From nobody Mon Sep 28 15:34:28 2026 Received: from mail-wm1-f53.google.com (mail-wm1-f53.google.com [209.85.128.53]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 52249449B28 for ; Thu, 20 Aug 2026 13:18:39 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.53 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787231920; cv=none; b=pmio/ygR3o+f4Qy7Q2S2Y/rWBPqCjRndm8qyGAgsH5du/n//SytprPIEIqHH0fBtWjZlpZi+WcTKy7L3K8fAZornr1gECMVjpr1wwaGlnegd3CQ+mSMeRox+zCYWD97wxgvBKhXF7t/z0Omi1KAbNIqM0MKE+V63t0aF0JR2xHQ= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787231920; c=relaxed/simple; bh=B2fucAtdhxsImTUAGZWjue4CaG9TwF8/ytvWhAOak1g=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Nmb7VvB2tStp/V09JajEzb2ZEDtAeXN13KCfuhdzTzq3hZ1Zg3ox/D537kizt/bZc7D3dZDyUKMP9VViA52Edi334eM/QI/hUZDVGnTHCYHkyFdqpo9wdY+QCvD1qj2UrPqDSZnfDp3vgbZTAz7O8a7Y4rSJLAobMFUl5ZJgRuw= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=SnnW2LK6; arc=none smtp.client-ip=209.85.128.53 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="SnnW2LK6" Received: by mail-wm1-f53.google.com with SMTP id 5b1f17b1804b1-496bb7cdf51so26531145e9.2 for ; Thu, 20 Aug 2026 06:18:39 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1787231918; x=1787836718; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=d/dzYche3n13dnE4ECcGdXysT5dUdq4Uh980G2RdpPA=; b=SnnW2LK6X04KPLB43BPAdE50px/DsktrZGQv28Rbm/D9hpv56ie965uLNyVs32s31v 2QvCsSXjs1vFmKcPDwKn3f4klDreOjO14QLSJqr2o35Btyqpj/aM89kSRjbwGoCnL2AK xU6ZXAYpm9ZfJ7IwM8BxApq+4eFChJlncBQPY9X27EEjTObE5vev5yVuKq4c68MFKJp4 76g09XAp8gjMSSrrUbY1VDfXRI4rQx6rqLSBRNahJwRUaNulTl2C4qt+QQpHKVk77sDN kLC1b4dxVyNlhvolyFOmZHv6Fe6i8hGOK/wVjlWHdUkQHnHT+ML2EHXVeY3GrNANoIWR f5IQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787231918; x=1787836718; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=d/dzYche3n13dnE4ECcGdXysT5dUdq4Uh980G2RdpPA=; b=ZmqlbSfxcxm4B8+tAGTEoPJUlEHn7YkQ+xc6aZQ7NAGHiRC49QGqUNcYE08VPF1dG/ ycDW1jUGauzTmkSz0zo8FXYmIsZAcinLFpjgy6cr2MR7qALRyjCVnWicuKGAwotSPDwz Y5UC7Vm/HczEfGXpkYWvVxygd4kEXWv4thqNn9txVfPL6b1fUgVvbTVoPk8XgrFym3gc bVc2hzkaJ+kg6F/9+qamSUXd9UBF61PRS8xiC2dABXzVnqwLXzEgMZtx0byX0Ojg28Hh JfjrHqnKoJ0jTp8VFoiPRMApHBFaUpB+LgrhQbMRuYv4L1pBkqMDEo9QQ7SCozQccGuv d2zw== X-Gm-Message-State: AOJu0YyLw2sUTFnAQaAy7dv+kPayb/XE8OqnxQFSFY/DIJtmKBjc6Zsf nCfT1kIzvMEVZ7AYnu2bA7u8zUvc98QpgZKQ9UqcY2T+nj6WVTLtc69W X-Gm-Gg: AR+sD125HlnXZvHXfo/sluZ2QzIIrdvBFM8pGKygL4pOj8BnQeeBWcNq4TYTTUniJ3Q Jt2YT24NJj3F6InJIRX5ySfyGRGnhIibs8j+0b4HV59UGoBOQ6yUyYlZ6T8wZgXOPPgqZWrDOiO UYn6CMmZTZwc6HcCAHjau/KAoIjpNps11fhgPlqai52hXqPHnHdv2EfovYflzA5zeofLadfdFzU qkoQ8tM8yH0e03e8GWdzGfYz15cUyIo9VrXbrSZne5AlfRbsYXWHXkZtQHA4gkkQmwen0+C9W7O gI3C3uvoMcNobdCCKF+lp64YrOpkmQfu9heJm362FJhI9MNdlFMYZ9u3ngXUQ3DVQgk1wBkgNd8 TzzWbndlOAbcHl+og24RgcAck0P671AiK7+PNSbISuEjNE21pqtjiwZz8juLfsDA4ytuhVjugIi 1fBwmbG+5jwFXFCtliPcEiftO8W3YWANPeQcbSKiSN8AuB+2SA71cJiUODC4iLLk80m9GTFvmr0 E2DWqEaLQ== X-Received: by 2002:a05:600c:6749:b0:495:6274:56c2 with SMTP id 5b1f17b1804b1-499aa1896f1mr232088665e9.2.1787231917285; Thu, 20 Aug 2026 06:18:37 -0700 (PDT) Received: from dell-desktop ([2a02:587:4b5e:1100:7303:647d:7cc4:8552]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-499aa0e473dsm136027275e9.15.2026.08.20.06.18.35 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 20 Aug 2026 06:18:36 -0700 (PDT) From: Anastasios Papagiannis To: bpf@vger.kernel.org Cc: linux-kernel@vger.kernel.org, linux-mm@kvack.org, linux-fsdevel@vger.kernel.org, viro@zeniv.linux.org.uk, brauner@kernel.org, akpm@linux-foundation.org, david@kernel.org, ast@kernel.org, daniel@iogearbox.net, andrii@kernel.org, eddyz87@gmail.com, memxor@gmail.com, kpsingh@kernel.org, matt@bobrowski.net, song@kernel.org, utilityemal77@gmail.com, tasos.papagiannnis@gmail.com Subject: [PATCH bpf-next v2 1/3] mm: Add copy_remote_mm_str() Date: Thu, 20 Aug 2026 16:17:59 +0300 Message-ID: <20260820131801.68759-2-tasos.papagiannnis@gmail.