From nobody Thu Sep 24 23:33:22 2026 Received: from mail-wr2-f12.google.com (mail-wr2-f12.google.com [74.125.225.76]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 08BA64F3EA8 for ; Fri, 18 Sep 2026 13:18:23 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.225.76 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789737508; cv=none; b=XKAwTZ3ARfKAecr7GPS2L7UyA8Y+Q7m3WA4uc5vQlO9fjQKP43hahhx3XNRduMfmEwHZI5SaVh1k3Vzw3yMaxKnbr/BI5Jj196HeHda9Jn8L/+6Ecfee/a7lVdOPcpk62wN7QFj9ZZ/kr/jV2gGuLRCbvWuZo4MeNibC2RaPn80= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789737508; c=relaxed/simple; bh=BBkVEhkLLbXu5qOdrjGK2WS6zCi3TkNNq5NU2ke1u48=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=oLs5HygD0YIQGfY5i8svThvn7HtECygZ9kn61IwA6018EYSUodXuzwmbrbf+IuZut8FL/w1gYbR10DnJzkLKWwngz5NdoRTaMOM4xi+xoqgVnbvigvIGVwlBBZLtO3xYqQ6AQJFp3tCI04EeXBXqnUBgq0sYvR5W5m9YhzMd44M= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=mS0Zn17p; arc=none smtp.client-ip=74.125.225.76 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="mS0Zn17p" Received: by mail-wr2-f12.google.com with SMTP id ffacd0b85a97d-4834977ae75so392769f8f.3 for ; Fri, 18 Sep 2026 06:18:23 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1789737501; x=1790342301; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=dBI8Vei6mUKThCIHcgGdefIiyo76m+YulL+4eF81XBA=; b=mS0Zn17pFo82XJZ/3cXmc3LQnwznkNaViVpZ8i/Qxca7+X2RUiDRzVYEYJym1Vpm5E xN1FB0JqOZNShKC67aVYIXxSzlnt5d6+DcGIz2dc4Co2/tjCpaxcNXE3sfSGHAoByOzI zsHm33ITd/ByFkytXWEteWLHTXCK5Uyrh1lz/m3AldXlybQkCSER5zMWzR+abTYmcwqP yDWiqdCKsdJg+OU527afEcZpHvwsCEIPw1VQE82ZL1M+MgtG4oJg5VnxoCJ6V5rdrnGS Qcr9Mf+pcXdlmZBN5sPfQfDG2PkBHejO65HjZXJacPDrPl3GZx/N46FVsKd6OwqtiNQh 81Mg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1789737501; x=1790342301; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=dBI8Vei6mUKThCIHcgGdefIiyo76m+YulL+4eF81XBA=; b=1abv2HCucHLqTZ7h4cqwJdovapnz79Be9094vAhOepE55EXRazRWgUdO+R/Jd9o/IG xbhIId1l7n2sLu/j7ext94BvrREZwH/dSx5o7FOzSHtqHTpUF1nUqja8iUJEpybmFCNV we4i90JrO0PmD0Tu5Rk76FuTMK7AY+kbfNGNL6WY1O5+CTdDMsp8sBmqv3NeRjW/3oYy 5LYzJSI77W1IYcpMWXs+tQgPYY9padAOizBHr+bQWHnd6Xamlgp7kJf62ERQN7AT5xeU YhJwrI7Ny1FontjpvZN+ZSqAoTmIHR0xkT0hsbolaUY2kdy1fuzVcCP49/NxUBPabp2a Jcow== X-Forwarded-Encrypted: i=1; AKwUvBx8KaL6IP+OF53fIN+a8jHcHrzed5a+mB8U4o0Gsg+N8lMh0sBgIOXEtSqWkbTyOTRdRFtK2xPq+lWZENc=@vger.kernel.org X-Gm-Message-State: AFuF++kf8y6CafRB0UBrIDMq/m033A58SycWUhcojMtxQgVVSgZzTd+p lz1+1ru+vLme9dOSkv1wniw6RmzkxulwNn/BjvI0bQMIY7XJ4DggAgnA X-Gm-Gg: AYBFou02QGihbkfedF0oQzIVryIKbeLAj+u5NrykFqK/yTnx75nYkkQl4cWOKn5/U3U sffhvJqLj3RPjTUKPpk3lSVAkQ+R0NQzFny4eOrhq/gtckaj4TPFt9gCvArs4s0m1+G+Anxsfpc xvzAupSXwgQ/1IfvAvPxvtDGGetSZqoMdbuNt4WshwwK1YCipCzINODj5p5lrqv1x/QZp/Z2EGy HCnJkU9RicO0BkWB5adsoxdqkvTeVCjjbV040isagCkJ43caj2O3m9xKQn910VKgtr0lxZnPWJl fLiSLZ0jAn8H94LtN0otadrZdHPLhdH5195deOj75q1vcO7zTQgVFfgusC5US+pOIZ8quuSgLmK CRakOzmPUga3xRd2eAcTne6ish+AWshaUJ6bG7mQ5NS1iNA8Jql2UGlobukPxbdAJBvlF0umn71 jaFEfbfEOWcqNTmYT8pwWR53giGa8f1pls78tLxP1UA4gD2ibjrYrr2LWD1GuNr1OyboCJ6T0bq i4mDLwAVxgIs0U= X-Received: by 2002:a05:6000:26d2:b0:487:ae2:4d01 with SMTP id ffacd0b85a97d-4871e36cff7mr7099900f8f.22.1789737501308; Fri, 18 Sep 2026 06:18:21 -0700 (PDT) Received: from dell-desktop ([2a02:587:4b4e:8500:290c:210b:1c76:5710]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-4871feb5de3sm4424549f8f.1.2026.09.18.06.18.19 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 18 Sep 2026 06:18:20 -0700 (PDT) From: Anastasios Papagiannis To: bpf@vger.kernel.org Cc: linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org, linux-mm@kvack.org, david@kernel.org, akpm@linux-foundation.org, andrii@kernel.org, ast@kernel.org, brauner@kernel.org, daniel@iogearbox.net, eddyz87@gmail.com, kpsingh@kernel.org, ljs@kernel.org, matt@bobrowski.net, memxor@gmail.com, song@kernel.org, sun.jian.kdev@gmail.com, utilityemal77@gmail.com, viro@zeniv.linux.org.uk, tasos.papagiannnis@gmail.com Subject: [PATCH bpf-next v9 1/5] mm: Add copy_remote_mm_str() Date: Fri, 18 Sep 2026 16:17:53 +0300 Message-ID: <20260918131757.42802-2-tasos.papagiannnis@gmail.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260918131757.42802-1-tasos.papagiannnis@gmail.com> References: <20260918131757.42802-1-tasos.papagiannnis@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" copy_remote_vm_str() gets the target address space from a struct task_struct. This does not work for an address space that exists but is not yet associated with a task_struct, such as the mm held by struct linux_binprm during exec. Add copy_remote_mm_str(), which operates directly on a struct mm_struct. Use a common internal interface for the MMU and NOMMU implementations and define both public wrappers in mm/util.c. Preserve the existing copy_remote_vm_str() behavior, including handling zero-length requests before acquiring the task's mm. Signed-off-by: Anastasios Papagiannis Acked-by: Lorenzo Stoakes (ARM) Acked-by: David Hildenbrand (Arm) --- include/linux/mm.h | 8 +++---- mm/internal.h | 3 +++ mm/memory.c | 43 ++------------------------------- mm/nommu.c | 43 ++------------------------------- mm/util.c | 60 ++++++++++++++++++++++++++++++++++++++++++++++ 5 files changed, 71 insertions(+), 86 deletions(-) diff --git a/include/linux/mm.h b/include/linux/mm.h index dd09c438fa23..63f40e615754 100644 --- a/include/linux/mm.h +++ b/include/linux/mm.h @@ -3325,10 +3325,10 @@ extern int access_process_vm(struct task_struct *ts= k, unsigned long addr, extern int access_remote_vm(struct mm_struct *mm, unsigned long addr, void *buf, int len, unsigned int gup_flags); =20 -#ifdef CONFIG_BPF_SYSCALL -extern int copy_remote_vm_str(struct task_struct *tsk, unsigned long addr, - void *buf, int len, unsigned