netdev - Re: [Potential Spoof] [PATCH bpf-next 4/4] selftests/bpf: add vmlinux.h selftest exercising tracing of syscalls

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20200313170212.lf4lnljwtvhypkew@kafai-mbp>
Date:   Fri, 13 Mar 2020 10:02:12 -0700
From:   Martin KaFai Lau <kafai@...com>
To:     Andrii Nakryiko <andriin@...com>
CC:     <bpf@...r.kernel.org>, <netdev@...r.kernel.org>, <ast@...com>,
        <daniel@...earbox.net>, <andrii.nakryiko@...il.com>,
        <kernel-team@...com>
Subject: Re: [Potential Spoof] [PATCH bpf-next 4/4] selftests/bpf: add
 vmlinux.h selftest exercising tracing of syscalls

On Fri, Mar 13, 2020 at 12:54:41AM -0700, Andrii Nakryiko wrote:
> Add vmlinux.h generation to selftest/bpf's Makefile. Use it from newly added
> test_vmlinux to trace nanosleep syscall using 5 different types of programs:
>   - tracepoint;
>   - raw tracepoint;
>   - raw tracepoint w/ direct memory reads (tp_btf);
>   - kprobe;
>   - fentry.
> 
> These programs are realistic variants of real-life tracing programs,
> excercising vmlinux.h's usage with tracing applications.
> 
> Signed-off-by: Andrii Nakryiko <andriin@...com>
> ---
[ ... ]

> diff --git a/tools/testing/selftests/bpf/prog_tests/vmlinux.c b/tools/testing/selftests/bpf/prog_tests/vmlinux.c
> new file mode 100644
> index 000000000000..04939eda1325
> --- /dev/null
> +++ b/tools/testing/selftests/bpf/prog_tests/vmlinux.c
> @@ -0,0 +1,43 @@
> +// SPDX-License-Identifier: GPL-2.0
> +/* Copyright (c) 2020 Facebook */
> +
> +#include <test_progs.h>
> +#include <time.h>
> +#include "test_vmlinux.skel.h"
> +
> +#define MY_TV_NSEC 1337
> +
> +static void nsleep()
> +{
> +	struct timespec ts = { .tv_nsec = MY_TV_NSEC };
> +
> +	(void)nanosleep(&ts, NULL);
> +}
> +
> +void test_vmlinux(void)
> +{
> +	int duration = 0, err;
> +	struct test_vmlinux* skel;
> +	struct test_vmlinux__bss *bss;
> +
> +	skel = test_vmlinux__open_and_load();
> +	if (CHECK(!skel, "skel_open", "failed to open skeleton\n"))
> +		return;
> +	bss = skel->bss;
> +
> +	err = test_vmlinux__attach(skel);
> +	if (CHECK(err, "skel_attach", "skeleton attach failed: %d\n", err))
> +		goto cleanup;
> +
> +	/* trigger everything */
> +	nsleep();
> +
> +	CHECK(!bss->tp_called, "tp", "not called\n");
> +	CHECK(!bss->raw_tp_called, "raw_tp", "not called\n");
> +	CHECK(!bss->tp_btf_called, "tp_btf", "not called\n");
> +	CHECK(!bss->kprobe_called, "kprobe", "not called\n");
> +	CHECK(!bss->fentry_called, "fentry", "not called\n");
> +
> +cleanup:
> +	test_vmlinux__destroy(skel);
> +}
> diff --git a/tools/testing/selftests/bpf/progs/test_vmlinux.c b/tools/testing/selftests/bpf/progs/test_vmlinux.c
> new file mode 100644
> index 000000000000..5cc2bf8011b0
> --- /dev/null
> +++ b/tools/testing/selftests/bpf/progs/test_vmlinux.c
> @@ -0,0 +1,98 @@
> +// SPDX-License-Identifier: GPL-2.0
> +/* Copyright (c) 2020 Facebook */
> +
> +#include "vmlinux.h"
> +#include <asm/unistd.h>
> +#include <bpf/bpf_helpers.h>
> +#include <bpf/bpf_tracing.h>
> +#include <bpf/bpf_core_read.h>
> +
> +#define MY_TV_NSEC 1337
> +
> +bool tp_called = false;
> +bool raw_tp_called = false;
> +bool tp_btf_called = false;
> +bool kprobe_called = false;
> +bool fentry_called = false;
> +
> +SEC("tp/syscalls/sys_enter_nanosleep")
> +int handle__tp(struct trace_event_raw_sys_enter *args)
> +{
> +	struct __kernel_timespec *ts;
> +
> +	if (args->id != __NR_nanosleep)
> +		return 0;
> +
> +	ts = (void *)args->args[0];
> +	if (BPF_CORE_READ(ts, tv_nsec) != MY_TV_NSEC)
> +		return 0;
> +
> +	tp_called = true;
> +	return 0;
> +}
> +
> +static bool __always_inline handle_probed(struct pt_regs *regs, long id)
It is not used, may be removing it?

> +{
> +	struct __kernel_timespec *ts;
> +
> +	if (id != __NR_nanosleep)
> +		return false;
> +
> +	ts = (void *)PT_REGS_PARM1_CORE(regs);
> +	if (BPF_CORE_READ(ts, tv_nsec) != MY_TV_NSEC)
> +		return false;
> +
> +	return true;
> +}