linux-kernel - [PATCH bpf-next] samples/bpf: tracex2: Replace kfree

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <tencent_9F90905CD6FBE5B00AF1EBD9681A62990106@qq.com>
Date: Wed, 28 Aug 2024 09:18:34 +0800
From: Rong Tao <rtoax@...mail.com>
To: andrii@...nel.org,
	daniel@...earbox.net,
	ast@...nel.org
Cc: rongtao@...tc.cn,
	Martin KaFai Lau <martin.lau@...ux.dev>,
	Eduard Zingerman <eddyz87@...il.com>,
	Song Liu <song@...nel.org>,
	Yonghong Song <yonghong.song@...ux.dev>,
	John Fastabend <john.fastabend@...il.com>,
	KP Singh <kpsingh@...nel.org>,
	Stanislav Fomichev <sdf@...ichev.me>,
	Hao Luo <haoluo@...gle.com>,
	Jiri Olsa <jolsa@...nel.org>,
	bpf@...r.kernel.org (open list:BPF [GENERAL] (Safe Dynamic Programs and Tools)),
	linux-kernel@...r.kernel.org (open list)
Subject: [PATCH bpf-next] samples/bpf: tracex2: Replace kfree_skb from kprobe to tracepoint

From: Rong Tao <rongtao@...tc.cn>

In commit ba8de796baf4 ("net: introduce sk_skb_reason_drop function")
kfree_skb_reason() becomes an inline function and cannot be traced.
We can use the stable tracepoint kfree_skb to get 'ip'.

Link: https://github.com/torvalds/linux/commit/ba8de796baf4bdc03530774fb284fe3c97875566
Signed-off-by: Rong Tao <rongtao@...tc.cn>
---
 samples/bpf/tracex2.bpf.c | 13 ++++---------
 1 file changed, 4 insertions(+), 9 deletions(-)

diff --git a/samples/bpf/tracex2.bpf.c b/samples/bpf/tracex2.bpf.c
index 0a5c75b367be..dc3d91b65a6f 100644
--- a/samples/bpf/tracex2.bpf.c
+++ b/samples/bpf/tracex2.bpf.c
@@ -17,20 +17,15 @@ struct {
 	__uint(max_entries, 1024);
 } my_map SEC(".maps");
 
-/* kprobe is NOT a stable ABI. If kernel internals change this bpf+kprobe
- * example will no longer be meaningful
- */
-SEC("kprobe/kfree_skb_reason")
-int bpf_prog2(struct pt_regs *ctx)
+SEC("tracepoint/skb/kfree_skb")
+int bpf_prog1(struct trace_event_raw_kfree_skb *ctx)
 {
 	long loc = 0;
 	long init_val = 1;
 	long *value;
 
-	/* read ip of kfree_skb_reason caller.
-	 * non-portable version of __builtin_return_address(0)
-	 */
-	BPF_KPROBE_READ_RET_IP(loc, ctx);
+	/* read ip */
+	loc = (long)ctx->location;
 
 	value = bpf_map_lookup_elem(&my_map, &loc);
 	if (value)
-- 
2.46.0