int gup_flags); -#endif +int copy_remote_mm_str(struct mm_struct *mm, unsigned long addr, + void *buf, int len, unsigned int gup_flags); +int copy_remote_vm_str(struct task_struct *tsk, unsigned long addr, + void *buf, int len, unsigned int gup_flags); =20 long get_user_pages_remote(struct mm_struct *mm, unsigned long start, unsigned long nr_pages, diff --git a/mm/internal.h b/mm/internal.h index 38b1165212c9..7c326965a94f 100644 --- a/mm/internal.h +++ b/mm/internal.h @@ -25,6 +25,9 @@ struct folio_batch; struct hstate; =20 +int __copy_remote_mm_str(struct mm_struct *mm, unsigned long addr, + void *buf, int len, unsigned int gup_flags); + struct huge_bootmem_page { struct list_head list; struct hstate *hstate; diff --git a/mm/memory.c b/mm/memory.c index 8b0c2c735d3d..fa819a8a1df6 100644 --- a/mm/memory.c +++ b/mm/memory.c @@ -7326,13 +7326,12 @@ int access_process_vm(struct task_struct *tsk, unsi= gned long addr, } EXPORT_SYMBOL_GPL(access_process_vm); =20 -#ifdef CONFIG_BPF_SYSCALL /* * Copy a string from another process's address space as given in mm. * If there is any error return -EFAULT. */ -static int __copy_remote_vm_str(struct mm_struct *mm, unsigned long addr, - void *buf, int len, unsigned int gup_flags) +int __copy_remote_mm_str(struct mm_struct *mm, unsigned long addr, + void *buf, int len, unsigned int gup_flags) { void *old_buf =3D buf; int err =3D 0; @@ -7408,44 +7407,6 @@ static int __copy_remote_vm_str(struct mm_struct *mm= , unsigned long addr, return buf - old_buf; } =20 -/** - * copy_remote_vm_str - copy a string from another process's address space. - * @tsk: the task of the target address space - * @addr: start address to read from - * @buf: destination buffer - * @len: number of bytes to copy - * @gup_flags: flags modifying lookup behaviour - * - * The caller must hold a reference on @mm. - * - * Return: number of bytes copied from @addr (source) to @buf (destination= ); - * not including the trailing NUL. Always guaranteed to leave NUL-terminat= ed - * buffer. On any error, return -EFAULT. - */ -int copy_remote_vm_str(struct task_struct *tsk, unsigned long addr, - void *buf, int len, unsigned int gup_flags) -{ - struct mm_struct *mm; - int ret; - - if (unlikely(len =3D=3D 0)) - return 0; - - mm =3D get_task_mm(tsk); - if (!mm) { - *(char *)buf =3D '\0'; - return -EFAULT; - } - - ret =3D __copy_remote_vm_str(mm, addr, buf, len, gup_flags); - - mmput(mm); - - return ret; -} -EXPORT_SYMBOL_GPL(copy_remote_vm_str); -#endif /* CONFIG_BPF_SYSCALL */ - /* * Print the name of a VMA. */ diff --git a/mm/nommu.c b/mm/nommu.c index 498e01ee40b0..68b05565e15a 100644 --- a/mm/nommu.c +++ b/mm/nommu.c @@ -1741,13 +1741,12 @@ int access_process_vm(struct task_struct *tsk, unsi= gned long addr, void *buf, in } EXPORT_SYMBOL_GPL(access_process_vm); =20 -#ifdef CONFIG_BPF_SYSCALL /* * Copy a string from another process's address space as given in mm. * If there is any error return -EFAULT. */ -static int __copy_remote_vm_str(struct mm_struct *mm, unsigned long addr, - void *buf, int len) +int __copy_remote_mm_str(struct mm_struct *mm, unsigned long addr, + void *buf, int len, unsigned int gup_flags) { unsigned long addr_end; struct vm_area_struct *vma; @@ -1782,44 +1781,6 @@ static int __copy_remote_vm_str(struct mm_struct *mm= , unsigned long addr, return ret; } =20 -/** - * copy_remote_vm_str - copy a string from another process's address space. - * @tsk: the task of the target address space - * @addr: start address to read from - * @buf: destination buffer - * @len: number of bytes to copy - * @gup_flags: flags modifying lookup behaviour (unused) - * - * The caller must hold a reference on @mm. - * - * Return: number of bytes copied from @addr (source) to @buf (destination= ); - * not including the trailing NUL. Always guaranteed to leave NUL-terminat= ed - * buffer. On any error, return -EFAULT. - */ -int copy_remote_vm_str(struct task_struct *tsk, unsigned long addr, - void *buf, int len, unsigned int gup_flags) -{ - struct mm_struct *mm; - int ret; - - if (unlikely(len =3D=3D 0)) - return 0; - - mm =3D get_task_mm(tsk); - if (!mm) { - *(char *)buf =3D '\0'; - return -EFAULT; - } - - ret =3D __copy_remote_vm_str(mm, addr, buf, len); - - mmput(mm); - - return ret; -} -EXPORT_SYMBOL_GPL(copy_remote_vm_str); -#endif /* CONFIG_BPF_SYSCALL */ - /** * nommu_shrink_inode_mappings - Shrink the shared mappings on an inode * @inode: The inode to check diff --git a/mm/util.c b/mm/util.c index bf0513d1d3d0..75c0fc2061aa 100644 --- a/mm/util.c +++ b/mm/util.c @@ -1061,6 +1061,66 @@ int get_cmdline(struct task_struct *task, char *buff= er, int buflen) return res; } =20 +/** + * copy_remote_mm_str - copy a string from a remote address space. + * @mm: the remote address space + * @addr: start address to read from + * @buf: destination buffer + * @len: number of bytes to copy + * @gup_flags: flags modifying lookup behaviour + * + * The caller must hold a reference on @mm. + * + * Return: number of bytes copied from @addr (source) to @buf (destination= ), + * not including the trailing NUL. If @len is zero, return 0 without acces= sing + * @buf. Otherwise, @buf is always NUL-terminated. On any error, return + * -EFAULT. + */ +int copy_remote_mm_str(struct mm_struct *mm, unsigned long addr, + void *buf, int len, unsigned int gup_flags) +{ + if (unlikely(len =3D=3D 0)) + return 0; + + return __copy_remote_mm_str(mm, addr, buf, len, gup_flags); +} + +/** + * copy_remote_vm_str - copy a string from another process's address space. + * @tsk: the task of the target address space + * @addr: start address to read from + * @buf: destination buffer + * @len: number of bytes to copy + * @gup_flags: flags modifying