| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20200415192744.4082950-1-yhs@fb.com>
Date: Wed, 15 Apr 2020 12:27:44 -0700
From: Yonghong Song <yhs@...com>
To: Andrii Nakryiko <andriin@...com>, <bpf@...r.kernel.org>,
Martin KaFai Lau <kafai@...com>, <netdev@...r.kernel.org>
CC: Alexei Starovoitov <ast@...com>,
Daniel Borkmann <daniel@...earbox.net>, <kernel-team@...com>
Subject: [RFC PATCH bpf-next v2 04/17] bpf: allow loading of a dumper program
A dumper bpf program is a tracing program with attach type
BPF_TRACE_DUMP. During bpf program load, the load attribute
attach_prog_fd
carries the target directory fd. The program will be
verified against btf_id of the target_proto.
If the program is loaded successfully, the dump target, as
represented as a relative path to /sys/kernel/bpfdump,
will be remembered in prog->aux->dump_target, which will
be used later to create dumpers.
Signed-off-by: Yonghong Song <yhs@...com>
---
include/linux/bpf.h | 2 ++
include/uapi/linux/bpf.h | 6 ++++-
kernel/bpf/dump.c | 42 ++++++++++++++++++++++++++++++++++
kernel/bpf/syscall.c | 8 ++++++-
kernel/bpf/verifier.c | 15 ++++++++++++
tools/include/uapi/linux/bpf.h | 6 ++++-
6 files changed, 76 insertions(+), 3 deletions(-)
diff --git a/include/linux/bpf.h b/include/linux/bpf.h
index 84c7eb40d7bc..068552c2d2cf 100644
--- a/include/linux/bpf.h
+++ b/include/linux/bpf.h
@@ -674,6 +674,7 @@ struct bpf_prog_aux {
struct bpf_map **used_maps;
struct bpf_prog *prog;
struct user_struct *user;
+ const char *dump_target;
u64 load_time; /* ns since boottime */
struct bpf_map *cgroup_storage[MAX_BPF_CGROUP_STORAGE_TYPE];
char name[BPF_OBJ_NAME_LEN];
@@ -1120,6 +1121,7 @@ struct bpf_dump_reg {
};
int bpf_dump_reg_target(struct bpf_dump_reg *reg_info);
+int bpf_dump_set_target_info(u32 target_fd, struct bpf_prog *prog);
int bpf_percpu_hash_copy(struct bpf_map *map, void *key, void *value);
int bpf_percpu_array_copy(struct bpf_map *map, void *key, void *value);
diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h
index 2e29a671d67e..f92b919c723e 100644
--- a/include/uapi/linux/bpf.h
+++ b/include/uapi/linux/bpf.h
@@ -215,6 +215,7 @@ enum bpf_attach_type {
BPF_TRACE_FEXIT,
BPF_MODIFY_RETURN,
BPF_LSM_MAC,
+ BPF_TRACE_DUMP,
__MAX_BPF_ATTACH_TYPE
};
@@ -476,7 +477,10 @@ union bpf_attr {
__aligned_u64 line_info; /* line info */
__u32 line_info_cnt; /* number of bpf_line_info records */
__u32 attach_btf_id; /* in-kernel BTF type id to attach to */
- __u32 attach_prog_fd; /* 0 to attach to vmlinux */
+ union {
+ __u32 attach_prog_fd; /* 0 to attach to vmlinux */
+ __u32 attach_target_fd;
+ };
};
struct { /* anonymous struct used by BPF_OBJ_* commands */
diff --git a/kernel/bpf/dump.c b/kernel/bpf/dump.c
index e8b46f9e0ee0..8c7a89800312 100644
--- a/kernel/bpf/dump.c
+++ b/kernel/bpf/dump.c
@@ -11,6 +11,9 @@
#include <linux/fs_parser.h>
#include <linux/filter.h>
#include <linux/bpf.h>
+#include <linux/btf.h>
+
+extern struct btf *btf_vmlinux;
struct bpfdump_target_info {
struct list_head list;
@@ -51,6 +54,45 @@ static const struct inode_operations bpfdump_dir_iops = {
.unlink = dumper_unlink,
};
+int bpf_dump_set_target_info(u32 target_fd, struct bpf_prog *prog)
+{
+ struct bpfdump_target_info *tinfo;
+ const char *target_proto;
+ struct file *target_file;
+ struct fd tfd;
+ int err = 0, btf_id;
+
+ if (!btf_vmlinux)
