| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <CAEf4Bzbe4L0eEBpLRaQ0m6qOmV40ayGr9L-W+0fDkjm0sLe2Bw@mail.gmail.com>
Date: Fri, 21 Jan 2022 11:33:50 -0800
From: Andrii Nakryiko <andrii.nakryiko@...il.com>
To: Alan Maguire <alan.maguire@...cle.com>
Cc: Alexei Starovoitov <ast@...nel.org>,
Daniel Borkmann <daniel@...earbox.net>,
Andrii Nakryiko <andrii@...nel.org>, Martin Lau <kafai@...com>,
Song Liu <songliubraving@...com>, Yonghong Song <yhs@...com>,
john fastabend <john.fastabend@...il.com>,
KP Singh <kpsingh@...nel.org>, Jiri Olsa <jolsa@...nel.org>,
Yucong Sun <sunyucong@...il.com>,
Networking <netdev@...r.kernel.org>, bpf <bpf@...r.kernel.org>
Subject: Re: [RFC bpf-next 2/3] libbpf: add auto-attach for uprobes based on
section name
On Thu, Jan 20, 2022 at 3:43 AM Alan Maguire <alan.maguire@...cle.com> wrote:
>
> Now that u[ret]probes can use name-based specification, it makes
> sense to add support for auto-attach based on SEC() definition.
> The format proposed is
>
> SEC("u[ret]probe[/]/path/to/prog/function[+offset]")
>
> For example, to trace malloc() in libc:
>
> SEC("uprobe/usr/lib64/libc.so.6/malloc")
>
> Auto-attach is done for all tasks (pid -1).
>
> Future work will look at generalizing section specification to
> substitute ':' for '/'.
>
> Signed-off-by: Alan Maguire <alan.maguire@...cle.com>
> ---
> tools/lib/bpf/libbpf.c | 60 ++++++++++++++++++++++++++++++++++++++++++++++++--
> 1 file changed, 58 insertions(+), 2 deletions(-)
>
> diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
> index 6479aae..1c8c8f0 100644
> --- a/tools/lib/bpf/libbpf.c
> +++ b/tools/lib/bpf/libbpf.c
> @@ -8565,6 +8565,7 @@ int bpf_program__set_log_buf(struct bpf_program *prog, char *log_buf, size_t log
> }
>
> static struct bpf_link *attach_kprobe(const struct bpf_program *prog, long cookie);
> +static struct bpf_link *attach_uprobe(const struct bpf_program *prog, long cookie);
> static struct bpf_link *attach_tp(const struct bpf_program *prog, long cookie);
> static struct bpf_link *attach_raw_tp(const struct bpf_program *prog, long cookie);
> static struct bpf_link *attach_trace(const struct bpf_program *prog, long cookie);
> @@ -8576,9 +8577,9 @@ int bpf_program__set_log_buf(struct bpf_program *prog, char *log_buf, size_t log
> SEC_DEF("sk_reuseport/migrate", SK_REUSEPORT, BPF_SK_REUSEPORT_SELECT_OR_MIGRATE, SEC_ATTACHABLE | SEC_SLOPPY_PFX),
> SEC_DEF("sk_reuseport", SK_REUSEPORT, BPF_SK_REUSEPORT_SELECT, SEC_ATTACHABLE | SEC_SLOPPY_PFX),
> SEC_DEF("kprobe/", KPROBE, 0, SEC_NONE, attach_kprobe),
> - SEC_DEF("uprobe/", KPROBE, 0, SEC_NONE),
> + SEC_DEF("uprobe/", KPROBE, 0, SEC_NONE, attach_uprobe),
> SEC_DEF("kretprobe/", KPROBE, 0, SEC_NONE, attach_kprobe),
> - SEC_DEF("uretprobe/", KPROBE, 0, SEC_NONE),
> + SEC_DEF("uretprobe/", KPROBE, 0, SEC_NONE, attach_uprobe),
> SEC_DEF("tc", SCHED_CLS, 0, SEC_NONE),
> SEC_DEF("classifier", SCHED_CLS, 0, SEC_NONE | SEC_SLOPPY_PFX),
> SEC_DEF("action", SCHED_ACT, 0, SEC_NONE | SEC_SLOPPY_PFX),
> @@ -10454,6 +10455,61 @@ static ssize_t find_elf_func_offset(const char *binary_path, const char *name)
>
> }
>
> +/* Format of u[ret]probe section definition supporting auto-attach:
> + * u[ret]probe[/]/path/to/prog/function[+offset]
> + *
> + * Many uprobe programs do not avail of auto-attach, so we need to handle the
> + * case where the format is uprobe/myfunc by returning NULL rather than an
> + * error.
> + */
> +static struct bpf_link *attach_uprobe(const struct bpf_program *prog, long cookie)
> +{
> + DECLARE_LIBBPF_OPTS(bpf_uprobe_opts, opts);
> + char *func_name, binary_path[512];
> + char *func, *probe_name;
> + struct bpf_link *link;
> + size_t offset = 0;
> + int n, err;
> +
> + opts.retprobe = str_has_pfx(prog->sec_name, "uretprobe/");
> + if (opts.retprobe)
> + probe_name = prog->sec_name + sizeof("uretprobe/") - 1;
> + else
> + probe_name = prog->sec_name + sizeof("uprobe/") - 1;
> +
> + /* First char in binary_path is a '/'; this allows us to support
> + * uprobe/path/2/prog and uprobe//path/2/prog, while also
> + * distinguishing between old-style uprobe/something definitions.
> + */
see my comments on cover letter, I don't think this is the right thing to do
> + snprintf(binary_path, sizeof(binary_path) - 1, "/%s", probe_name);
> + /* last '/' should be prior to function+offset */
> + func_name = strrchr(binary_path + 1, '/');
> + if (!func_name) {
> + pr_debug("section '%s' is old-style u[ret]probe/function, cannot auto-attach\n",
> + prog->sec_name);
> + return NULL;
this is actually a regression, we need to adapt
bpf_object__attach_skeleton() to accommodate SEC_DEF()s with attach
functions that might decide not to auto-attach (but not treat it as an
error). Maybe -EOPNOTSUPP should be treated specially?
> + }
> + func_name[0] = '\0';
> + func_name++;
> + n = sscanf(func_name, "%m[a-zA-Z0-9_.]+%li", &func, &offset);
> + if (n < 1) {
> + err = -EINVAL;
> + pr_warn("uprobe name is invalid: %s\n", func_name);
> + return libbpf_err_ptr(err);
> + }
> + if (opts.retprobe && offset != 0) {
> + free(func);
> + err = -EINVAL;
> + pr_warn("uretprobes do not support offset specification\n");
> + return libbpf_err_ptr(err);
> + }
> + opts.func_name = func;
> +
> + link = bpf_program__attach_uprobe_opts(prog, -1, binary_path, offset, &opts);
> + free(func);
> + return link;
> +}
> +
> struct bpf_link *bpf_program__attach_uprobe(const struct bpf_program *prog,
> bool retprobe, pid_t pid,
> const char *binary_path,
> --
> 1.8.3.1
>
Powered by blists - more mailing lists