lookup behaviour + * + * Return: number of bytes copied from @addr (source) to @buf (destination= ), + * not including the trailing NUL. If @len is zero, return 0 without acces= sing + * @buf. Otherwise, @buf is always NUL-terminated. On any error, return + * -EFAULT. + */ +int copy_remote_vm_str(struct task_struct *tsk, unsigned long addr, + void *buf, int len, unsigned int gup_flags) +{ + struct mm_struct *mm; + int ret; + + if (unlikely(len =3D=3D 0)) + return 0; + + mm =3D get_task_mm(tsk); + if (!mm) { + *(char *)buf =3D '\0'; + return -EFAULT; + } + + ret =3D __copy_remote_mm_str(mm, addr, buf, len, gup_flags); + + mmput(mm); + + return ret; +} +EXPORT_SYMBOL_GPL(copy_remote_vm_str); + int __weak memcmp_pages(struct page *page1, struct page *page2) { char *addr1, *addr2; --=20 2.55.0 From nobody Thu Sep 24 23:33:22 2026 Received: from mail-wr2-f33.google.com (mail-wr2-f33.google.com [74.125.225.97]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CEBC14F55AC for ; Fri, 18 Sep 2026 13:18:26 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.225.97 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789737509; cv=none; b=BEANwz0tpgl4KOobZjB+gbytpXO6XioWaMgVSGinzF+NE44Kf1AgjU0L1n6Cxi759iudQwF4kkej6KhYSzFVx8ZZEE5zAMUxf1Lt6gmPkeEUkQKzf9iLcjBR0DjNRrH1mPOYJzITPenv+F6cF6uAAKd6DpDG7HlDD7qaUhBMFx4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789737509; c=relaxed/simple; bh=oxBm833C8T+jxHgAdbU6D4xcv4E4TYoli1xZPpTW0yQ=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=mel5p5NnRm93J7OBVJ9mi3Jhwqqlxbxw6yQ+gSp2bDc1F5AOFtkg6wzvj7CVlR/2GD+CpZJhvlR5VcUpFxUYKeeCM7IVwQPcjnceLcj9xsWXjdN5iX0szLN5mffaVNJOs7PlNWCxeEq6Z30eTIFOkFM+9AYd5JBKZUy9Tm6ik7k= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=DTaCcuRB; arc=none smtp.client-ip=74.125.225.97 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="DTaCcuRB" Received: by mail-wr2-f33.google.com with SMTP id ffacd0b85a97d-482f6351831so383362f8f.1 for ; Fri, 18 Sep 2026 06:18:26 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1789737505; x=1790342305; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=BcITG13Gvl8i0HA4g724jWVmnWns/ceZ5ECxTEaQlok=; b=DTaCcuRBPvPuYFBbtD+F2d6f25YKCbNgO+WTHSknWaLBGXmG2OpAVMuYbRsYynbO4p hU1O+Ft6/couaczpum1O1Irmi6BiCrWLwe3JmmzyTSmTnWbX3OSF5cdAhQk+Zq6w8bhV xU8QUQHZdn7FkIZ2bq2vht8ZC+ZWBDppbH4mZIQqgdyhfcOPRcLsCxY09HIs6SLsLX0A SxOyRv9mpuBNhWkhejOxIHV31BjEzumxFZWoq9FL1AYU8q3Bxk7bQFzGkzVuhnk+Mb3H MGnlvhPWbb7Fu1CV051czmm0c9C6u4OZdr1w/NJm3TYVpqVwjv1H4C++LhhdUon0Ra+7 AL2g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1789737505; x=1790342305; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=BcITG13Gvl8i0HA4g724jWVmnWns/ceZ5ECxTEaQlok=; b=sszSet4LEaZBMEDlfrgzX0NOH3mu5uxdA3MGaJwa2ZERFJ0OIn6fuqtCaVhC2zboil uyeDYKS6wY5D5qaO3WThypI3WXJF5O6Ee5gJI3OO4bgev8ESbl0pEeuCPGva5Q1GOSo9 bgrC4rc8ziuue+oMX/5a+mCH9S4Dm1+mHHbUs6Rc2kXHXOWg238FsmPPg8jQpp+BcrIR 3cGqVMdAz/BU3Rvrel4sL9WflCU9eI8LRC827owfmISnLpRURw8Pz49GFwJep8ubclWe taRpwvldawhYuDcaCJvVYeagilVfEt9KJPBxeBDK4CqPu3Fh6WPBAtp0iuHmvOMlnqFQ 1hPA== X-Forwarded-Encrypted: i=1; AKwUvBw8M0OL5FWcCbdQeC/QlpivNiJsuEdj4KvMtkjs6j12ATl+6F6u8pCZonnFJ1LH5gD/wO3tqITceMqg4+w=@vger.kernel.org X-Gm-Message-State: AFuF++lDunbARaGLQpqNeFyhPztBMKet/JH5lKNDwYVuIncRoV3yn3pW L2Bfv4BeP5Emin3BFbbZGeOjHQ26hutKDTfM/SWFcQkuGxH6Qcy3ChWP X-Gm-Gg: AYBFou3ZpU+L2JU6GbGnCktzti7QAmO8A+4NdaRP4WdTyKuyTeT/0jOtQVkl86C4Zrb L6GrRsr1eCknA2KA8AvTASeoH7pdl6tByMyQj/K6y5VyPmhs0gzACwPEGsUV/I86jy3S6Acr8c4 zd6nlA6TIuItC+oA4prWySoE2VNxuZ3X8AaELQ17maiCPEjWhbEgd1ZD9x5Y2EG3ICXpbYcBxjv NZK5LX/h7Jj1gWf1S6P3LTg1XCP6cBugq0Z8jzItrAxHWz4fInMjs40YnefUFQWMZ9fc5vrm5fY 9e9+yVdJ9PUMTwtCDvv/wu2HI2VvjqEj0abNyL+yurfkCIiil6tx/VV6P+uieoyovmQatJjbqF3 xb2ky4VMVy+lDjBxPQKmXNuh/gfGGhhPHG8EVSalwqz+2gitRZxydH51f8XDECXGHRbfUF6nxYn jceut/dCenagDe44Loyz/+3lD/VZx/nz1lRvlyhUI37dGgTF9xP22aBqnFOMbdf8rbHqiVZ4FiK FVBddGbPxj3qnb3fFFamVEKKQ== X-Received: by 2002:a05:6000:490d:b0:485:8a47:5b91 with SMTP id ffacd0b85a97d-4871e36cb87mr3143383f8f.46.1789737504555; Fri, 18 Sep 2026 06:18:24 -0700 (PDT) Received: from dell-desktop ([2a02:587:4b4e:8500:290c:210b:1c76:5710]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-4871feb5de3sm4424549f8f.1.2026.09.18.06.18.22 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 18 Sep 2026 06:18:23 -0700 (PDT) From: Anastasios Papagiannis To: bpf@vger.kernel.org Cc: linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org, linux-mm@kvack.org, david@kernel.org, akpm@linux-foundation.org, andrii@kernel.org, ast@kernel.org, brauner@kernel.org, daniel@iogearbox.net, eddyz87@gmail.com, kpsingh@kernel.org, ljs@kernel.org, matt@bobrowski.net, memxor@gmail.com, song@kernel.org, sun.jian.kdev@gmail.com, utilityemal77@gmail.com, viro@zeniv.linux.org.uk, tasos.papagiannnis@gmail.com Subject: [PATCH bpf-next v9 2/5] exec: Clear bprm->mm before dropping its reference Date: Fri, 18 Sep 2026 16:17:54 +0300 Message-ID: <20260918131757.42802-3-tasos.papagiannnis@gmail.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260918131757.42802-1-tasos.papagiannnis@gmail.com> References: <20260918131757.42802-1-tasos.papagiannnis@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Once mmput() drops the final reference to bprm->mm, the pointer must no longer remain accessible through struct linux_binprm. The successful exec path and the bprm initialization error path already clear bprm->mm when ownership is transferred or released. Do the same in free_bprm() before calling mmput(). This is required for BPF kfuncs where bprm->mm is either NULL or points to a live mm_struct to ensure safe access. Signed-off-by: Anastasios Papagiannis Reviewed-by: Sun Jian --- fs/exec.