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260820131801.68759-1-tasos.papagiannnis@gmail.com> References: <20260820131801.68759-1-tasos.papagiannnis@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" copy_remote_vm_str() gets the target address space from a struct task_struct. This does not work for an address space that exists but is not yet associated with a task_struct, such as the mm held by struct linux_binprm during exec. Add copy_remote_mm_str(), which operates directly on a struct mm_struct. Signed-off-by: Anastasios Papagiannis --- include/linux/mm.h | 2 ++ mm/memory.c | 26 +++++++++++++++++++++++++- mm/nommu.c | 26 +++++++++++++++++++++++++- 3 files changed, 52 insertions(+), 2 deletions(-) diff --git a/include/linux/mm.h b/include/linux/mm.h index 485df9c2dbdd..eede435bf4a3 100644 --- a/include/linux/mm.h +++ b/include/linux/mm.h @@ -3222,6 +3222,8 @@ extern int access_remote_vm(struct mm_struct *mm, uns= igned long addr, void *buf, int len, unsigned int gup_flags); =20 #ifdef CONFIG_BPF_SYSCALL +extern int copy_remote_mm_str(struct mm_struct *mm, unsigned long addr, + void *buf, int len, unsigned int gup_flags); extern int copy_remote_vm_str(struct task_struct *tsk, unsigned long addr, void *buf, int len, unsigned int gup_flags); #endif diff --git a/mm/memory.c b/mm/memory.c index 6b8280cfc1db..da0010c4475d 100644 --- a/mm/memory.c +++ b/mm/memory.c @@ -7218,6 +7218,30 @@ static int __copy_remote_vm_str(struct mm_struct *mm= , unsigned long addr, return buf - old_buf; } =20 +/** + * copy_remote_mm_str - copy a string from a remote address space. + * @mm: the remote address space + * @addr: start address to read from + * @buf: destination buffer + * @len: number of bytes to copy + * @gup_flags: flags modifying lookup behaviour + * + * The caller must hold a reference on @mm. + * + * Return: number of bytes copied from @addr (source) to @buf (destination= ), + * not including the trailing NUL. If @len is zero, return 0 without acces= sing + * @buf. Otherwise, @buf is always NUL-terminated. On any error, return + * -EFAULT. + */ +int copy_remote_mm_str(struct mm_struct *mm, unsigned long addr, + void *buf, int len, unsigned int gup_flags) +{ + if (unlikely(len =3D=3D 0)) + return 0; + + return __copy_remote_vm_str(mm, addr, buf, len, gup_flags); +} + /** * copy_remote_vm_str - copy a string from another process's address space. * @tsk: the task of the target address space @@ -7247,7 +7271,7 @@ int copy_remote_vm_str(struct task_struct *tsk, unsig= ned long addr, return -EFAULT; } =20 - ret =3D __copy_remote_vm_str(mm, addr, buf, len, gup_flags); + ret =3D copy_remote_mm_str(mm, addr, buf, len, gup_flags); =20 mmput(mm); =20 diff --git a/mm/nommu.c b/mm/nommu.c index ed3934bc2de4..1fca0bb7f042 100644 --- a/mm/nommu.c +++ b/mm/nommu.c @@ -1752,6 +1752,30 @@ static int __copy_remote_vm_str(struct mm_struct *mm= , unsigned long addr, return ret; } =20 +/** + * copy_remote_mm_str - copy a string from a remote address space. + * @mm: the remote address space + * @addr: start address to read from + * @buf: destination buffer + * @len: number of bytes to copy + * @gup_flags: flags modifying lookup behaviour (unused) + * + * The caller must hold a reference on @mm. + * + * Return: number of bytes copied from @addr (source) to @buf (destination= ), + * not including the trailing NUL. If @len is zero, return 0 without acces= sing + * @buf. Otherwise, @buf is always NUL-terminated. On any error, return + * -EFAULT. + */ +int copy_remote_mm_str(struct mm_struct *mm, unsigned long addr, + void *buf, int len, unsigned int gup_flags) +{ + if (unlikely(len =3D=3D 0)) + return 0; + + return __copy_remote_vm_str(mm, addr, buf, len); +} + /** * copy_remote_vm_str - copy a string from another process's address space. * @tsk: the task of the target address space @@ -1781,7 +1805,7 @@ int copy_remote_vm_str(struct task_struct *tsk, unsig= ned long addr, return -EFAULT; } =20 - ret =3D __copy_remote_vm_str(mm, addr, buf, len); + ret =3D copy_remote_mm_str(mm, addr, buf, len, gup_flags); =20 mmput(mm); =20 --=20 2.55.0 From nobody Mon Sep 28 15:34:28 2026 Received: from mail-wm1-f49.google.com (mail-wm1-f49.google.com [209.85.128.49]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 787FC449B28 for ; Thu, 20 Aug 2026 13:18:45 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.49 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787231927; cv=none; b=HjrIAvlvags86PJ8Vz6YUW4xgz+/tHtVh6iq8/KBjazLpaZCSB0TFgF59O3NJzO19TNa4J1jRxnIW3Uq1gPPiaOhrApH0wYdVpvH3DHrqjiBHYciqjkBfSGi4VT330ShWUlpmOzwaPFtUX/TDMsrVhqC/jbuO7mWf1UqNcHfeEo= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787231927; c=relaxed/simple; bh=5dLODDxq/3apC3tgo/+UYPQ68vpq9esvWORYDhKADVQ=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=hsxT/v3pX//aEgawHhzuKk75Kege1kEF+XX+fFkeWQ901kZ/ypvNv+e8VwTAm8bKxzcgilh5X2X2gvBl9wNqT48sd5KSbb6YDkDRpmijVzVmA7ybWaWefd4X8vq/+PwykAX18hZlORjcTHFbEAtbOEXXXlC/3FAHh5JPmt6qof8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=aHd4v+1u; arc=none smtp.client-ip=209.85.128.49 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="aHd4v+1u" Received: by mail-wm1-f49.google.com with SMTP id 5b1f17b1804b1-49554ebb87dso23525015e9.3 for ; Thu, 20 Aug 2026 06:18:45 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1787231924; x=1787836724; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=QYbEtEXZu+xF5hfb2YmFgZkOm/c5VxJE4N0FZpACyEY=; b=aHd4v+1uttLEp3pD9HKPxwn/VYxpSnvi77YglD+KLVX0nAMKYUjGrXrS4UWFT9Jv7p uiiN6KtPEZyZjeigdlDpKtQGCLkdL9cuEgCJ+h9pClaFbLrw/23hPW2FR4ebF6oKcF7y fXtWBXQjEWTTibkp3A60eoIke1AQ4NbylJlMiz3E5p9skmm/W82yUwwsjO+BWVIi1c+a 2nQOS+ZotStm1amujNMYaxJGwF3tDZsnHudYMPmYQkXlCGs1p2cKxC1aRH1zHYFS4Rx9 h2JJHp+khdq8HcXPLEZ99SM59yS7OpQfbzPBO3zhHdeGqx+I9+jMdzo8tkupDfn+ZZ+j 4Gpg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787231924; x=1787836724; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=QYbEtEXZu+xF5hfb2YmFgZkOm/c5VxJE4N0FZpACyEY=; b=eYmchSLuW08Mstvi2baE/OiBY6SsuIQTE8Xq9atUZubcnK9arFtcdO4QNOnorpaGDO 5FH8GzchEE8WS3sELts+DapXqzDTsfN4IO3Aw3bPOApIKKCLWJeu2XXhTxcQub1xlYP2 9z5bQ2kz4fB8nrWRkSEsCHrpi2dTzxSZDJX50b+krGRCiupAjfDjKPBkulpXy1ycatX3 HdkwzhvOXZFvTeiuCn1zQF7UNTlxdQL/C36riSuYeydKKXr9eGFROWkrrev5NQtt78CM utaiZm7XwqXNj2nldgSMaqILTPzjQmi0P9zsB5c/bXvf5XgQbcdOtQPIevMdknHhQG0J KxZQ== X-Gm-Message-State: AOJu0YzXrGO2hkuGaqeq6TQJG8eYBld/Iv8qU67WtD225oVMLEC6Hmfu /DZM8sZna1NqrZNo8xMyfWbxVHk9FebYdAWjYIZRUK/oIc3T6fE/Q83V X-Gm-Gg: AR+sD10kG++4IFqC6CYxW3W1Rfiz8N7anhm6bWvQdrPrQQBLCz3YSua1ZK6elCJvjES goLZngP5kBmOiv1UO5SzRfNjy4Wu3GSNBJENMokTImqMVwW9PV9+RKEvUwxmmgbjiWG62qNPbJ8 Gh3aFCpN0j/qmngXeFf2BRbBBuUoHFgtvtrstfT615Sl07NzBefhSMdivjxEvE0qf5+v/bGvx6M RKDOyFV0RojdT21+UjANrHn4hFN+qGcjwYnRn2F/Wxn2xGubeHS3I7ddD7FS9qngNS5wzqwfvFg