+ return -EINVAL;
+
+ tfd = fdget(target_fd);
+ target_file = tfd.file;
+ if (!target_file)
+ return -EBADF;
+
+ if (target_file->f_inode->i_op != &bpfdump_dir_iops) {
+ err = -EINVAL;
+ goto done;
+ }
+
+ tinfo = target_file->f_inode->i_private;
+ target_proto = tinfo->target_proto;
+ btf_id = btf_find_by_name_kind(btf_vmlinux, target_proto,
+ BTF_KIND_FUNC);
+
+ if (btf_id < 0) {
+ err = btf_id;
+ goto done;
+ }
+
+ prog->aux->dump_target = tinfo->target;
+ prog->aux->attach_btf_id = btf_id;
+
+done:
+ fdput(tfd);
+ return err;
+}
+
int bpf_dump_reg_target(struct bpf_dump_reg *reg_info)
{
struct bpfdump_target_info *tinfo, *ptinfo;
diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index 64783da34202..1ce2f74f8efc 100644
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -2060,7 +2060,12 @@ static int bpf_prog_load(union bpf_attr *attr, union bpf_attr __user *uattr)
prog->expected_attach_type = attr->expected_attach_type;
prog->aux->attach_btf_id = attr->attach_btf_id;
- if (attr->attach_prog_fd) {
+ if (type == BPF_PROG_TYPE_TRACING &&
+ attr->expected_attach_type == BPF_TRACE_DUMP) {
+ err = bpf_dump_set_target_info(attr->attach_target_fd, prog);
+ if (err)
+ goto free_prog_nouncharge;
+ } else if (attr->attach_prog_fd) {
struct bpf_prog *tgt_prog;
tgt_prog = bpf_prog_get(attr->attach_prog_fd);
@@ -2145,6 +2150,7 @@ static int bpf_prog_load(union bpf_attr *attr, union bpf_attr __user *uattr)
err = bpf_prog_new_fd(prog);
if (err < 0)
bpf_prog_put(prog);
+
return err;
free_used_maps:
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 04c6630cc18f..f531cee24fc5 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -10426,6 +10426,7 @@ static int check_attach_btf_id(struct bpf_verifier_env *env)
struct bpf_prog *tgt_prog = prog->aux->linked_prog;
u32 btf_id = prog->aux->attach_btf_id;
const char prefix[] = "btf_trace_";
+ struct btf_func_model fmodel;
int ret = 0, subprog = -1, i;
struct bpf_trampoline *tr;
const struct btf_type *t;
@@ -10566,6 +10567,20 @@ static int check_attach_btf_id(struct bpf_verifier_env *env)
prog->aux->attach_func_proto = t;
prog->aux->attach_btf_trace = true;
return 0;
+ case BPF_TRACE_DUMP:
+ if (!btf_type_is_func(t)) {
+ verbose(env, "attach_btf_id %u is not a function\n",
+ btf_id);
+ return -EINVAL;
+ }
+ t = btf_type_by_id(btf, t->type);
+ if (!btf_type_is_func_proto(t))
+ return -EINVAL;
+ prog->aux->attach_func_name = tname;
+ prog->aux->attach_func_proto = t;
+ ret = btf_distill_func_proto(&env->log, btf, t,
+ tname, &fmodel);
+ return ret;
default:
if (!prog_extension)
return -EINVAL;
diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h
index 2e29a671d67e..f92b919c723e 100644
--- a/tools/include/uapi/linux/bpf.h
+++ b/tools/include/uapi/linux/bpf.h
@@ -215,6 +215,7 @@ enum bpf_attach_type {
BPF_TRACE_FEXIT,
BPF_MODIFY_RETURN,
BPF_LSM_MAC,
+ BPF_TRACE_DUMP,
__MAX_BPF_ATTACH_TYPE
};
@@ -476,7 +477,10 @@ union bpf_attr {
__aligned_u64 line_info; /* line info */
__u32 line_info_cnt; /* number of bpf_line_info records */
__u32 attach_btf_id; /* in-kernel BTF type id to attach to */
- __u32 attach_prog_fd; /* 0 to attach to vmlinux */
+ union {
+ __u32 attach_prog_fd; /* 0 to attach to vmlinux */
+ __u32 attach_target_fd;
+ };
};
struct { /* anonymous struct used by BPF_OBJ_* commands */
--
2.24.1
Powered by blists - more mailing lists