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/fs/exec.c b/fs/exec.c index 745f6eb5279e..4ddd403fd91c 100644 --- a/fs/exec.c +++ b/fs/exec.c @@ -1456,9 +1456,12 @@ void bprm_drop_loader(struct linux_binprm *bprm) =20 static void free_bprm(struct linux_binprm *bprm) { - if (bprm->mm) { + struct mm_struct *mm =3D bprm->mm; + + if (mm) { acct_arg_size(bprm, 0); - mmput(bprm->mm); + bprm->mm =3D NULL; + mmput(mm); } if (bprm->user_ns) put_user_ns(bprm->user_ns); --=20 2.55.0 From nobody Thu Sep 24 23:33:22 2026 Received: from mail-wr2-f12.google.com (mail-wr2-f12.google.com [74.125.225.76]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9F2C04F404D for ; Fri, 18 Sep 2026 13:18:30 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.225.76 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789737514; cv=none; b=GlnpQH+GcDq1l+3na/r75wh84wKPYgXtnnQrHt7/P8Y05EHH/wCGPD4ly6GAUVTjKbU4T4/RT4+LtcbrlAcB5NECRXzsS3A+K6iTvyiBtc+Br0q/6dBM8zeMPDS1Kk7la+ViFBA9cfw9r1VgqieW5y9+qSq67T2k/faeqzOTvV0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789737514; c=relaxed/simple; bh=+IXRF+gxbR99W9XyJ7A4LutWdhORNAD9G05Fo0xKDts=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=R6lrdYXnTVdHXFWut9RPGqtuXWMEz3as/+6UpoAtR2c/zPOEJT5JqoOiiOJMzIP5Z0SUNrqGDVSIVebY+xdycuEvV48R9AHTXom/1rkq3AqySemgw2GXJp0bF17x+PidTlmuqalzCTaelwPT0XQx18x33F/9mU/EWpB4Ybq8pM0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=Qks8P6ny; arc=none smtp.client-ip=74.125.225.76 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="Qks8P6ny" Received: by mail-wr2-f12.google.com with SMTP id ffacd0b85a97d-482f633cd78so410932f8f.1 for ; Fri, 18 Sep 2026 06:18:29 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1789737508; x=1790342308; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=YtBPLqwC7VJbXcngjda2oQbwhTixdm4j9JpsXuMGn8M=; b=Qks8P6nyrw2bjISS6Harh4axmDj1JOKUU32YGdG8NqGI9E/e5i/9wYvcHPNE6bTuIz kav2o9CIQqjpGTOkbabYHkRA1v9gwosKj00nuxjOv0GmxKzS0Y+SrzSE1GNlG7THcGJG 0VU1PL3M9rGQ8n18hdHdlsd7oSaikusaPR6nuVGgPxzWC0Kidfw2hrB4MWePb2unPVKa vJ9zsBrH8IN/XSkP7SoN0r4IO13jYD/8qmLH5N2iLx4UhievBwQeiE2U9tz3kB6Os0cH YR+o+9ShmJA+fIlLYfsrUUDRcT2+ZqdBGPD7ZxNh8HBEQyZW78/YtaxiPj1+/zC7g+P3 Hz3g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1789737508; x=1790342308; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=YtBPLqwC7VJbXcngjda2oQbwhTixdm4j9JpsXuMGn8M=; b=SN+AWRwW+cH4Lcj3XiJENgDyDzGKNUtCjjMTYVWifESefAWAuY+jcild4lYKptt7r+ 9mFRC56HmgfCnm0q2dGuuy/7JVKS6n02HeOiFLy8cRrowSThvaIuqNCiF0Do88lGCFfJ 3ugPI8hbbKAdWUFEhWJUeyZwzzBM0WxL6pcYKAtF3QAce7NRi/7bEE+KktZKbaJn3VVs 8xHVA911yIvyzpl1GtRLOT0v8TfNDok0ZB47c/514JhMaQJFaWDGde4qTxoji0+Lh/hR VSQGAtCJVpvg3mcJHg4eT9gk0i//NXy+NDQLUz3ANwx/RdgMu/fVRmHgqJlOoBHYVpVD XSog== X-Forwarded-Encrypted: i=1; AKwUvBy9+3NBOqTakBXbMOiR4U/MK6dCF/mdgt82yLzHv8tHN1tdWykjLNWM5MnTSZvXMDHaCXFpjvgp6iPbYSs=@vger.kernel.org X-Gm-Message-State: AFuF++lLW875ZDG+5yoN7wbBe4J2tL/alfmGkM6v8FjvHMmW57IBmhhi E5vaws7I2FMToSujBpzjXS80x/Sh2QbnfVbGJhY5ikV5nx4kSRSAyu4ttVrM2VAo X-Gm-Gg: AYBFou00mXvxEwWNq6uXuDNRItJlqFHWaNAgXak0NJwLRj4E6eYP0spxlR1JpP5u6Nx e6iIuO7TzkxovdEzaqAbZdM7tWL7vj0NMpwfz+94jQMwjhZcG8hvlQQDwBZCsS3tse5OioNUaTR C75zVLJzE+yS3tEfabu9/nivH0XQSAzM9MUq8dxZpJl/tck/wq2zgXjx0En8pDc4F3lMLivWfRA YLOXQXRDX8nagIcZf/DG7pfkDd8bn6DT46IoGXHvM/Twwr/p4LnKIPQEKJL+A+0XB8mqnF2gkqd jn7FI2Q65rPlLKyyZNP0dM8q6FK7l+SOTGNQQc8nQGvkq+saV+7fAzVbgWgBl4v8G5ims0NrEOs 4+pq1wFs1u84gq6yIOXRDs8BxJoQA0+7basHqZlqBnVlYidjB7mnvpo+9ZNeKjeqPshmYFRZkZw FnGgvuEwClL6nk+Ans328kFTrgBePU1D9ivoKKQ6RBS7U4pXjbRaNyIB8QWgOEp2nkpMWmzR6wF 6rqqxuXpI7KQ+Q= X-Received: by 2002:a05:6000:40e1:b0:482:fd9c:3740 with SMTP id ffacd0b85a97d-4871e227ccfmr3468864f8f.22.1789737507607; Fri, 18 Sep 2026 06:18:27 -0700 (PDT) Received: from dell-desktop ([2a02:587:4b4e:8500:290c:210b:1c76:5710]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-4871feb5de3sm4424549f8f.1.2026.09.18.06.18.25 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 18 Sep 2026 06:18:26 -0700 (PDT) From: Anastasios Papagiannis To: bpf@vger.kernel.org Cc: linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org, linux-mm@kvack.org, david@kernel.org, akpm@linux-foundation.org, andrii@kernel.org, ast@kernel.org, brauner@kernel.org, daniel@iogearbox.net, eddyz87@gmail.com, kpsingh@kernel.org, ljs@kernel.org, matt@bobrowski.net, memxor@gmail.com, song@kernel.org, sun.jian.kdev@gmail.com, utilityemal77@gmail.com, viro@zeniv.linux.org.uk, tasos.papagiannnis@gmail.com Subject: [PATCH bpf-next v9 3/5] bpf: Add user memory access kfuncs for mm_struct Date: Fri, 18 Sep 2026 16:17:55 +0300 Message-ID: <20260918131757.42802-4-tasos.papagiannnis@gmail.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260918131757.42802-1-tasos.papagiannnis@gmail.com> References: <20260918131757.42802-1-tasos.papagiannnis@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" On CONFIG_MMU kernels, when security_bprm_check() runs, the argument and environment strings for the exec have been copied into bprm->mm. The new address space is not associated with a task_struct until exec_mmap(), so existing BPF user memory helpers cannot access it. Add bpf_copy_from_user_mm() and bpf_copy_from_user_mm_str() kfuncs. Both take a struct mm_struct pointer directly, allowing callers to access trusted address spaces that are not associated with a task_struct. bpf_copy_from_user_mm() has similar semantics to bpf_copy_from_user_task(). bpf_copy_from_user_mm_str() copies one NUL-terminated string and returns its size including the NUL terminator. It accepts BPF_F_PAD_ZEROS to clear unused destination bytes on success. Refactor the task-based helpers and the new mm-based kfuncs to share static internal implementations. The task-based interfaces validate their arguments before acquiring and holding a reference to the task's mm for the copy. No behavior change is