linux-kernel - Re: [PATCH bpf-next] samples/bpf: tracex2: Replace kfree

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAEf4BzaCW03xOp6=rSUqmy8DRFvGJWHy1LyGNdpP+D-D9Eo+Yw@mail.gmail.com>
Date: Fri, 30 Aug 2024 13:01:11 -0700
From: Andrii Nakryiko <andrii.nakryiko@...il.com>
To: Rong Tao <rtoax@...mail.com>
Cc: andrii@...nel.org, daniel@...earbox.net, ast@...nel.org, rongtao@...tc.cn, 
	Martin KaFai Lau <martin.lau@...ux.dev>, Eduard Zingerman <eddyz87@...il.com>, Song Liu <song@...nel.org>, 
	Yonghong Song <yonghong.song@...ux.dev>, John Fastabend <john.fastabend@...il.com>, 
	KP Singh <kpsingh@...nel.org>, Stanislav Fomichev <sdf@...ichev.me>, Hao Luo <haoluo@...gle.com>, 
	Jiri Olsa <jolsa@...nel.org>, 
	"open list:BPF [GENERAL] (Safe Dynamic Programs and Tools)" <bpf@...r.kernel.org>, open list <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH bpf-next] samples/bpf: tracex2: Replace kfree_skb from
 kprobe to tracepoint

On Tue, Aug 27, 2024 at 6:19 PM Rong Tao <rtoax@...mail.com> wrote:
>
> From: Rong Tao <rongtao@...tc.cn>
>
> In commit ba8de796baf4 ("net: introduce sk_skb_reason_drop function")
> kfree_skb_reason() becomes an inline function and cannot be traced.
> We can use the stable tracepoint kfree_skb to get 'ip'.
>
> Link: https://github.com/torvalds/linux/commit/ba8de796baf4bdc03530774fb284fe3c97875566
> Signed-off-by: Rong Tao <rongtao@...tc.cn>
> ---
>  samples/bpf/tracex2.bpf.c | 13 ++++---------
>  1 file changed, 4 insertions(+), 9 deletions(-)
>

Maybe just remove this "sample". samples/bpf is abandonware by now,
and we should slowly but surely convert whatever makes sense into BPF
selftests under tools/testing/selftests/bpf and just get rid of the
rest.

> diff --git a/samples/bpf/tracex2.bpf.c b/samples/bpf/tracex2.bpf.c
> index 0a5c75b367be..dc3d91b65a6f 100644
> --- a/samples/bpf/tracex2.bpf.c
> +++ b/samples/bpf/tracex2.bpf.c
> @@ -17,20 +17,15 @@ struct {
>         __uint(max_entries, 1024);
>  } my_map SEC(".maps");
>
> -/* kprobe is NOT a stable ABI. If kernel internals change this bpf+kprobe
> - * example will no longer be meaningful
> - */
> -SEC("kprobe/kfree_skb_reason")
> -int bpf_prog2(struct pt_regs *ctx)
> +SEC("tracepoint/skb/kfree_skb")
> +int bpf_prog1(struct trace_event_raw_kfree_skb *ctx)
>  {
>         long loc = 0;
>         long init_val = 1;
>         long *value;
>
> -       /* read ip of kfree_skb_reason caller.
> -        * non-portable version of __builtin_return_address(0)
> -        */
> -       BPF_KPROBE_READ_RET_IP(loc, ctx);
> +       /* read ip */
> +       loc = (long)ctx->location;
>
>         value = bpf_map_lookup_elem(&my_map, &loc);
>         if (value)
> --
> 2.46.0
>
>