netdev - Re: [Potential Spoof] [PATCH bpf-next 4/4] selftests/bpf: add vmlinux.h selftest exercising tracing of syscalls

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAEf4BzbZ0rQ=Lwvvy1Kk8jQqRdHzPNodcXTHD=i1px7DKa-YsA@mail.gmail.com>
Date:   Fri, 13 Mar 2020 10:16:24 -0700
From:   Andrii Nakryiko <andrii.nakryiko@...il.com>
To:     Martin KaFai Lau <kafai@...com>
Cc:     Andrii Nakryiko <andriin@...com>, bpf <bpf@...r.kernel.org>,
        Networking <netdev@...r.kernel.org>,
        Alexei Starovoitov <ast@...com>,
        Daniel Borkmann <daniel@...earbox.net>,
        Kernel Team <kernel-team@...com>
Subject: Re: [Potential Spoof] [PATCH bpf-next 4/4] selftests/bpf: add
 vmlinux.h selftest exercising tracing of syscalls

On Fri, Mar 13, 2020 at 10:02 AM Martin KaFai Lau <kafai@...com> wrote:
>
> On Fri, Mar 13, 2020 at 12:54:41AM -0700, Andrii Nakryiko wrote:
> > Add vmlinux.h generation to selftest/bpf's Makefile. Use it from newly added
> > test_vmlinux to trace nanosleep syscall using 5 different types of programs:
> >   - tracepoint;
> >   - raw tracepoint;
> >   - raw tracepoint w/ direct memory reads (tp_btf);
> >   - kprobe;
> >   - fentry.
> >
> > These programs are realistic variants of real-life tracing programs,
> > excercising vmlinux.h's usage with tracing applications.
> >
> > Signed-off-by: Andrii Nakryiko <andriin@...com>
> > ---
> [ ... ]
>
> > diff --git a/tools/testing/selftests/bpf/prog_tests/vmlinux.c b/tools/testing/selftests/bpf/prog_tests/vmlinux.c
> > new file mode 100644
> > index 000000000000..04939eda1325
> > --- /dev/null
> > +++ b/tools/testing/selftests/bpf/prog_tests/vmlinux.c
> > @@ -0,0 +1,43 @@
> > +// SPDX-License-Identifier: GPL-2.0
> > +/* Copyright (c) 2020 Facebook */
> > +
> > +#include <test_progs.h>
> > +#include <time.h>
> > +#include "test_vmlinux.skel.h"
> > +
> > +#define MY_TV_NSEC 1337
> > +
> > +static void nsleep()
> > +{
> > +     struct timespec ts = { .tv_nsec = MY_TV_NSEC };
> > +
> > +     (void)nanosleep(&ts, NULL);
> > +}
> > +
> > +void test_vmlinux(void)
> > +{
> > +     int duration = 0, err;
> > +     struct test_vmlinux* skel;
> > +     struct test_vmlinux__bss *bss;
> > +
> > +     skel = test_vmlinux__open_and_load();
> > +     if (CHECK(!skel, "skel_open", "failed to open skeleton\n"))
> > +             return;
> > +     bss = skel->bss;
> > +
> > +     err = test_vmlinux__attach(skel);
> > +     if (CHECK(err, "skel_attach", "skeleton attach failed: %d\n", err))
> > +             goto cleanup;
> > +
> > +     /* trigger everything */
> > +     nsleep();
> > +
> > +     CHECK(!bss->tp_called, "tp", "not called\n");
> > +     CHECK(!bss->raw_tp_called, "raw_tp", "not called\n");
> > +     CHECK(!bss->tp_btf_called, "tp_btf", "not called\n");
> > +     CHECK(!bss->kprobe_called, "kprobe", "not called\n");
> > +     CHECK(!bss->fentry_called, "fentry", "not called\n");
> > +
> > +cleanup:
> > +     test_vmlinux__destroy(skel);
> > +}
> > diff --git a/tools/testing/selftests/bpf/progs/test_vmlinux.c b/tools/testing/selftests/bpf/progs/test_vmlinux.c
> > new file mode 100644
> > index 000000000000..5cc2bf8011b0
> > --- /dev/null
> > +++ b/tools/testing/selftests/bpf/progs/test_vmlinux.c
> > @@ -0,0 +1,98 @@
> > +// SPDX-License-Identifier: GPL-2.0
> > +/* Copyright (c) 2020 Facebook */
> > +
> > +#include "vmlinux.h"
> > +#include <asm/unistd.h>
> > +#include <bpf/bpf_helpers.h>
> > +#include <bpf/bpf_tracing.h>
> > +#include <bpf/bpf_core_read.h>
> > +
> > +#define MY_TV_NSEC 1337
> > +
> > +bool tp_called = false;
> > +bool raw_tp_called = false;
> > +bool tp_btf_called = false;
> > +bool kprobe_called = false;
> > +bool fentry_called = false;
> > +
> > +SEC("tp/syscalls/sys_enter_nanosleep")
> > +int handle__tp(struct trace_event_raw_sys_enter *args)
> > +{
> > +     struct __kernel_timespec *ts;
> > +
> > +     if (args->id != __NR_nanosleep)
> > +             return 0;
> > +
> > +     ts = (void *)args->args[0];
> > +     if (BPF_CORE_READ(ts, tv_nsec) != MY_TV_NSEC)
> > +             return 0;
> > +
> > +     tp_called = true;
> > +     return 0;
> > +}
> > +
> > +static bool __always_inline handle_probed(struct pt_regs *regs, long id)
> It is not used, may be removing it?
>

Oh, did I really leave it around?... Sigh, will post v2 without it.


> > +{
> > +     struct __kernel_timespec *ts;
> > +
> > +     if (id != __NR_nanosleep)
> > +             return false;
> > +
> > +     ts = (void *)PT_REGS_PARM1_CORE(regs);
> > +     if (BPF_CORE_READ(ts, tv_nsec) != MY_TV_NSEC)
> > +             return false;
> > +
> > +     return true;
> > +}