intended for the existing task-based interfaces. Register both new kfuncs and mark them KF_SLEEPABLE because accessing a remote address space can fault. Signed-off-by: Anastasios Papagiannis Reviewed-by: Matt Bobrowski --- kernel/bpf/helpers.c | 154 +++++++++++++++++++++++++++++++++++++++---- 1 file changed, 142 insertions(+), 12 deletions(-) diff --git a/kernel/bpf/helpers.c b/kernel/bpf/helpers.c index 051b6654e57c..82402d97ce67 100644 --- a/kernel/bpf/helpers.c +++ b/kernel/bpf/helpers.c @@ -679,9 +679,44 @@ const struct bpf_func_proto bpf_copy_from_user_proto = =3D { .arg3_type =3D ARG_ANYTHING, }; =20 +static int __bpf_copy_from_user_mm(void *dst, u32 size, + const void __user *user_ptr, + struct mm_struct *mm) +{ + int ret; + + ret =3D access_remote_vm(mm, (unsigned long)user_ptr, dst, size, 0); + if (ret =3D=3D size) + return 0; + + memset(dst, 0, size); + /* Return -EFAULT for partial read */ + return ret < 0 ? ret : -EFAULT; +} + +static int __bpf_copy_from_user_mm_str(void *dst, u32 size, + const void __user *user_ptr, + struct mm_struct *mm, u64 flags) +{ + int ret; + + ret =3D copy_remote_mm_str(mm, (unsigned long)user_ptr, dst, size, 0); + if (ret < 0) { + if (flags & BPF_F_PAD_ZEROS) + memset(dst, 0, size); + return ret; + } + + if (flags & BPF_F_PAD_ZEROS) + memset(dst + ret, 0, size - ret); + + return ret + 1; +} + BPF_CALL_5(bpf_copy_from_user_task, void *, dst, u32, size, const void __user *, user_ptr, struct task_struct *, tsk, u64, flags) { + struct mm_struct *mm; int ret; =20 /* flags is not used yet */ @@ -691,13 +726,16 @@ BPF_CALL_5(bpf_copy_from_user_task, void *, dst, u32,= size, if (unlikely(!size)) return 0; =20 - ret =3D access_process_vm(tsk, (unsigned long)user_ptr, dst, size, 0); - if (ret =3D=3D size) - return 0; + mm =3D get_task_mm(tsk); + if (!mm) { + memset(dst, 0, size); + return -EFAULT; + } =20 - memset(dst, 0, size); - /* Return -EFAULT for partial read */ - return ret < 0 ? ret : -EFAULT; + ret =3D __bpf_copy_from_user_mm(dst, size, user_ptr, mm); + mmput(mm); + + return ret; } =20 const struct bpf_func_proto bpf_copy_from_user_task_proto =3D { @@ -3659,6 +3697,92 @@ __bpf_kfunc int bpf_copy_from_user_str(void *dst, u3= 2 dst__sz, const void __user return ret + 1; } =20 +/** + * bpf_copy_from_user_mm() - Copy data from an address space + * @dst: Destination address, in kernel space + * @dst__sz: Number of bytes to copy + * @unsafe_ptr__ign: Source address in the address space + * @mm: Address space to copy from + * @flags: Reserved for future use; must be zero + * + * Copies data from the user address space associated with @mm. The destin= ation + * is zeroed if an attempted copy cannot be completed in full. Unsupported + * flags return -EINVAL without modifying @dst. + * + * Return: 0 on success, -EINVAL if @flags is non-zero, or -EFAULT if @mm = is no + * longer active or the copy fails or is partial. + */ +__bpf_kfunc int bpf_copy_from_user_mm(void *dst, u32 dst__sz, + const void __user *unsafe_ptr__ign, + struct mm_struct *mm, u64 flags) +{ + int ret; + + if (unlikely(flags)) + return -EINVAL; + + if (unlikely(!dst__sz)) + return 0; + + if (unlikely(!mmget_not_zero(mm))) { + memset(dst, 0, dst__sz); + return -EFAULT; + } + + ret =3D __bpf_copy_from_user_mm(dst, dst__sz, unsafe_ptr__ign, mm); + mmput(mm); + + return ret; +} + +/** + * bpf_copy_from_user_mm_str() - Copy a string from an address space + * @dst: Destination address, in kernel space. This buffer mus= t be + * at least @dst__sz bytes long + * @dst__sz: Maximum number of bytes to copy, including the traili= ng NUL + * @unsafe_ptr__ign: Source address in the address space + * @mm: Address space to copy from + * @flags: The only supported flag is BPF_F_PAD_ZEROS + * + * Copies a NUL-terminated string from the user address space associated w= ith + * @mm. If the string is too long, @dst is still NUL-terminated unless @ds= t__sz + * is zero. + * + * If the flags are valid and BPF_F_PAD_ZEROS is set, the unused portion of + * @dst is cleared on success and all of @dst is cleared on a copy failure. + * Unsupported flags return -EINVAL without modifying @dst. + * + * Return: The number of copied bytes including the NUL terminator on succ= ess, + * -EINVAL if @flags is invalid, or -EFAULT if @mm is no longer active or = the + * copy fails. + */ +__bpf_kfunc int bpf_copy_from_user_mm_str(void *dst, u32 dst__sz, + const void __user *unsafe_ptr__ign, + struct mm_struct *mm, u64 flags) +{ + int ret; + + if (unlikely(flags & ~BPF_F_PAD_ZEROS)) + return -EINVAL; + + if (unlikely(dst__sz =3D=3D 0)) + return 0; + + if (unlikely(!mmget_not_zero(mm))) { + if (flags & BPF_F_PAD_ZEROS) + memset(dst, 0, dst__sz); + else + *(char *)dst =3D '\0'; + return -EFAULT; + } + + ret =3D __bpf_copy_from_user_mm_str(dst, dst__sz, unsafe_ptr__ign, + mm, flags); + mmput(mm); + + return ret; +} + /** * bpf_copy_from_user_task_str() - Copy a string from an task's address sp= ace * @dst: Destination address, in kernel space. This buffer mu= st be @@ -3682,6 +3806,7 @@ __bpf_kfunc int bpf_copy_from_user_task_str(void *dst= , u32 dst__sz, const void __user *unsafe_ptr__ign, struct task_struct *tsk, u64 flags) { + struct mm_struct *mm; int ret; =20 if (unlikely(flags & ~BPF_F_PAD_ZEROS)) @@ -3690,17 +3815,20 @@ __bpf_kfunc int bpf_copy_from_user_task_str(void *d= st, u32 dst__sz, if (unlikely(dst__sz =3D=3D 0)) return 0; =20 - ret =3D copy_remote_vm_str(tsk, (unsigned long)unsafe_ptr__ign, dst, dst_= _sz, 0); - if (ret < 0) { + mm =3D get_task_mm(tsk); + if (!mm) { if (flags & BPF_F_PAD_ZEROS) memset(dst, 0, dst__sz); - return ret; + else + *(char *)dst =3D '\0'; + return -EFAULT; } =20 - if (flags & BPF_F_PAD_ZEROS) - memset(dst + ret, 