HID: bpf: prevent infinite recursions with hid_hw_raw_requests hooks

When we attach a sleepable hook to hid_hw_raw_requests, we can (and in
many cases should) call ourself hid_bpf_raw_request(), to actually fetch
data from the device itself.

However, this means that we might enter an infinite loop between
hid_hw_raw_requests hooks and hid_bpf_hw_request() call.

To prevent that, if a hid_bpf_hw_request() call is emitted, we prevent
any new call of this kfunc by storing the information in the context.
This way we can always trace/monitor/filter the incoming bpf requests,
while preventing those loops to happen.

I don't think exposing "from_bpf" is very interesting because while
writing such a bpf program, you need to match at least the report number
and/or the source of the call. So a blind "if there is a
hid_hw_raw_request() call, I'm emitting another one" makes no real
sense.

Link: https://patch.msgid.link/20240626-hid_hw_req_bpf-v2-5-cfd60fb6c79f@kernel.org
Acked-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>

diff --git a/drivers/hid/bpf/hid_bpf_dispatch.c b/drivers/hid/bpf/hid_bpf_dispatch.c
index 37a1bb381684001b797429941237470a7065b1e4..61c02538e5913072280d875991954b98daa27d2f 100644 (file)
--- a/drivers/hid/bpf/hid_bpf_dispatch.c
+++ b/drivers/hid/bpf/hid_bpf_dispatch.c
@@ -78,7 +78,7 @@ int dispatch_hid_bpf_raw_requests(struct hid_device *hdev,
                                  unsigned char reportnum, u8 *buf,
                                  u32 size, enum hid_report_type rtype,
                                  enum hid_class_request reqtype,
-                                 u64 source)
+                                 u64 source, bool from_bpf)
 {
        struct hid_bpf_ctx_kern ctx_kern = {
                .ctx = {
@@ -87,6 +87,7 @@ int dispatch_hid_bpf_raw_requests(struct hid_device *hdev,
                        .size = size,
                },
                .data = buf,
+               .from_bpf = from_bpf,
        };
        struct hid_bpf_ops *e;
        int ret, idx;
@@ -364,11 +365,17 @@ __bpf_kfunc int
 hid_bpf_hw_request(struct hid_bpf_ctx *ctx, __u8 *buf, size_t buf__sz,
                   enum hid_report_type rtype, enum hid_class_request reqtype)
 {
+       struct hid_bpf_ctx_kern *ctx_kern;
        struct hid_device *hdev;
        size_t size = buf__sz;
        u8 *dma_data;
        int ret;
 
+       ctx_kern = container_of(ctx, struct hid_bpf_ctx_kern, ctx);
+
+       if (ctx_kern->from_bpf)
+               return -EDEADLOCK;
+
        /* check arguments */
        ret = __hid_bpf_hw_check_params(ctx, buf, &size, rtype);
        if (ret)
@@ -398,7 +405,8 @@ hid_bpf_hw_request(struct hid_bpf_ctx *ctx, __u8 *buf, size_t buf__sz,
                                              size,
                                              rtype,
                                              reqtype,
-                                             (__u64)ctx);
+                                             (__u64)ctx,
+                                             true); /* prevent infinite recursions */
 
        if (ret > 0)
                memcpy(buf, dma_data, ret);

diff --git a/drivers/hid/bpf/hid_bpf_dispatch.h b/drivers/hid/bpf/hid_bpf_dispatch.h
index 835e6f69f479877c631e7bd149503a3d4baa2168..44c6ea22233f4726061e86358ff8cd6b23ce76a7 100644 (file)
--- a/drivers/hid/bpf/hid_bpf_dispatch.h
+++ b/drivers/hid/bpf/hid_bpf_dispatch.h
@@ -8,6 +8,7 @@
 struct hid_bpf_ctx_kern {
        struct hid_bpf_ctx ctx;
        u8 *data;
+       bool from_bpf;
 };
 
 struct hid_device *hid_get_device(unsigned int hid_id);

diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index 16731804c6bd0eb215829ffeeb21dcd3b4448462..2038ba08eaa16a241aa64fb91a09487295f6b9f6 100644 (file)
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -2403,7 +2403,7 @@ int __hid_hw_raw_request(struct hid_device *hdev,
                         unsigned char reportnum, __u8 *buf,
                         size_t len, enum hid_report_type rtype,
                         enum hid_class_request reqtype,
-                        __u64 source)
+                        __u64 source, bool from_bpf)
 {
        unsigned int max_buffer_size = HID_MAX_BUFFER_SIZE;
        int ret;
@@ -2415,7 +2415,7 @@ int __hid_hw_raw_request(struct hid_device *hdev,
                return -EINVAL;
 
        ret = dispatch_hid_bpf_raw_requests(hdev, reportnum, buf, len, rtype,
-                                           reqtype, source);
+                                           reqtype, source, from_bpf);
        if (ret)
                return ret;
 