FosGWG+WAu553WRTHPPDt0pEfCYbxN4WfcwfFaQcjVzXv09H5E1S0VxE6FvTCRcjM2JxyPGoEDW PdU9Pn2UsqyPP/hb1JXpkNzs9ZGRvFj6xGZCf7KZEPcPTE0Lqrb27lJTDQbih0L+0cJjqr6ZXAj sk9FB2qnYPeyQwM+Q2KVllcDvaws2GJ3zExfiOPBLeEfnUjAzA3Z21/R4CW0FDQmCBa2kPqm4XX xP4 X-Received: by 2002:a05:600c:a30f:b0:499:b01e:911c with SMTP id 5b1f17b1804b1-499b01e9125mr101732655e9.2.1787231921093; Thu, 20 Aug 2026 06:18:41 -0700 (PDT) Received: from dell-desktop ([2a02:587:4b5e:1100:7303:647d:7cc4:8552]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-499aa0e473dsm136027275e9.15.2026.08.20.06.18.39 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 20 Aug 2026 06:18:40 -0700 (PDT) From: Anastasios Papagiannis To: bpf@vger.kernel.org Cc: linux-kernel@vger.kernel.org, linux-mm@kvack.org, linux-fsdevel@vger.kernel.org, viro@zeniv.linux.org.uk, brauner@kernel.org, akpm@linux-foundation.org, david@kernel.org, ast@kernel.org, daniel@iogearbox.net, andrii@kernel.org, eddyz87@gmail.com, memxor@gmail.com, kpsingh@kernel.org, matt@bobrowski.net, song@kernel.org, utilityemal77@gmail.com, tasos.papagiannnis@gmail.com Subject: [PATCH bpf-next v2 2/3] bpf: Add user memory access kfuncs for linux_binprm Date: Thu, 20 Aug 2026 16:18:00 +0300 Message-ID: <20260820131801.68759-3-tasos.papagiannnis@gmail.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260820131801.68759-1-tasos.papagiannnis@gmail.com> References: <20260820131801.68759-1-tasos.papagiannnis@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" When security_bprm_check runs, the arg and env strings for the exec have been copied into bprm->mm. The new address space has not been associated yet with a task_struct until exec_mmap(), so existing BPF user memory helpers can only read from the calling task's old address space. This patch adds bpf_copy_from_user_bprm() and bpf_copy_from_user_bprm_str() kfuncs. Both use the mm_struct provided by struct linux_binprm. Register these kfuncs on both MMU and NOMMU systems. On NOMMU systems, exec arguments are staged in bprm->page[] rather than mapped in bprm->mm, so the kfuncs return -EOPNOTSUPP. bpf_copy_from_user_bprm() has similar semantics as bpf_copy_from_user_task(). bpf_copy_from_user_bprm_str() copies one NUL-terminated string and returns its size including the NUL terminator. It accepts BPF_F_PAD_ZEROS to clear unused destination bytes on success. This patch registers both kfuncs with KF_SLEEPABLE because accessing the remote address space can fault. This allows BPF LSM programs attached to security_bprm_check to read arguments beginning at bprm->p and reject an exec based on its command-line arguments. Signed-off-by: Anastasios Papagiannis --- fs/bpf_fs_kfuncs.c | 128 +++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 128 insertions(+) diff --git a/fs/bpf_fs_kfuncs.c b/fs/bpf_fs_kfuncs.c index f1863a891db6..1cd06f9e4890 100644 --- a/fs/bpf_fs_kfuncs.c +++ b/fs/bpf_fs_kfuncs.c @@ -1,6 +1,7 @@ // SPDX-License-Identifier: GPL-2.0 /* Copyright (c) 2024 Google LLC. */ =20 +#include #include #include #include @@ -379,6 +380,131 @@ __bpf_kfunc struct inode *bpf_real_data_inode(struct = file *file) return d_real_inode(file_dentry(file)); } =20 +/** + * bpf_copy_from_user_bprm - Copy data from a binary parameter address spa= ce + * @dst: Destination address, in kernel space + * @dst__sz: Number of bytes to copy + * @unsafe_ptr__ign: Source address in the binary parameter address space + * @bprm: Binary parameters whose address space will be used + * @flags: Reserved for future use; must be zero + * + * Copies data from