0, dst__sz - ret); + ret =3D __bpf_copy_from_user_mm_str(dst, dst__sz, unsafe_ptr__ign, + mm, flags); + mmput(mm); =20 - return ret + 1; + return ret; } =20 /* Keep unsigned long in prototype so that kfunc is usable when emitted to @@ -4925,6 +5053,8 @@ BTF_ID_FLAGS(func, bpf_iter_bits_new, KF_ITER_NEW) BTF_ID_FLAGS(func, bpf_iter_bits_next, KF_ITER_NEXT | KF_RET_NULL) BTF_ID_FLAGS(func, bpf_iter_bits_destroy, KF_ITER_DESTROY) BTF_ID_FLAGS(func, bpf_copy_from_user_str, KF_SLEEPABLE) +BTF_ID_FLAGS(func, bpf_copy_from_user_mm, KF_SLEEPABLE) +BTF_ID_FLAGS(func, bpf_copy_from_user_mm_str, KF_SLEEPABLE) BTF_ID_FLAGS(func, bpf_copy_from_user_task_str, KF_SLEEPABLE) BTF_ID_FLAGS(func, bpf_get_kmem_cache) BTF_ID_FLAGS(func, bpf_iter_kmem_cache_new, KF_ITER_NEW | KF_SLEEPABLE) --=20 2.55.0 From nobody Thu Sep 24 23:33:22 2026 Received: from mail-wr2-f12.google.com (mail-wr2-f12.google.com [74.125.225.76]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id AEC694F68D7 for ; Fri, 18 Sep 2026 13:18:33 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.225.76 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789737516; cv=none; b=jN/FYt7wDPzCdx/LhkRY5JWYIqgWGNopyeBFS+aAesqLYyKnDU7CdjvhLWUNIBNAyLuRaRStJxDJhxpeVqWqJ/eILbiitdmG7llM6UDkrKdJjQmKXXVQs9aH31VsoYi94jZbRE5Mws8MyOiq3EafPgEQ9F8756QGB43mrsUtZqQ= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789737516; c=relaxed/simple; bh=FiRsDZdzGXAipkwSasDiwYJgNjGQw/oWZmESPlkGMAY=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=p9fWlJwbUN3ZKi8QP5AQ4AKXKRW1bOAQTtnxCCY8fcAgQPBrJ3XwyY3/Ggx71eyVD/yNdl6cItXG6THxM7naUH90953pk5oOBuFsKZMGVXAypjTwxktogwGuaORHVg98WWLlCF+b7TfIftEUK22GWqUYHXBaOmMAp/Yok+R+iCI= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=pwtcHEJh; arc=none smtp.client-ip=74.125.225.76 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="pwtcHEJh" Received: by mail-wr2-f12.google.com with SMTP id ffacd0b85a97d-482f6350f89so455779f8f.3 for ; Fri, 18 Sep 2026 06:18:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1789737510; x=1790342310; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=Lk08SIy6DJ+jXcktdOiUfMwYrHwPBwEtrnZT5485SRQ=; b=pwtcHEJhy+AqkJEIPvt6KoFIXebSr8frclgIJqi4kD2b5Qsb6sOogjqKgfQ5wMMh6l z00HjFNr+bWexwi2bknLqaCBXGepxzkl+FoEincelLSgFI6/DwUmW2+GxIxbuNyy2yN6 x+WirGt+AC2cmvPA2IbZs9DlQRIdGp8xTtvrUfXaKdzB9XPoAGNoKIPF/R9Y7cWU2uo6 RI6rTE4MfIoNbuZkPgYx+nEAXMWMp/siRkXMEc5v5BNqkm8mINgcqEcM/nx3H/3hptz0 PJjT8F/e1OawwEc7NE1n2Xii5LUJsgsDowML8Z1ATPMQafT7UCd315UjO0bo3GonCdQ1 XyCg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1789737510; x=1790342310; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=Lk08SIy6DJ+jXcktdOiUfMwYrHwPBwEtrnZT5485SRQ=; b=gu5EwYRM5wZFyV+sqt9aZRAmzPJo1GQovUoTn4Q62hveTFzr3gROne2xvbW0GrYGrG jZgWIE2cgObWm6xkFzcwOkf+jjNo64WwP0ewLTilpywqlJOWY9N5Qq9z2s2di0D8DnyU NnAmaCVK0TmHa+4+tk3BXeqYk0c8ZCOlNk80W0HXHXV4gH6EaqyITsXTrsW49Ly6AK2v fd2xv2hE3IzQj6jJITgPHtvidKEkPVbMkCahmLiamGymIvmxuKnZdZ+0xjLQRwq14d4T 6uruoFuSgBtcScaOWiKqvBnM4oof9xix1bDpFMwafvs7n7+DFY00jyTlEGorHr3P/6wc wvPw== X-Forwarded-Encrypted: i=1; AKwUvBzM21jfAQlrZhI/+TMd7FlUv3t+oZxz43Uvs/Wd58i9YNYX314KmREfuRONqQqiRLDO1WQ3EZB97Tsc0gg=@vger.kernel.org X-Gm-Message-State: AFuF++loUsiN7oJANsW5L5oKp1qSak9yg1/JyK0YqlHtMEyFmC3q1+mn VLdN6uokcJHpzKNhUIH5+rF4EBS4MPCZmp85hpqtlPqSAOnuyYwy7iff X-Gm-Gg: AYBFou0LPQZgEXVEqHDbTiYr9ZiTQUM1bdhXdshbrU5fInG5ro2qSGkmBN7rhScbaSd zXBkSfdUwGv6X0FMo1/iVlP/BlvAbyuLetAniQM/n8RiiCiVW5hscB/Z7s/OhiosoMzqNsyb18F ZgWPFV7PsILKIWn6yMBCnP4heutv1GVmwnFoIP3fPKG0xUmAk3EUnIN5GDnxqzZv6VFtdXV+Tdz 87QPBPcvDpEJJoCAyp9ANvS6DMn3+3Ph79kaF9FKAF04ymEwdSfKLanp91k2DO01mnDHL1/sMHl mWU/rMn9iwShAbJKhzybAtY1EW39H/OXrIltFYQEP0fjP9EjJMu+uolDFuwp578iZHklBcEQIDh mzkSG2R2cdd3Z/XJqAR5rgOCBb6/46TSvPG4exl0i5NNLLQUzhpXWXXeF5n9w2RL8fLLvYRILzx oVWce9J7jZnkOefnqPLVqRR2QvqoO1tbolumxcQEc6qWGz/wmyWOQ629Yzem+/GbM/T3d0u7toB ifL83cz5U3HJg0sVjNx/YCH/Q== X-Received: by 2002:a05:6000:491e:b0:487:84:96d7 with SMTP id ffacd0b85a97d-4871e373189mr3667759f8f.53.1789737510446; Fri, 18 Sep 2026 06:18:30 -0700 (PDT) Received: from dell-desktop ([2a02:587:4b4e:8500:290c:210b:1c76:5710]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-4871feb5de3sm4424549f8f.1.2026.09.18.06.18.28 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 18 Sep 2026 06:18:29 -0700 (PDT) From: Anastasios Papagiannis To: bpf@vger.kernel.org Cc: linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org, linux-mm@kvack.org, david@kernel.org, akpm@linux-foundation.org, andrii@kernel.org, ast@kernel.org, brauner@kernel.org, daniel@iogearbox.net, eddyz87@gmail.com, kpsingh@kernel.org, ljs@kernel.org, matt@bobrowski.net, memxor@gmail.com, song@kernel.org, sun.jian.kdev@gmail.com, utilityemal77@gmail.com, viro@zeniv.linux.org.uk, tasos.papagiannnis@gmail.com Subject: [PATCH bpf-next v9 4/5] bpf: Mark linux_binprm->mm as trusted-or-null Date: Fri, 18 Sep 2026 16:17:56 +0300 Message-ID: <20260918131757.42802-5-tasos.papagiannnis@gmail.