netdev - Re: [PATCH net-next v4 1/2] bpf: add support for sys_enter_* and sys_exit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <9e28069f-c127-5596-c327-01a09f498a51@fb.com>
Date:   Mon, 7 Aug 2017 08:51:09 -1000
From:   Alexei Starovoitov <ast@...com>
To:     Yonghong Song <yhs@...com>, <peterz@...radead.org>,
        <rostedt@...dmis.org>, <daniel@...earbox.net>,
        <netdev@...r.kernel.org>
CC:     <kernel-team@...com>
Subject: Re: [PATCH net-next v4 1/2] bpf: add support for sys_enter_* and
 sys_exit_* tracepoints

On 8/4/17 1:00 PM, Yonghong Song wrote:
> Currently, bpf programs cannot be attached to sys_enter_* and sys_exit_*
> style tracepoints. The iovisor/bcc issue #748
> (https://github.com/iovisor/bcc/issues/748) documents this issue.
> For example, if you try to attach a bpf program to tracepoints
> syscalls/sys_enter_newfstat, you will get the following error:
>    # ./tools/trace.py t:syscalls:sys_enter_newfstat
>    Ioctl(PERF_EVENT_IOC_SET_BPF): Invalid argument
>    Failed to attach BPF to tracepoint
>
> The main reason is that syscalls/sys_enter_* and syscalls/sys_exit_*
> tracepoints are treated differently from other tracepoints and there
> is no bpf hook to it.
>
> This patch adds bpf support for these syscalls tracepoints by
>   . permitting bpf attachment in ioctl PERF_EVENT_IOC_SET_BPF
>   . calling bpf programs in perf_syscall_enter and perf_syscall_exit
>
> The legality of bpf program ctx access is also checked.
> Function trace_event_get_offsets returns correct max offset for each
> specific syscall tracepoint, which is compared against the maximum offset
> access in bpf program.
>
> Signed-off-by: Yonghong Song <yhs@...com>

lgtm
Acked-by: Alexei Starovoitov <ast@...nel.org>