the nascent address space associated with @bprm. This = is + * useful for reading the argument and environment strings before the new + * address space is installed by exec_mmap(). For example, at the + * bprm_check_security LSM hook, @bprm->p points at the first argument str= ing. + * + * The destination is zeroed if the requested number of bytes cannot be co= pied + * in full. + * + * Return: 0 on success, -EINVAL if @flags is non-zero, -EOPNOTSUPP on + * NOMMU systems, or -EFAULT if the copy fails or is partial. + */ +__bpf_kfunc int bpf_copy_from_user_bprm(void *dst, u32 dst__sz, + const void __user *unsafe_ptr__ign, + const struct linux_binprm *bprm, u64 flags) +{ +#ifdef CONFIG_MMU + struct mm_struct *mm; + int ret; +#endif + + if (unlikely(flags)) + return -EINVAL; + + if (unlikely(!dst__sz)) + return 0; + +#ifdef CONFIG_MMU + mm =3D bprm->mm; + if (!mm) { + memset(dst, 0, dst__sz); + return -EFAULT; + } + + ret =3D access_remote_vm(mm, (unsigned long)unsafe_ptr__ign, + dst, dst__sz, 0); + if (ret !=3D dst__sz) { + memset(dst, 0, dst__sz); + return -EFAULT; + } + + return 0; +#else + memset(dst, 0, dst__sz); + return -EOPNOTSUPP; +#endif +} + +/** + * bpf_copy_from_user_bprm_str - Copy a string from binary parameter memory + * @dst: Destination address, in kernel space. This buffer mus= t be + * at least @dst__sz bytes long + * @dst__sz: Maximum number of bytes to copy, including the traili= ng NUL + * @unsafe_ptr__ign: Source address in the binary parameter address space + * @bprm: Binary parameters whose address space will be used + * @flags: The only supported flag is BPF_F_PAD_ZEROS + * + * Copies a NUL-terminated string from the nascent address space associated + * with @bprm. If the string is too long, @dst is still NUL-terminated unl= ess + * @dst__sz is zero. + * + * If BPF_F_PAD_ZEROS is set, the unused portion of @dst is cleared on suc= cess + * and all of @dst is cleared on failure. + * + * Return: The number of copied bytes including the NUL terminator on succ= ess, + * or a negative error code on failure. On NOMMU systems, -EOPNOTSUPP is + * returned. + */ +__bpf_kfunc int bpf_copy_from_user_bprm_str(void *dst, u32 dst__sz, + const void __user *unsafe_ptr__ign, + const struct linux_binprm *bprm, + u64 flags) +{ +#ifdef CONFIG_MMU + struct mm_struct *mm; + int ret; +#endif + + if (unlikely(flags & ~BPF_F_PAD_ZEROS)) + return -EINVAL; + + if (unlikely(!dst__sz)) + return 0; + +#ifdef CONFIG_MMU + mm =3D bprm->mm; + if (!mm) { + if (flags & BPF_F_PAD_ZEROS) + memset(dst, 0, dst__sz); + else + *(char *)dst =3D '\0'; + + return -EFAULT; + } + + ret =3D copy_remote_mm_str(mm, (unsigned long)unsafe_ptr__ign, + dst, dst__sz, 0); + if (ret < 0) { + if (flags & BPF_F_PAD_ZEROS) + memset(dst, 0, dst__sz); + + return ret; + } + + if (flags & BPF_F_PAD_ZEROS) + memset(dst + ret, 0, dst__sz - ret); + + return ret + 1; +#else + if (flags & BPF_F_PAD_ZEROS) + memset(dst, 0, dst__sz); + else + *(char *)dst =3D '\0'; + + return -EOPNOTSUPP; +#endif +} + __bpf_kfunc_end_defs(); =20 BTF_KFUNCS_START(bpf_fs_kfunc_set_ids) @@ -390,6 +516,8 @@ BTF_ID_FLAGS(func, bpf_get_file_xattr, KF_SLEEPABLE) BTF_ID_FLAGS(func, bpf_set_dentry_xattr, KF_SLEEPABLE) BTF_ID_FLAGS(func, bpf_remove_dentry_xattr, KF_SLEEPABLE) BTF_ID_FLAGS(func, bpf_real_data_inode, KF_SLEEPABLE | KF_RET_NULL) +BTF_ID_FLAGS(func, bpf_copy_from_user_bprm, KF_SLEEPABLE) +BTF_ID_FLAGS(func, bpf_copy_from_user_bprm_str, KF_SLEEPABLE) BTF_KFUNCS_END(bpf_fs_kfunc_set_ids) =20 static int bpf_fs_kfuncs_filter(const struct bpf_prog *prog, u32 kfunc_id) --=20 2.55.0 From nobody Mon Sep 28 15:34:28 2026 Received: from mail-wm1-f48.google.com (mail-wm1-f48.google.com [209.85.128.48]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 083A6449B04 for ; Thu, 20 Aug 2026 13:18:46 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.48 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787231928; cv=none; b=ZALvyMR44wo7liM3+xDu/zW1aYreLEX52zR+7BnE5psgVBFEqH8bwkTfnfYdIAX+pPnB5LdFc4XQ7Ll7vnuzLN9oDCkqimsyv+7peDQWWUrJcHjAtIZ2+G2gmIYsxtuv9Le93IHJL2e9zC8HvAvbmknHv8Uvo780g0fxv3NUsC4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787231928; c=relaxed/simple; bh=f/eVcXeoiqfV4jlIqAc69WXM4ZBCO3csmi5dXDXXPOo=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=KMGZtj/q1z6bDfZvRgKaRTbOQCE1KPHA2QIWzxNkbpmLjoteQ+I9gt11DDst6kZCERmtYb3p8ly1suEjGEc2hOuLEBmLGmUBEhdulCULtiVrZkIs6reRAl/RmNhFJYAKXGicBLjRodlFLs9NcWA2h1/tbhTBwRxVpb54TTP2QS8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=QkQDIuaR; arc=none smtp.client-ip=209.85.128.48 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="QkQDIuaR" Received: by mail-wm1-f48.google.com with SMTP id 5b1f17b1804b1-4956242332dso23115125e9.2 for ; Thu, 20 Aug 2026 06:18:46 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1787231925; x=1787836725; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=vR40jF9Ss8LmiP9zSaPNfnunPJsok/mkpHKsfsj1AOo=; b=QkQDIuaR2WKegu2Qgjv7FQom99t505tsPoaT4Q+kXMp5E6f+JIP9/Xk0lUFiAoxUbZ 9VtFXzGW8pc+wDMb3lCcjUOxCRdWwA+O4v2s/rkYC9EgR8M+zOqZC5P4eaBwls2tnX35 IRSIQSD6IuRpH0SQL4FMrpd/6l6vszZoGC0zXzt041D7BQDi9+0iZdvPb9GOIOiwqBqo Ne1+mERowikGOfEydBzkFSOsd7WQjakLitEqlc3OAJR3WOIanYIdTuwC7qZL7Qlm2pqW qdvSMjm7/XwfcR2qRZF0y7j0cIXlVruWTEAiZK015pJvnIHjNRvUuHAkob+DLlsk5/4I geMQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787231925; x=1787836725; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=vR40jF9Ss8LmiP9zSaPNfnunPJsok/mkpHKsfsj1AOo=; b=NXqWRzie0LyKDsnhyuYViGinp+WeP6KK76BnBG9krBI3azrEs9btZxsvbWBJiXxAHY CRM7jOseF1PD0I26joIOeopP9N6nhBLw+H7lY9M2vgVkUbq590vrXz4ix4j1VU+ZZnBA mpc65CAEZcN7uqGVKryg+d/qrCmIOqgyaizvjC76OhMHhltuT957T3y21WKyp/B23NNd L52pwmUHUXT+sdr7f6MKoLNM8RlZo2E1u9ivo7E9wF8JX5shgzXOHKkBmx347bmGHOpM F/yn+VhmW9dR/cpbCD5tJFwMfwbee+EomSavoxwHsxmG7LS+U1xzI59zlRkO/xM1Eqa6 5WJw== X-Gm-Message-State: AOJu0Yx5F0/wHN2O3e5BdAjEeEp56Cm6WHaI6rwfJ5Q1O08SCWGo93fN r9CweO4F2xNiu7jvHb4oyJDVmlS8hoWfmrDk6CPUo2vd68GnmbkPEK43 X-Gm-Gg: AR+sD12itep0fXZgRc/Hc3qxfnmBnZ0m+EsXgQinKjLBKa4k4T7D8aljnYdbS/cxxGZ Z/my7pZFPL9fHuD4AabZP7ooLzMJ6i3/bKE8OuvN3Mhs9+ZTm4uT8Py6cTB4UPbQZ5rrq91eSxS ZzvcaEU6+8EE7jZYnjTqM/I3h5Tkffi4Sj2xUIW7PNwYFGOdAOSfGvXo5lMs8wi689iqSFP/f3F oShmPlGlYOfazyiNEe3nWx5DuoCVl42GmC6dhZkGB1gQWo6wUGcAW/xRywqi8hAGkFL4AaXWzPw mEh69iNXxaskDUp6FDRLp+JwxOdZ1TgIyzoSEzcDOQnDKLU41hsG4Doq8Zgn2mlLO7eoY0t+82I XoldR+Sqt4AWfK0dqBiyg0JD3T45QBKZyOAtcrNBDqJLPHfvjn7h3SOl9Hyz1+zNa/BQtz580DP 3IQSXrjQ3H1OhF+cw7sCak7GhNPd2Y9F/4HAR4cjjzqGo2FdegWe8bxfwcOHqEaKsaOnogNji5Z 1ye X-Received: by 2002:a05:600c:470a:b0:499:a5fc:207e with SMTP id 5b1f17b1804b1-499aa17e2bamr164727435e9.8.1787231924991; Thu, 20 Aug 2026 06:18:44 -0700 (PDT) Received: from dell-desktop ([2a02:587:4b5e:1100:7303:647d:7cc4:8552]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-499aa0e473dsm136027275e9.15.2026.08.20.06.18.43 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 20 Aug 2026 06:18:44 -0700 (PDT) From: Anastasios Papagiannis To: bpf@vger.kernel.org Cc: linux-kernel@vger.kernel.org, linux-mm@kvack.org, linux-fsdevel@vger.kernel.org, viro@zeniv.linux.org.uk, brauner@kernel.org, akpm@linux-foundation.org, david@kernel.org, ast@kernel.org, daniel@iogearbox.net, andrii@kernel.org, eddyz87@gmail.com, memxor@gmail.com, kpsingh@kernel.org, matt@bobrowski.net, song@kernel.org, utilityemal77@gmail.com, tasos.papagiannnis@gmail.com Subject: [PATCH bpf-next v2 3/3] selftests/bpf: Test linux_binprm user memory kfuncs Date: Thu, 20 Aug 2026 16:18:01 +0300 Message-ID: <20260820131801.68759-4-tasos.papagiannnis@gmail.