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260918131757.42802-1-tasos.papagiannnis@gmail.com> References: <20260918131757.42802-1-tasos.papagiannnis@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Mark linux_binprm->mm as a trusted-or-null nested pointer so BPF programs can pass it to kfuncs after a NULL check. The field is either NULL or points to a live mm_struct whenever BPF can access a linux_binprm. On successful exec, exec_mmap() installs the new address space before begin_new_exec() clears bprm->mm. The bprm_mm_init() error path clears the field before mmdrop(), and free_bprm() clears it before mmput(), as ensured by an earlier patch in this series. Update the existing LSM selftest to check bprm->mm for NULL before dereferencing it, as required for trusted-or-null pointers. Signed-off-by: Anastasios Papagiannis Reviewed-by: Sun Jian Reviewed-by: Matt Bobrowski --- kernel/bpf/verifier.c | 5 +++++ tools/testing/selftests/bpf/progs/lsm.c | 5 ++++- 2 files changed, 9 insertions(+), 1 deletion(-) diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index 6c6b8d8520cd..3539a768b921 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -5997,6 +5997,10 @@ BTF_TYPE_SAFE_TRUSTED_OR_NULL(struct dentry) { struct inode *d_inode; }; =20 +BTF_TYPE_SAFE_TRUSTED_OR_NULL(struct linux_binprm) { + struct mm_struct *mm; +}; + BTF_TYPE_SAFE_TRUSTED_OR_NULL(struct socket) { struct sock *sk; }; @@ -6051,6 +6055,7 @@ static bool type_is_trusted_or_null(struct bpf_verifi= er_env *env, { BTF_TYPE_EMIT(BTF_TYPE_SAFE_TRUSTED_OR_NULL(struct socket)); BTF_TYPE_EMIT(BTF_TYPE_SAFE_TRUSTED_OR_NULL(struct dentry)); + BTF_TYPE_EMIT(BTF_TYPE_SAFE_TRUSTED_OR_NULL(struct linux_binprm)); BTF_TYPE_EMIT(BTF_TYPE_SAFE_TRUSTED_OR_NULL(struct vm_area_struct)); =20 return btf_nested_type_is_trusted(&env->log, reg, field_name, btf_id, diff --git a/tools/testing/selftests/bpf/progs/lsm.c b/tools/testing/selfte= sts/bpf/progs/lsm.c index 7de173daf27b..7441d66c080c 100644 --- a/tools/testing/selftests/bpf/progs/lsm.c +++ b/tools/testing/selftests/bpf/progs/lsm.c @@ -113,6 +113,7 @@ int BPF_PROG(test_void_hook, struct linux_binprm *bprm) { __u32 pid =3D bpf_get_current_pid_tgid() >> 32; struct inner_map *inner_map; + struct mm_struct *mm; char args[64]; __u32 key =3D 0; __u64 *value; @@ -121,7 +122,9 @@ int BPF_PROG(test_void_hook, struct linux_binprm *bprm) bprm_count++; =20 bpf_copy_from_user(args, sizeof(args), (void *)bprm->vma->vm_mm->arg_star= t); - bpf_copy_from_user(args, sizeof(args), (void *)bprm->mm->arg_start); + mm =3D bprm->mm; + if (mm) + bpf_copy_from_user(args, sizeof(args), (void *)mm->arg_start); =20 value =3D bpf_map_lookup_elem(&array, &key); if (value) --=20 2.55.0 From nobody Thu Sep 24 23:33:22 2026 Received: from mail-wr2-f12.google.com (mail-wr2-f12.google.com [74.125.225.76]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 794C34F68C6 for ; Fri, 18 Sep 2026 13:18:35 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.225.76 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789737518; cv=none; b=U9znLAsOKdlv8pCP2S7urbNDn5SlAcrSoHTu5fYk7OieAITUlbG72r6QbrSawhEGjg3rXa8KTCccf9+do9uhGqY9b0qWWUNcCRSXEEP91Nu+gUhQ+El6FJPWp/2IZrVMpsjbRroEdGyBmCIN57IRMJjKGvm/4BF/dpV6IMA+QV0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789737518; c=relaxed/simple; bh=GnQNNaO2NdAe4bfr6j79tdcCpkRyZDIf9oDO6K4Un58=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=VYl8DR29mqhxqk12WT27X+gI/9s0GAn/OmWFg8kfNNQBQmgJJRxhqDvHPYwJA1XUf85WbNAc6BmzN70MXEkzenYZMfHNRU7Uz6cWozf6w0w3YHfLtYaRFcbyWXHvPGL3lRBF9Mi+xfrap4buXKFLAD/+HhBz1flXRwKChsWUXOw= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=dfNj6vqq; arc=none smtp.client-ip=74.125.225.76 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="dfNj6vqq" Received: by mail-wr2-f12.google.com with SMTP id ffacd0b85a97d-4843f22dc83so504182f8f.1 for ; Fri, 18 Sep 2026 06:18:35 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1789737513; x=1790342313; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=fpIPJYBrAn9lh0X90aJ+LjetM4Yd20S6QCxk4a13+gY=; b=dfNj6vqq9xkhGvDp+J6LNGtrm5ncKHKgZ8DFRcbBaYW1fEYVgQRm+GygaOxmtkowpi Hn6UAlfO3JrbHYqvVctOMS/O46fN8RBxPeAq7HwsObKpN4Gv5xnKfFZyiYSV/85gpsCK mJ0zFAZNfCANkCk6/ZCsf6OzyzYBiAPY+OM6t2Xz1NGPPiDp0nnbvMTkE9MjIOLuZ3nj ZzmJDso5Pp7WkAoRqsX3wzyzblhY9prTKhybIRe5eJ6VZAvHwqsS0DgByxx3ZWm2EHbY ZojEHTVgSft6SrLfQFWYn4EhDj2/OxavCHGMoq74PDzTq6Ap8TY8UtCLmh6uKSDtbYBR Bwag== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1789737513; x=1790342313; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=fpIPJYBrAn9lh0X90aJ+LjetM4Yd20S6QCxk4a13+gY=; b=dF0K7CFEAbJ0fNIF8IpdBmEeeG8iss15rfNuP0Ft5uDIPfwKZ1mlU1SpJ78KgQPhaS m23tR2gRTKbayczihIWIgKlSWutY/TUyShTNcU/V5TeG1cn9IDxosw9BHfCPzJkMoky+ /LMCeDN1e9XvMkjCzWzWeaYa3SN0ZbM3l5ZRm60uFS5LywbiHZF/K6UIBxy25z6duPGM GODo2RnS20ROBUgVz2j7a3RWvggLrl7rzvCuhgFy/FlkG3EFoJHPNchYJbGENYBMrYMe 0njK5+xsVx2kgi/b4lxT/zmKMlqCqJ1Clrk0C0L5jmJq1B/4IJnjhT8DK0MbzV2HR4dg GWdA== X-Forwarded-Encrypted: i=1; AKwUvByFLtCLQQFPUgBm7UA2C3TEf3hnMIRoGCbfeai5z6V16JyIWyLUcmE4IPFQue07UZPin+DFFb3rnzlxzM8=@vger.kernel.org X-Gm-Message-State: AFuF++lzZgs971MvSG1EolnLXTMD48unQBm5Y5r3UpL1DkgF3UYlf7BJ ty6MAcRMuEJksWXJ6JjhF9XX7sWIRmrS7Fwnb7JlnmH3o/2BC29NHVDD X-Gm-Gg: AYBFou38siD0AhE5Tsyjn+2kLoCEcxb+/ysyLiFdTTSNQgTbs/7/rmYa9MFLjSoNJV9 Y073j+5KKRV42kc/QTjuL57SZnM0CfkKSKrsfRcWQ/vnA9g/C4pdATNopUh1DGEJAw5TX+d2COv QUPxz8N6XBy9tNBq12VmH575h5reOFLRe+91RD5KljX9Thqmh+d6FjZ61uit3gnRPFVHIG1RRuh fmTdG6QV2rIJFpkjs9d2iL43s0s358WX1RDQ3XdkDTyzZHs6yNZO0khrIlu8Bcbh2vMuhfgdUrD Vi0G7MCtXwjz9rTDzuEY6RTrpBThN5ecqxAwR5rKnuqCxfAmlviC037nlRCDKND7Bmbj5PKQ+Vr KdCFP+p76f7JWXSkoMOyQT4eR8RuyqsStuLeTJks946TtUJ3UIPy/ZWSZYWgVtrzfS3awKqNAvm MHf4545LArrOqb2KIYqMcuXhzwRhucsnIqoFZQJos723QVNKdRvss3RP22bZugM59d4LEL/+/eT ocyzk/stB9BcXY= X-Received: by 2002:a05:6000:41f0:b0:487:7fd:730 with SMTP id ffacd0b85a97d-4871e254ef7mr3501858f8f.13.1789737513163; Fri, 18 Sep 2026 06:18:33 -0700 (PDT) Received: from dell-desktop ([2a02:587:4b4e:8500:290c:210b:1c76:5710]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-4871feb5de3sm4424549f8f.1.2026.09.18.06.18.31 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 18 Sep 2026 06:18:32 -0700 (PDT) From: Anastasios Papagiannis To: bpf@vger.kernel.org Cc: linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org, linux-mm@kvack.org, david@kernel.org, akpm@linux-foundation.org, andrii@kernel.org, ast@kernel.org, brauner@kernel.org, daniel@iogearbox.net, eddyz87@gmail.com, kpsingh@kernel.org, ljs@kernel.org, matt@bobrowski.net, memxor@gmail.com, song@kernel.org, sun.jian.kdev@gmail.com, utilityemal77@gmail.com, viro@zeniv.linux.org.uk, tasos.papagiannnis@gmail.com Subject: [PATCH bpf-next v9 5/5] selftests/bpf: Test mm_struct user memory kfuncs with linux_binprm Date: Fri, 18 Sep 2026 16:17:57 +0300 Message-ID: <20260918131757.42802-6-tasos.papagiannnis@gmail.