linux-kernel - [PATCH bpf-next v2 0/5] bpf: Add bpf_task_pt

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 23 Aug 2021 19:43:45 -0700
From:   Daniel Xu <dxu@...uu.xyz>
To:     bpf@...r.kernel.org, yhs@...com, andriin@...com
Cc:     Daniel Xu <dxu@...uu.xyz>, kernel-team@...com,
        linux-kernel@...r.kernel.org
Subject: [PATCH bpf-next v2 0/5] bpf: Add bpf_task_pt_regs() helper

The motivation behind this helper is to access userspace pt_regs in a
kprobe handler.

uprobe's ctx is the userspace pt_regs. kprobe's ctx is the kernelspace
pt_regs. bpf_task_pt_regs() allows accessing userspace pt_regs in a
kprobe handler. The final case (kernelspace pt_regs in uprobe) is
pretty rare (usermode helper) so I think that can be solved later if
necessary.

More concretely, this helper is useful in doing BPF-based DWARF stack
unwinding. Currently the kernel can only do framepointer based stack
unwinds for userspace code. This is because the DWARF state machines are
too fragile to be computed in kernelspace [0]. The idea behind
DWARF-based stack unwinds w/ BPF is to copy a chunk of the userspace
stack (while in prog context) and send it up to userspace for unwinding
(probably with libunwind) [1]. This would effectively enable profiling
applications with -fomit-frame-pointer using kprobes and uprobes.

[0]: https://lkml.org/lkml/2012/2/10/356
[1]: https://github.com/danobi/bpf-dwarf-walk

Changes from v1:
- Conwolidate BTF_ID decls for task_struct
- Enable bpf_get_current_task_btf() for all prog types
- Enable bpf_task_pt_regs() for all prog types
- Use ASSERT_* macros instead of CHECK

Daniel Xu (5):
  bpf: Add BTF_ID_LIST_GLOBAL_SINGLE macro
  bpf: Consolidate task_struct BTF_ID declarations
  bpf: Extend bpf_base_func_proto helpers with
    bpf_get_current_task_btf()
  bpf: Add bpf_task_pt_regs() helper
  bpf: selftests: Add bpf_task_pt_regs() selftest

 include/linux/btf_ids.h                       |  5 ++
 include/uapi/linux/bpf.h                      |  7 +++
 kernel/bpf/bpf_task_storage.c                 |  6 +--
 kernel/bpf/helpers.c                          |  6 +++
 kernel/bpf/stackmap.c                         |  4 +-
 kernel/bpf/task_iter.c                        | 11 ++---
 kernel/trace/bpf_trace.c                      | 25 ++++++++--
 tools/include/uapi/linux/bpf.h                |  7 +++
 .../selftests/bpf/prog_tests/task_pt_regs.c   | 47 +++++++++++++++++++
 .../selftests/bpf/progs/test_task_pt_regs.c   | 29 ++++++++++++
 10 files changed, 131 insertions(+), 16 deletions(-)
 create mode 100644 tools/testing/selftests/bpf/prog_tests/task_pt_regs.c
 create mode 100644 tools/testing/selftests/bpf/progs/test_task_pt_regs.c

-- 
2.33.0