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260820131801.68759-1-tasos.papagiannnis@gmail.com> References: <20260820131801.68759-1-tasos.papagiannnis@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" This patch adds a sleepable BPF LSM program attached to bprm_check_security to test bpf_copy_from_user_bprm() and bpf_copy_from_user_bprm_str(). Starting at bprm->p, verify that bpf_copy_from_user_bprm() can copy the contiguous NUL-separated argument and environment data. Then use bpf_copy_from_user_bprm_str() to read each argument and environment string separately, by advancing the offset based on the returned length. Signed-off-by: Anastasios Papagiannis --- .../bpf/prog_tests/copy_from_user_bprm.c | 62 ++++++++++ .../selftests/bpf/progs/copy_from_user_bprm.c | 115 ++++++++++++++++++ 2 files changed, 177 insertions(+) create mode 100644 tools/testing/selftests/bpf/prog_tests/copy_from_user_b= prm.c create mode 100644 tools/testing/selftests/bpf/progs/copy_from_user_bprm.c diff --git a/tools/testing/selftests/bpf/prog_tests/copy_from_user_bprm.c b= /tools/testing/selftests/bpf/prog_tests/copy_from_user_bprm.c new file mode 100644 index 000000000000..1007e3aec054 --- /dev/null +++ b/tools/testing/selftests/bpf/prog_tests/copy_from_user_bprm.c @@ -0,0 +1,62 @@ +// SPDX-License-Identifier: GPL-2.0 + +#include +#include +#include + +#include + +#include "copy_from_user_bprm.skel.h" + +void test_copy_from_user_bprm(void) +{ + char arg0[] =3D "first"; + char arg1[] =3D "second-argument"; + char env0[] =3D "SOME_ENV=3Da"; + char env1[] =3D "OTHER_ENV=3Dsomething"; + struct copy_from_user_bprm *skel; + pid_t child; + int status; + + skel =3D copy_from_user_bprm__open_and_load(); + if (!ASSERT_OK_PTR(skel, "open_and_load")) + return; + + if (!ASSERT_OK(copy_from_user_bprm__attach(skel), "attach")) + goto out; + + child =3D fork(); + if (!ASSERT_GE(child, 0, "fork")) + goto out; + + if (!child) { + char *const argv[] =3D { arg0, arg1, NULL }; + char *const envp[] =3D { env0, env1, NULL }; + + skel->bss->monitored_pid =3D getpid(); + execve("/bin/true", argv, envp); + _exit(errno); + } + + if (!ASSERT_EQ(waitpid(child, &status, 0), child, "waitpid")) + goto out; + + if (ASSERT_TRUE(WIFEXITED(status), "child_exited")) + ASSERT_EQ(WEXITSTATUS(status), EPERM, "exec_errno"); + + ASSERT_EQ(skel->bss->bprm_argc, 2, "bprm_argc"); + ASSERT_EQ(skel->bss->bprm_envc, 2, "bprm_envc"); + ASSERT_EQ(skel->bss->data_len_match, 1, "data_len_match"); + ASSERT_EQ(skel->bss->invalid_flags_ret, -EINVAL, "invalid_flags_ret"); + ASSERT_EQ(skel->bss->copy_ret, 0, "copy_ret"); + ASSERT_EQ(skel->bss->str_arg0_ret, sizeof(arg0), "str_arg0_ret"); + ASSERT_EQ(skel->bss->str_arg1_ret, sizeof(arg1), "str_arg1_ret"); + ASSERT_EQ(skel->bss->str_env0_ret, sizeof(env0), "str_env0_ret"); + ASSERT_EQ(skel->bss->str_env1_ret, sizeof(env1), "str_env1_ret"); + ASSERT_EQ(skel->bss->data_match, 1, "data_match"); + ASSERT_EQ(skel->bss->str_args_match, 1, "str_args_match"); + ASSERT_EQ(skel->bss->str_envs_match, 1, "str_envs_match"); + +out: + copy_from_user_bprm__destroy(skel); +} diff --git a/tools/testing/selftests/bpf/progs/copy_from_user_bprm.c