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260918131757.42802-1-tasos.papagiannnis@gmail.com> References: <20260918131757.42802-1-tasos.papagiannnis@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Add a sleepable BPF LSM program attached to bprm_check_security to test bpf_copy_from_user_mm() and bpf_copy_from_user_mm_str(). Starting at bprm->p, verify that bpf_copy_from_user_mm() can copy the contiguous NUL-separated argument and environment data. Then use bpf_copy_from_user_mm_str() to read each argument and environment string separately, advancing the offset by the length returned from each call. Signed-off-by: Anastasios Papagiannis --- .../bpf/prog_tests/copy_from_user_bprm.c | 65 +++++++++++++++++ .../selftests/bpf/progs/copy_from_user_bprm.c | 69 +++++++++++++++++++ 2 files changed, 134 insertions(+) create mode 100644 tools/testing/selftests/bpf/prog_tests/copy_from_user_b= prm.c create mode 100644 tools/testing/selftests/bpf/progs/copy_from_user_bprm.c diff --git a/tools/testing/selftests/bpf/prog_tests/copy_from_user_bprm.c b= /tools/testing/selftests/bpf/prog_tests/copy_from_user_bprm.c new file mode 100644 index 000000000000..310370689427 --- /dev/null +++ b/tools/testing/selftests/bpf/prog_tests/copy_from_user_bprm.c @@ -0,0 +1,65 @@ +// SPDX-License-Identifier: GPL-2.0 + +#include +#include +#include + +#include + +#include "copy_from_user_bprm.skel.h" + +void test_copy_from_user_bprm(void) +{ + char data[] =3D "first\0second-argument\0SOME_ENV=3Da\0OTHER_ENV=3Dsometh= ing"; + char arg0[] =3D "first"; + char arg1[] =3D "second-argument"; + char env0[] =3D "SOME_ENV=3Da"; + char env1[] =3D "OTHER_ENV=3Dsomething"; + struct copy_from_user_bprm *skel; + pid_t child; + int status; + + skel =3D copy_from_user_bprm__open_and_load(); + if (!ASSERT_OK_PTR(skel, "open_and_load")) + return; + + if (!ASSERT_OK(copy_from_user_bprm__attach(skel), "attach")) + goto out; + + child =3D fork(); + if (!ASSERT_GE(child, 0, "fork")) + goto out; + + if (!child) { + char *const argv[] =3D { arg0, arg1, NULL }; + char *const envp[] =3D { env0, env1, NULL }; + + skel->bss->monitored_pid =3D getpid(); + execvpe("true", argv, envp); + _exit(errno); + } + + if (!ASSERT_EQ(waitpid(child, &status, 0), child, "waitpid")) + goto out; + + if (ASSERT_TRUE(WIFEXITED(status), "child_exited")) + ASSERT_EQ(WEXITSTATUS(status), EPERM, "exec_errno"); + + ASSERT_EQ(skel->bss->bprm_argc, 2, "bprm_argc"); + ASSERT_EQ(skel->bss->bprm_envc, 2, "bprm_envc"); + ASSERT_EQ(skel->bss->data_len, sizeof(data), "data_len"); + ASSERT_EQ(skel->bss->invalid_flags_ret, -EINVAL, "invalid_flags_ret"); + ASSERT_EQ(skel->bss->copy_ret, 0, "copy_ret"); + ASSERT_EQ(skel->bss->arg0_ret, sizeof(arg0), "arg0_ret"); + ASSERT_EQ(skel->bss->arg1_ret, sizeof(arg1), "arg1_ret"); + ASSERT_EQ(skel->bss->env0_ret, sizeof(env0), "env0_ret"); + ASSERT_EQ(skel->bss->env1_ret, sizeof(env1), "env1_ret"); + ASSERT_EQ(memcmp(skel->bss->data, data, sizeof(data)), 0, "data"); + ASSERT_EQ(memcmp(skel->bss->arg0, arg0, sizeof(arg0)), 0, "arg0"); + ASSERT_EQ(memcmp(skel->bss->arg1, arg1, sizeof(arg1)), 0, "arg1"); + ASSERT_EQ(memcmp(skel->bss->env0, env0, sizeof(env0)), 0, "env0"); + ASSERT_EQ(memcmp(skel->bss->env1, env1, sizeof(env1)), 0, "env1"); + +out: + copy_from_user_bprm__destroy(skel); +} diff --git a/tools/testing/selftests/bpf/progs/copy_from_user_bprm.c b/tool= s/testing/selftests/bpf/progs/copy_from_user_bprm.c new file mode 100644 index 000000000000..00ecba3ea567 --- /dev/null +++ b/tools/testing/selftests/bpf/progs/copy_from_user_bprm.c @@ -0,0 +1,69 @@ +// SPDX-License-Identifier: GPL-2.0 + +#include "vmlinux.h" + +#include +#include +#include + +char _license[] SEC("license") =3D "GPL"; + +int monitored_pid; +int bprm_argc; +int bprm_envc; +int data_len; +int invalid_flags_ret; +int copy_ret; +int arg0_ret; +int arg1_ret; +int env0_ret; +int env1_ret; +char data[64] =3D {}; +char arg0[32] =3D {}; +char arg1[32] =3D {}; +char env0[32] =3D {}; +char env1[32] =3D {}; + +SEC("lsm.s/bprm_check_security") +int BPF_PROG(check_exec_args, struct linux_binprm *bprm) +{ + u32 pid =3D bpf_get_current_pid_tgid() >> 32; + struct mm_struct *mm; + u64 offset =3D 0; + + if (pid !=3D monitored_pid) + return 0; + + mm =3D bprm->mm; + if (!mm) + return 0; + + bprm_argc =3D bprm->argc; + bprm_envc =3D bprm->envc; + + /* this is the total size of args and envs starting from bprm->p */ + data_len =3D bprm->exec - bprm->p; + + invalid_flags_ret =3D bpf_copy_from_user_mm(data, sizeof(data), (void *)b= prm->p, mm, ~0ULL); + + copy_ret =3D bpf_copy_from_user_mm(data, sizeof(data), (void *)bprm->p, m= m, 0); + if (copy_ret) + return 0; + + /* arg0 is at bprm->p */ + arg0_ret =3D bpf_copy_from_user_mm_str(arg0, sizeof(arg0), (void *)(bprm-= >p + offset), mm, BPF_F_PAD_ZEROS); + offset +=3D arg0_ret; + + /* arg1 is at bprm->p + arg0_ret */ + arg1_ret =3D bpf_copy_from_user_mm_str(arg1, sizeof(arg1), (void *)(bprm-= >p + offset), mm, BPF_F_PAD_ZEROS); + offset +=3D arg1_ret; + + /* env0 is at bprm->p + arg0_ret + arg1_ret */ + env0_ret =3D bpf_copy_from_user_mm_str(env0, sizeof(env0), (void *)(bprm-= >p + offset), mm, BPF_F_PAD_ZEROS); + offset +=3D env0_ret; + + /* env1 is at bprm->p + arg0_ret + arg1_ret + env0_ret */ + env1_ret =3D bpf_copy_from_user_mm_str(env1, sizeof(env1), (void *)(bprm-= >p + offset), mm, BPF_F_PAD_ZEROS); + + return -EPERM; +} --=20 2.55.0