ +// SPDX-License-Identifier: GPL-2.0 + +#include "vmlinux.h" + +#include +#include +#include +#include "bpf_misc.h" + +char _license[] SEC("license") =3D "GPL"; + +static const char expected_args[] =3D "first\0second-argument"; +static const char expected_arg0[] =3D "first"; +static const char expected_arg1[] =3D "second-argument"; + +int monitored_pid; +int bprm_argc; +int invalid_flags_ret; +int copy_ret; +int str_arg0_ret; +int str_arg1_ret; +int args_match; +int str_args_match; + +extern int bpf_copy_from_user_bprm(void *dst, u32 dst__sz, + const void *unsafe_ptr__ign, + const struct linux_binprm *bprm, + u64 flags) __ksym; + +extern int bpf_copy_from_user_bprm_str(void *dst, u32 dst__sz, + const void *unsafe_ptr__ign, + const struct linux_binprm *bprm, + u64 flags) __ksym; + +SEC("lsm.s/bprm_check_security") +int BPF_PROG(check_exec_args, struct linux_binprm *bprm, int ret) +{ + u32 pid =3D bpf_get_current_pid_tgid() >> 32; + char args[sizeof(expected_args)]; + char arg0[32]; + char arg1[32]; + + if (ret || pid !=3D monitored_pid) + return ret; + + bprm_argc =3D bprm->argc; + + invalid_flags_ret =3D bpf_copy_from_user_bprm(args, sizeof(args), + (void *)bprm->p, bprm, 1); + + copy_ret =3D bpf_copy_from_user_bprm(args, sizeof(args), + (void *)bprm->p, bprm, 0); + if (copy_ret) + return 0; + + args_match =3D !__builtin_memcmp(args, expected_args, sizeof(expected_arg= s)); + + str_arg0_ret =3D bpf_copy_from_user_bprm_str(arg0, sizeof(arg0), + (void *)bprm->p, bprm, + BPF_F_PAD_ZEROS); + if (str_arg0_ret !=3D sizeof(expected_arg0)) + return 0; + + str_arg1_ret =3D bpf_copy_from_user_bprm_str(arg1, sizeof(arg1), + (void *)(bprm->p + str_arg0_ret), + bprm, BPF_F_PAD_ZEROS); + if (str_arg1_ret !=3D sizeof(expected_arg1)) + return 0; + + str_args_match =3D !__builtin_memcmp(arg0, expected_arg0, sizeof(expected= _arg0)) && + !__builtin_memcmp(arg1, expected_arg1, sizeof(expected_arg1)); + + return args_match && str_args_match ? -EPERM : 0; +} --=20 2.55.0