netdev - Re: [PATCH v5 bpf-next 5/5] selftests/bpf: add tests for uprobe auto-attach via skeleton

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAEf4Bza4fj8GZUqu5RHx3yrQ1mVPkOSAT1=rtD1aAxhUCxYMmQ@mail.gmail.com>
Date:   Sun, 3 Apr 2022 18:15:00 -0700
From:   Andrii Nakryiko <andrii.nakryiko@...il.com>
To:     Alan Maguire <alan.maguire@...cle.com>
Cc:     Andrii Nakryiko <andrii@...nel.org>,
        Daniel Borkmann <daniel@...earbox.net>,
        Alexei Starovoitov <ast@...nel.org>, Martin Lau <kafai@...com>,
        Song Liu <songliubraving@...com>, Yonghong Song <yhs@...com>,
        john fastabend <john.fastabend@...il.com>,
        KP Singh <kpsingh@...nel.org>,
        Toke Høiland-Jørgensen <toke@...hat.com>,
        Yucong Sun <sunyucong@...il.com>,
        Networking <netdev@...r.kernel.org>, bpf <bpf@...r.kernel.org>
Subject: Re: [PATCH v5 bpf-next 5/5] selftests/bpf: add tests for uprobe
 auto-attach via skeleton

On Wed, Mar 30, 2022 at 8:27 AM Alan Maguire <alan.maguire@...cle.com> wrote:
>
> tests that verify auto-attach works for function entry/return for
> local functions in program and library functions in a library.
>
> Signed-off-by: Alan Maguire <alan.maguire@...cle.com>
> ---
>  .../selftests/bpf/prog_tests/uprobe_autoattach.c   | 38 ++++++++++++++++
>  .../selftests/bpf/progs/test_uprobe_autoattach.c   | 52 ++++++++++++++++++++++
>  2 files changed, 90 insertions(+)
>  create mode 100644 tools/testing/selftests/bpf/prog_tests/uprobe_autoattach.c
>  create mode 100644 tools/testing/selftests/bpf/progs/test_uprobe_autoattach.c
>
> diff --git a/tools/testing/selftests/bpf/prog_tests/uprobe_autoattach.c b/tools/testing/selftests/bpf/prog_tests/uprobe_autoattach.c
> new file mode 100644
> index 0000000..03b15d6
> --- /dev/null
> +++ b/tools/testing/selftests/bpf/prog_tests/uprobe_autoattach.c
> @@ -0,0 +1,38 @@
> +// SPDX-License-Identifier: GPL-2.0
> +/* Copyright (c) 2022, Oracle and/or its affiliates. */
> +
> +#include <test_progs.h>
> +#include "test_uprobe_autoattach.skel.h"
> +
> +/* uprobe attach point */
> +static void autoattach_trigger_func(void)
> +{
> +       asm volatile ("");
> +}
> +
> +void test_uprobe_autoattach(void)
> +{
> +       struct test_uprobe_autoattach *skel;
> +       char *mem;
> +
> +       skel = test_uprobe_autoattach__open_and_load();
> +       if (!ASSERT_OK_PTR(skel, "skel_open"))
> +               return;
> +
> +       if (!ASSERT_OK(test_uprobe_autoattach__attach(skel), "skel_attach"))
> +               goto cleanup;
> +
> +       /* trigger & validate uprobe & uretprobe */
> +       autoattach_trigger_func();
> +
> +       /* trigger & validate shared library u[ret]probes attached by name */
> +       mem = malloc(1);
> +       free(mem);
> +
> +       ASSERT_EQ(skel->bss->uprobe_byname_res, 1, "check_uprobe_byname_res");
> +       ASSERT_EQ(skel->bss->uretprobe_byname_res, 2, "check_uretprobe_byname_res");
> +       ASSERT_EQ(skel->bss->uprobe_byname2_res, 3, "check_uprobe_byname2_res");
> +       ASSERT_EQ(skel->bss->uretprobe_byname2_res, 4, "check_uretprobe_byname2_res");
> +cleanup:
> +       test_uprobe_autoattach__destroy(skel);
> +}
> diff --git a/tools/testing/selftests/bpf/progs/test_uprobe_autoattach.c b/tools/testing/selftests/bpf/progs/test_uprobe_autoattach.c
> new file mode 100644
> index 0000000..b442fb5
> --- /dev/null
> +++ b/tools/testing/selftests/bpf/progs/test_uprobe_autoattach.c
> @@ -0,0 +1,52 @@
> +// SPDX-License-Identifier: GPL-2.0
> +/* Copyright (c) 2022, Oracle and/or its affiliates. */
> +
> +#include <linux/ptrace.h>
> +#include <linux/bpf.h>
> +#include <bpf/bpf_helpers.h>
> +#include <bpf/bpf_tracing.h>
> +
> +int uprobe_byname_res = 0;
> +int uretprobe_byname_res = 0;
> +int uprobe_byname2_res = 0;
> +int uretprobe_byname2_res = 0;
> +
> +/* This program cannot auto-attach, but that should not stop other
> + * programs from attaching.
> + */
> +SEC("uprobe")
> +int handle_uprobe_noautoattach(struct pt_regs *ctx)
> +{
> +       return 0;
> +}
> +
> +SEC("uprobe//proc/self/exe:autoattach_trigger_func")
> +int handle_uprobe_byname(struct pt_regs *ctx)
> +{
> +       uprobe_byname_res = 1;
> +       return 0;
> +}
> +
> +SEC("uretprobe//proc/self/exe:autoattach_trigger_func")
> +int handle_uretprobe_byname(struct pt_regs *ctx)
> +{
> +       uretprobe_byname_res = 2;
> +       return 0;
> +}
> +
> +
> +SEC("uprobe/libc.so.6:malloc")
> +int handle_uprobe_byname2(struct pt_regs *ctx)
> +{
> +       uprobe_byname2_res = 3;
> +       return 0;
> +}
> +
> +SEC("uretprobe/libc.so.6:free")
> +int handle_uretprobe_byname2(struct pt_regs *ctx)
> +{
> +       uretprobe_byname2_res = 4;
> +       return 0;
> +}

I just realized that in all our uprobe tests we don't really check
that it was really a return probe. Can you please follow up with
changes to selftests that make relevant trigger functions return some
well-known value and uretprobe programs capturing and recording those
with user-space parts of selftests checking this?


> +
> +char _license[] SEC("license") = "GPL";
> --
> 1.8.3.1
>