| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Fri, 16 Dec 2022 16:51:48 -0800
From: Yonghong Song <yhs@...a.com>
To: "Daniel T. Lee" <danieltimlee@...il.com>,
Daniel Borkmann <daniel@...earbox.net>,
Alexei Starovoitov <ast@...nel.org>,
Andrii Nakryiko <andrii.nakryiko@...il.com>,
Yonghong Song <yhs@...com>
Cc: bpf@...r.kernel.org, netdev@...r.kernel.org
Subject: Re: [bpf-next 0/5] samples: bpf: enhance syscall tracing program
On 12/15/22 3:39 AM, Daniel T. Lee wrote:
> Syscall tracing using kprobe is quite unstable. Since it uses the exact
> name of the kernel function, the program might broke due to the rename
> of a function. The problem can also be caused by a changes in the
> arguments of the function to which the kprobe connects. This commit
> enhances syscall tracing program with the following instruments.
>
> In this patchset, ksyscall is used instead of kprobe. By using
> ksyscall, libbpf will detect the appropriate kernel function name.
> (e.g. sys_write -> __s390_sys_write). This eliminates the need to worry
> about which wrapper function to attach in order to parse arguments.
> Also ksyscall provides more fine method with attaching system call, the
> coarse SYSCALL helper at trace_common.h can be removed.
>
> Next, BPF_SYSCALL is used to reduce the inconvenience of parsing
> arguments. Since the nature of SYSCALL_WRAPPER function wraps the
> argument once, additional process of argument extraction is required
> to properly parse the argument. The BPF_SYSCALL macro will reduces the
> hassle of parsing arguments from pt_regs.
>
> Lastly, vmlinux.h is applied to syscall tracing program. This change
> allows the bpf program to refer to the internal structure as a single
> "vmlinux.h" instead of including each header referenced by the bpf
> program.
>
> Additionally, this patchset changes the suffix of _kern to .bpf to make
> use of the new compile rule (CLANG-BPF) which is more simple and neat.
> By just changing the _kern suffix to .bpf will inherit the benefit of
> the new CLANG-BPF compile target.
>
> Daniel T. Lee (5):
> samples: bpf: use kyscall instead of kprobe in syscall tracing program
> samples: bpf: use vmlinux.h instead of implicit headers in syscall
> tracing program
> samples: bpf: change _kern suffix to .bpf with syscall tracing program
> samples: bpf: fix tracex2 by using BPF_KSYSCALL macro
> samples: bpf: use BPF_KSYSCALL macro in syscall tracing programs
Please change 'samples: bpf" to "samples/bpf".
Also, bpf CI reported some new warnings and failures:
https://github.com/kernel-patches/bpf/actions/runs/3708274678/jobs/6285674300
CLANG-bpf /tmp/work/bpf/bpf/samples/bpf/tracex4_kern.o
/tmp/work/bpf/bpf/samples/bpf/xdp_fwd_user.c: In function ‘main’:
/tmp/work/bpf/bpf/samples/bpf/xdp_fwd_user.c:85:44: warning: ‘_prog’
directive output may be truncated writing 5 bytes into a region of size
between 2 and 9 [-Wformat-truncation=]
85 | snprintf(prog_name, sizeof(prog_name), "%s_prog", app_name);
| ^~~~~
In file included from /usr/include/stdio.h:867,
from /tmp/work/bpf/bpf/samples/bpf/xdp_fwd_user.c:19:
/usr/include/x86_64-linux-gnu/bits/stdio2.h:67:10: note:
‘__builtin___snprintf_chk’ output between 13 and 20 bytes into a
destination of size 16
67 | return __builtin___snprintf_chk (__s, __n,
__USE_FORTIFY_LEVEL - 1,
|
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
68 | __bos (__s), __fmt, __va_arg_pack ());
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
CC /tmp/work/bpf/bpf/samples/bpf/syscall_nrs.s
...
CLANG-BPF
/tmp/work/bpf/bpf/samples/bpf/test_current_task_under_cgroup.bpf.o
In file included from
/tmp/work/bpf/bpf/samples/bpf/test_probe_write_user.bpf.c:8:
In file included from /usr/include/string.h:26:
In file included from
/usr/include/x86_64-linux-gnu/bits/libc-header-start.h:33:
In file included from /usr/include/features.h:485:
/usr/include/x86_64-linux-gnu/gnu/stubs.h:7:11: fatal error:
'gnu/stubs-32.h' file not found
# include <gnu/stubs-32.h>
^~~~~~~~~~~~~~~~
1 error generated.
make[3]: *** [/tmp/work/bpf/bpf/samples/bpf/Makefile:394:
/tmp/work/bpf/bpf/samples/bpf/test_probe_write_user.bpf.o] Error 1
make[3]: *** Waiting for unfinished jobs....
In file included from
/tmp/work/bpf/bpf/samples/bpf/map_perf_test.bpf.c:8:
In file included from /usr/include/errno.h:25:
In file included from /usr/include/features.h:485:
/usr/include/x86_64-linux-gnu/gnu/stubs.h:7:11: fatal error:
'gnu/stubs-32.h' file not found
# include <gnu/stubs-32.h>
^~~~~~~~~~~~~~~~
1 error generated.
make[3]: *** [/tmp/work/bpf/bpf/samples/bpf/Makefile:394:
/tmp/work/bpf/bpf/samples/bpf/map_perf_test.bpf.o] Error 1
make[2]: *** [/tmp/work/bpf/bpf/Makefile:1994:
/tmp/work/bpf/bpf/samples/bpf] Error 2
make[2]: Leaving directory '/tmp/work/bpf/bpf/kbuild-output'
make[1]: *** [Makefile:231: __sub-make] Error 2
make[1]: Leaving directory '/tmp/work/bpf/bpf'
make: *** [Makefile:269: all] Error 2
make: Leaving directory '/tmp/work/bpf/bpf/samples/bpf'
Error: Process completed with exit code 2.
Please check bpf ci https://github.com/kernel-patches/bpf
and fix the above issues properly.
>
> samples/bpf/Makefile | 10 ++--
> ...p_perf_test_kern.c => map_perf_test.bpf.c} | 48 ++++++++-----------
> samples/bpf/map_perf_test_user.c | 2 +-
> ...c => test_current_task_under_cgroup.bpf.c} | 11 ++---
> .../bpf/test_current_task_under_cgroup_user.c | 2 +-
> samples/bpf/test_map_in_map_kern.c | 1 -
> ...ser_kern.c => test_probe_write_user.bpf.c} | 20 ++++----
> samples/bpf/test_probe_write_user_user.c | 2 +-
> samples/bpf/trace_common.h | 13 -----
> ...trace_output_kern.c => trace_output.bpf.c} | 6 +--
> samples/bpf/trace_output_user.c | 2 +-
> samples/bpf/{tracex2_kern.c => tracex2.bpf.c} | 13 ++---
> samples/bpf/tracex2_user.c | 2 +-
> 13 files changed, 51 insertions(+), 81 deletions(-)
> rename samples/bpf/{map_perf_test_kern.c => map_perf_test.bpf.c} (85%)
> rename samples/bpf/{test_current_task_under_cgroup_kern.c => test_current_task_under_cgroup.bpf.c} (84%)
> rename samples/bpf/{test_probe_write_user_kern.c => test_probe_write_user.bpf.c} (71%)
> delete mode 100644 samples/bpf/trace_common.h
> rename samples/bpf/{trace_output_kern.c => trace_output.bpf.c} (82%)
> rename samples/bpf/{tracex2_kern.c => tracex2.bpf.c} (89%)
>
Powered by blists - more mailing lists