linux-kernel - [PATCH] tracing/user_events: Run BPF program if attached

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Mon,  8 May 2023 09:37:51 -0700
From:   Beau Belgrave <beaub@...ux.microsoft.com>
To:     rostedt@...dmis.org, mhiramat@...nel.org
Cc:     linux-kernel@...r.kernel.org, linux-trace-kernel@...r.kernel.org,
        ast@...nel.org, daniel@...earbox.net, andrii@...nel.org,
        bpf@...r.kernel.org
Subject: [PATCH] tracing/user_events: Run BPF program if attached

Programs that utilize user_events today only get the event payloads via
perf or ftrace when writing event data. When BPF programs are attached
to tracepoints created by user_events the BPF programs do not get run
even though the attach succeeds. This causes confusion by the users of
the programs, as they expect the data to be available via BPF programs
they write. We have several projects that have hit this and requested
BPF program support when publishing data via user_events from their
user processes in production.

Swap out perf_trace_buf_submit() for perf_trace_run_bpf_submit() to
ensure BPF programs that are attached are run in addition to writing to
perf or ftrace buffers. This requires no changes to the BPF infrastructure
and only utilizes the GPL exported function that modules and other
components may use for the same purpose. This keeps user_events consistent
with how other kernel, modules, and probes expose tracepoint data to allow
attachment of a BPF program.

Cc: Alexei Starovoitov <ast@...nel.org>
Cc: Daniel Borkmann <daniel@...earbox.net>
Cc: Andrii Nakryiko <andrii@...nel.org>
Cc: bpf@...r.kernel.org
Signed-off-by: Beau Belgrave <beaub@...ux.microsoft.com>
---
 kernel/trace/trace_events_user.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/kernel/trace/trace_events_user.c b/kernel/trace/trace_events_user.c
index b1ecd7677642..838fced40a41 100644
--- a/kernel/trace/trace_events_user.c
+++ b/kernel/trace/trace_events_user.c
@@ -1422,11 +1422,12 @@ static void user_event_ftrace(struct user_event *user, struct iov_iter *i,
 static void user_event_perf(struct user_event *user, struct iov_iter *i,
 			    void *tpdata, bool *faulted)
 {
+	bool bpf_prog = bpf_prog_array_valid(&user->call);
 	struct hlist_head *perf_head;

 	perf_head = this_cpu_ptr(user->call.perf_events);

-	if (perf_head && !hlist_empty(perf_head)) {
+	if (perf_head && (!hlist_empty(perf_head) || bpf_prog)) {
 		struct trace_entry *perf_entry;
 		struct pt_regs *regs;
 		size_t size = sizeof(*perf_entry) + i->count;
@@ -1447,9 +1448,9 @@ static void user_event_perf(struct user_event *user, struct iov_iter *i,
 		    unlikely(user_event_validate(user, perf_entry, size)))
 			goto discard;

-		perf_trace_buf_submit(perf_entry, size, context,
-				      user->call.event.type, 1, regs,
-				      perf_head, NULL);
+		perf_trace_run_bpf_submit(perf_entry, size, context,
+					  &user->call, 1, regs,
+					  perf_head, NULL);

 		return;
 discard:

base-commit: 3862f86c1529fa0016de6344eb974877b4cd3838
-- 
2.25.1