@@ -2441,7 +2441,7 @@ int hid_hw_raw_request(struct hid_device *hdev,
                       unsigned char reportnum, __u8 *buf,
                       size_t len, enum hid_report_type rtype, enum hid_class_request reqtype)
 {
-       return __hid_hw_raw_request(hdev, reportnum, buf, len, rtype, reqtype, 0);
+       return __hid_hw_raw_request(hdev, reportnum, buf, len, rtype, reqtype, 0, false);
 }
 EXPORT_SYMBOL_GPL(hid_hw_raw_request);
 

diff --git a/drivers/hid/hidraw.c b/drivers/hid/hidraw.c
index 6d2a6d38e42a031278a0311f0ce715e73f4bdf9e..4ba3131de61498a49fb41f4133e766f5d358f0c8 100644 (file)
--- a/drivers/hid/hidraw.c
+++ b/drivers/hid/hidraw.c
@@ -151,7 +151,7 @@ static ssize_t hidraw_send_report(struct file *file, const char __user *buffer,
        }
 
        ret = __hid_hw_raw_request(dev, buf[0], buf, count, report_type,
-                                  HID_REQ_SET_REPORT, (__u64)file);
+                                  HID_REQ_SET_REPORT, (__u64)file, false);
 
 out_free:
        kfree(buf);
@@ -228,7 +228,7 @@ static ssize_t hidraw_get_report(struct file *file, char __user *buffer, size_t
        }
 
        ret = __hid_hw_raw_request(dev, report_number, buf, count, report_type,
-                                  HID_REQ_GET_REPORT, (__u64)file);
+                                  HID_REQ_GET_REPORT, (__u64)file, false);
 
        if (ret < 0)
                goto out_free;

diff --git a/include/linux/hid.h b/include/linux/hid.h
index dac2804b4562dc67570a51bc2d937ab150a202d6..24d0d7c0bd33964ed0a71be2ffcc35f557fdb26a 100644 (file)
--- a/include/linux/hid.h
+++ b/include/linux/hid.h
@@ -1129,7 +1129,7 @@ int __hid_hw_raw_request(struct hid_device *hdev,
                         unsigned char reportnum, __u8 *buf,
                         size_t len, enum hid_report_type rtype,
                         enum hid_class_request reqtype,
-                        __u64 source);
+                        __u64 source, bool from_bpf);
 int __hid_hw_output_report(struct hid_device *hdev, __u8 *buf, size_t len, __u64 source);
 int hid_hw_raw_request(struct hid_device *hdev,
                       unsigned char reportnum, __u8 *buf,

diff --git a/include/linux/hid_bpf.h b/include/linux/hid_bpf.h
index 3c01f7f8b6fce7c3530cff3b57615bfa69b633eb..088c94b6d8ec8919db1d802b0818768c26684e9b 100644 (file)
--- a/include/linux/hid_bpf.h
+++ b/include/linux/hid_bpf.h
@@ -68,7 +68,7 @@ struct hid_ops {
                                  unsigned char reportnum, __u8 *buf,
                                  size_t len, enum hid_report_type rtype,
                                  enum hid_class_request reqtype,
-                                 __u64 source);
+                                 __u64 source, bool from_bpf);
        int (*hid_hw_output_report)(struct hid_device *hdev, __u8 *buf, size_t len,
                                    __u64 source);
        int (*hid_input_report)(struct hid_device *hid, enum hid_report_type type,
@@ -181,7 +181,7 @@ int dispatch_hid_bpf_raw_requests(struct hid_device *hdev,
                                  unsigned char reportnum, __u8 *buf,
                                  u32 size, enum hid_report_type rtype,
                                  enum hid_class_request reqtype,
-                                 __u64 source);
+                                 __u64 source, bool from_bpf);
 int hid_bpf_connect_device(struct hid_device *hdev);
 void hid_bpf_disconnect_device(struct hid_device *hdev);
 void hid_bpf_destroy_device(struct hid_device *hid);
@@ -195,7 +195,7 @@ static inline int dispatch_hid_bpf_raw_requests(struct hid_device *hdev,
                                                unsigned char reportnum, u8 *buf,
                                                u32 size, enum hid_report_type rtype,
                                                enum hid_class_request reqtype,
-                                               u64 source) { return 0; }
+                                               u64 source, bool from_bpf) { return 0; }
 static inline int hid_bpf_connect_device(struct hid_device *hdev) { return 0; }
 static inline void hid_bpf_disconnect_device(struct hid_device *hdev) {}
 static inline void hid_bpf_destroy_device(struct hid_device *hid) {}