b/tool= s/testing/selftests/bpf/progs/copy_from_user_bprm.c new file mode 100644 index 000000000000..4d7e9002b45b --- /dev/null +++ b/tools/testing/selftests/bpf/progs/copy_from_user_bprm.c @@ -0,0 +1,115 @@ +// SPDX-License-Identifier: GPL-2.0 + +#include "vmlinux.h" + +#include +#include +#include +#include "bpf_misc.h" + +char _license[] SEC("license") =3D "GPL"; + +static const char expected_data[] =3D "first\0second-argument\0" + "SOME_ENV=3Da\0OTHER_ENV=3Dsomething"; +static const char expected_arg0[] =3D "first"; +static const char expected_arg1[] =3D "second-argument"; +static const char expected_env0[] =3D "SOME_ENV=3Da"; +static const char expected_env1[] =3D "OTHER_ENV=3Dsomething"; + +int monitored_pid; +int bprm_argc; +int bprm_envc; +int data_len_match; +int invalid_flags_ret; +int copy_ret; +int str_arg0_ret; +int str_arg1_ret; +int str_env0_ret; +int str_env1_ret; +int data_match; +int str_args_match; +int str_envs_match; + +extern int bpf_copy_from_user_bprm(void *dst, u32 dst__sz, + const void *unsafe_ptr__ign, + const struct linux_binprm *bprm, + u64 flags) __ksym; + +extern int bpf_copy_from_user_bprm_str(void *dst, u32 dst__sz, + const void *unsafe_ptr__ign, + const struct linux_binprm *bprm, + u64 flags) __ksym; + +SEC("lsm.s/bprm_check_security") +int BPF_PROG(check_exec_args, struct linux_binprm *bprm) +{ + u32 pid =3D bpf_get_current_pid_tgid() >> 32; + char data[sizeof(expected_data)]; + char arg0[32]; + char arg1[32]; + char env0[32]; + char env1[32]; + u64 offset =3D 0; + u64 data_len; + + if (pid !=3D monitored_pid) + return 0; + + bprm_argc =3D bprm->argc; + bprm_envc =3D bprm->envc; + + /* this is the total size of args and envs starting from bprm->p */ + data_len =3D bprm->exec - bprm->p; + data_len_match =3D data_len =3D=3D sizeof(expected_data); + + invalid_flags_ret =3D bpf_copy_from_user_bprm(data, + sizeof(data), (void *)bprm->p, bprm, ~0ULL); + + copy_ret =3D bpf_copy_from_user_bprm(data, sizeof(data), (void *)bprm->p, + bprm, 0); + if (copy_ret) + return 0; + + data_match =3D + !__builtin_memcmp(data, expected_data, sizeof(expected_data)); + + /* arg0 is at bprm->p */ + str_arg0_ret =3D bpf_copy_from_user_bprm_str(arg0, sizeof(arg0), + (void *)(bprm->p + offset), + bprm, BPF_F_PAD_ZEROS); + if (str_arg0_ret !=3D sizeof(expected_arg0)) + return 0; + offset +=3D str_arg0_ret; + + /* arg1 is at bprm->p + sizeof(arg0) */ + str_arg1_ret =3D bpf_copy_from_user_bprm_str(arg1, sizeof(arg1), + (void *)(bprm->p + offset), + bprm, BPF_F_PAD_ZEROS); + if (str_arg1_ret !=3D sizeof(expected_arg1)) + return 0; + offset +=3D str_arg1_ret; + + /* env0 is at bprm->p + sizeof(arg0) + sizeof(arg1) */ + str_env0_ret =3D bpf_copy_from_user_bprm_str(env0, sizeof(env0), + (void *)(bprm->p + offset), + bprm, BPF_F_PAD_ZEROS); + if (str_env0_ret !=3D sizeof(expected_env0)) + return 0; + offset +=3D str_env0_ret; + + /* env1 is at bprm->p + sizeof(arg0) + sizeof(arg1) + sizeof(env0) */ + str_env1_ret =3D bpf_copy_from_user_bprm_str(env1, sizeof(env1), + (void *)(bprm->p + offset), + bprm, BPF_F_PAD_ZEROS); + if (str_env1_ret !=3D sizeof(expected_env1)) + return 0; + + str_args_match =3D + !__builtin_memcmp(arg0, expected_arg0, sizeof(expected_arg0)) && + !__builtin_memcmp(arg1, expected_arg1, sizeof(expected_arg1)); + str_envs_match =3D + !__builtin_memcmp(env0, expected_env0, sizeof(expected_env0)) && + !__builtin_memcmp(env1, expected_env1, sizeof(expected_env1)); + + return data_match && str_args_match && str_envs_match ? -EPERM : 0; +} --=20 2.55.0