linux-kernel - Re: [RFC PATCH v3 7/9] bpf: Add kprobe link for attaching raw kprobes

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20220120211527.cd46c74ce2ad8f401aec545a@kernel.org>
Date:   Thu, 20 Jan 2022 21:15:27 +0900
From:   Masami Hiramatsu <mhiramat@...nel.org>
To:     Jiri Olsa <jolsa@...hat.com>
Cc:     Alexei Starovoitov <ast@...nel.org>,
        Daniel Borkmann <daniel@...earbox.net>,
        Andrii Nakryiko <andrii@...nel.org>, netdev@...r.kernel.org,
        bpf@...r.kernel.org, lkml <linux-kernel@...r.kernel.org>,
        Martin KaFai Lau <kafai@...com>,
        Song Liu <songliubraving@...com>, Yonghong Song <yhs@...com>,
        John Fastabend <john.fastabend@...il.com>,
        KP Singh <kpsingh@...omium.org>,
        Steven Rostedt <rostedt@...dmis.org>,
        "Naveen N . Rao" <naveen.n.rao@...ux.ibm.com>,
        Anil S Keshavamurthy <anil.s.keshavamurthy@...el.com>,
        "David S . Miller" <davem@...emloft.net>
Subject: Re: [RFC PATCH v3 7/9] bpf: Add kprobe link for attaching raw
 kprobes

On Thu, 20 Jan 2022 11:44:54 +0100
Jiri Olsa <jolsa@...hat.com> wrote:

> On Wed, Jan 19, 2022 at 11:57:50PM +0900, Masami Hiramatsu wrote:
> 
> SNIP
> 
> > +static int kprobe_link_prog_run(struct bpf_kprobe_link *kprobe_link,
> > +				struct pt_regs *regs)
> > +{
> > +	struct bpf_trace_run_ctx run_ctx;
> > +	struct bpf_run_ctx *old_run_ctx;
> > +	int err;
> > +
> > +	if (unlikely(__this_cpu_inc_return(bpf_prog_active) != 1)) {
> > +		err = 0;
> > +		goto out;
> > +	}
> > +
> > +	old_run_ctx = bpf_set_run_ctx(&run_ctx.run_ctx);
> > +	run_ctx.bpf_cookie = kprobe_link->bpf_cookie;
> > +
> > +	rcu_read_lock();
> > +	migrate_disable();
> > +	err = bpf_prog_run(kprobe_link->link.prog, regs);
> > +	migrate_enable();
> > +	rcu_read_unlock();
> > +
> > +	bpf_reset_run_ctx(old_run_ctx);
> > +
> > + out:
> > +	__this_cpu_dec(bpf_prog_active);
> > +	return err;
> > +}
> > +
> > +static void kprobe_link_entry_handler(struct fprobe *fp, unsigned long entry_ip,
> > +				      struct pt_regs *regs)
> > +{
> > +	struct bpf_kprobe_link *kprobe_link;
> > +
> > +	/*
> > +	 * Because fprobe's regs->ip is set to the next instruction of
> > +	 * dynamic-ftrace insturction, correct entry ip must be set, so
> > +	 * that the bpf program can access entry address via regs as same
> > +	 * as kprobes.
> > +	 */
> > +	instruction_pointer_set(regs, entry_ip);
> 
> ok, so this actually does the stall for me.. it changes
> the return address back to repeat the call again

Good catch! and don't mind, this change is introduced me :-P.
I thought that if I didn't add the FTRACE_FL_IPMODIFY, ftrace
ignores the updated regs->ip, but it doesn't.

> bu I think it's good idea to carry the original ip in regs
> (for bpf_get_func_ip helper) so I think we need to save it
> first and restore after the callback

Yes, btw, should I do that fix in fprobe?

> 
> I'll make the fix and add cookie change Andrii asked for
> on top of your ftrace changes and let you know

OK, thank you!

> 
> thanks,
> jirka
> 
> > +	kprobe_link = container_of(fp, struct bpf_kprobe_link, fp);
> > +	kprobe_link_prog_run(kprobe_link, regs);
> > +}
> > +
> 
> SNIP
> 


-- 
Masami Hiramatsu <mhiramat@...nel.org>