Commit 75839101 authored by Benjamin Tissoires's avatar Benjamin Tissoires
Browse files

HID: bpf: prevent infinite recursions with hid_hw_raw_requests hooks 

When we attach a sleepable hook to hid_hw_raw_requests, we can (and in
many cases should) call ourself hid_bpf_raw_request(), to actually fetch
data from the device itself.

However, this means that we might enter an infinite loop between
hid_hw_raw_requests hooks and hid_bpf_hw_request() call.

To prevent that, if a hid_bpf_hw_request() call is emitted, we prevent
any new call of this kfunc by storing the information in the context.
This way we can always trace/monitor/filter the incoming bpf requests,
while preventing those loops to happen.

I don't think exposing "from_bpf" is very interesting because while
writing such a bpf program, you need to match at least the report number
and/or the source of the call. So a blind "if there is a
hid_hw_raw_request() call, I'm emitting another one" makes no real
sense.

Link: https://patch.msgid.link/20240626-hid_hw_req_bpf-v2-5-cfd60fb6c79f@kernel.org


Acked-by: default avatarJiri Kosina <jkosina@suse.com>
Signed-off-by: default avatarBenjamin Tissoires <bentiss@kernel.org>
parent 8bd0488b

drivers/hid/bpf/hid_bpf_dispatch.c

+10 −2
Original line number Diff line number Diff line
@@ -78,7 +78,7 @@ int dispatch_hid_bpf_raw_requests(struct hid_device *hdev, 
				  unsigned char reportnum, u8 *buf,

				  u32 size, enum hid_report_type rtype,

				  enum hid_class_request reqtype,

				  u64 source)

				  u64 source, bool from_bpf)

{

	struct hid_bpf_ctx_kern ctx_kern = {

		.ctx = {
@@ -87,6 +87,7 @@ int dispatch_hid_bpf_raw_requests(struct hid_device *hdev, 
			.size = size,

		},

		.data = buf,

		.from_bpf = from_bpf,

	};

	struct hid_bpf_ops *e;

	int ret, idx;
@@ -364,11 +365,17 @@ __bpf_kfunc int 
hid_bpf_hw_request(struct hid_bpf_ctx *ctx, __u8 *buf, size_t buf__sz,

		   enum hid_report_type rtype, enum hid_class_request reqtype)

{

	struct hid_bpf_ctx_kern *ctx_kern;

	struct hid_device *hdev;

	size_t size = buf__sz;

	u8 *dma_data;

	int ret;



	ctx_kern = container_of(ctx, struct hid_bpf_ctx_kern, ctx);



	if (ctx_kern->from_bpf)

		return -EDEADLOCK;



	/* check arguments */

	ret = __hid_bpf_hw_check_params(ctx, buf, &size, rtype);

	if (ret)
@@ -398,7 +405,8 @@ hid_bpf_hw_request(struct hid_bpf_ctx *ctx, __u8 *buf, size_t buf__sz, 
					      size,

					      rtype,

					      reqtype,

					      (__u64)ctx);

					      (__u64)ctx,

					      true); /* prevent infinite recursions */



	if (ret > 0)

		memcpy(buf, dma_data, ret);

drivers/hid/bpf/hid_bpf_dispatch.h

+1 −0
Original line number Diff line number Diff line
@@ -8,6 +8,7 @@ 
struct hid_bpf_ctx_kern {

	struct hid_bpf_ctx ctx;

	u8 *data;

	bool from_bpf;

};



struct hid_device *hid_get_device(unsigned int hid_id);

drivers/hid/hid-core.c

+3 −3
Original line number Diff line number Diff line
@@ -2403,7 +2403,7 @@ int __hid_hw_raw_request(struct hid_device *hdev, 
			 unsigned char reportnum, __u8 *buf,

			 size_t len, enum hid_report_type rtype,

			 enum hid_class_request reqtype,

			 __u64 source)

			 __u64 source, bool from_bpf)

{

	unsigned int max_buffer_size = HID_MAX_BUFFER_SIZE;

	int ret;
@@ -2415,7 +2415,7 @@ int __hid_hw_raw_request(struct hid_device *hdev, 
		return -EINVAL;



	ret = dispatch_hid_bpf_raw_requests(hdev, reportnum, buf, len, rtype,

					    reqtype, source);

					    reqtype, source, from_bpf);

	if (ret)

		return ret;
@@ -2441,7 +2441,7 @@ int hid_hw_raw_request(struct hid_device *hdev, 
		       unsigned char reportnum, __u8 *buf,

		       size_t len, enum hid_report_type rtype, enum hid_class_request reqtype)

{

	return __hid_hw_raw_request(hdev, reportnum, buf, len, rtype, reqtype, 0);

	return __hid_hw_raw_request(hdev, reportnum, buf, len, rtype, reqtype, 0, false);

}

EXPORT_SYMBOL_GPL(hid_hw_raw_request);

drivers/hid/hidraw.c

+2 −2
Original line number Diff line number Diff line
@@ -151,7 +151,7 @@ static ssize_t hidraw_send_report(struct file *file, const char __user *buffer, 
	}



	ret = __hid_hw_raw_request(dev, buf[0], buf, count, report_type,

				   HID_REQ_SET_REPORT, (__u64)file);

				   HID_REQ_SET_REPORT, (__u64)file, false);



out_free:

	kfree(buf);
@@ -228,7 +228,7 @@ static ssize_t hidraw_get_report(struct file *file, char __user *buffer, size_t 
	}



	ret = __hid_hw_raw_request(dev, report_number, buf, count, report_type,

				   HID_REQ_GET_REPORT, (__u64)file);

				   HID_REQ_GET_REPORT, (__u64)file, false);



	if (ret < 0)

		goto out_free;

include/linux/hid.h

+1 −1
Original line number Diff line number Diff line
@@ -1129,7 +1129,7 @@ int __hid_hw_raw_request(struct hid_device *hdev, 
			 unsigned char reportnum, __u8 *buf,

			 size_t len, enum hid_report_type rtype,

			 enum hid_class_request reqtype,

			 __u64 source);

			 __u64 source, bool from_bpf);

int __hid_hw_output_report(struct hid_device *hdev, __u8 *buf, size_t len, __u64 source);

int hid_hw_raw_request(struct hid_device *hdev,

		       unsigned char reportnum, __u8 *buf,