From patchwork Thu Nov 26 16:57:47 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Florent Revest X-Patchwork-Id: 11934373 X-Patchwork-Delegate: bpf@iogearbox.net Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-18.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_CR_TRAILER,INCLUDES_PATCH,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id D1FFDC64E8A for ; Thu, 26 Nov 2020 16:59:08 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 9DE19221FA for ; Thu, 26 Nov 2020 16:59:08 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (1024-bit key) header.d=chromium.org header.i=@chromium.org header.b="EivVOmLN" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2403939AbgKZQ7H (ORCPT ); Thu, 26 Nov 2020 11:59:07 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:32912 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2403891AbgKZQ7F (ORCPT ); Thu, 26 Nov 2020 11:59:05 -0500 Received: from mail-wm1-x343.google.com (mail-wm1-x343.google.com [IPv6:2a00:1450:4864:20::343]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id AD79FC0617A7 for ; Thu, 26 Nov 2020 08:59:04 -0800 (PST) Received: by mail-wm1-x343.google.com with SMTP id a186so2744404wme.1 for ; Thu, 26 Nov 2020 08:59:04 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=0L00r4rPHemcbzcKizDl5R/fNH5uAoaWPolJKjNNL9c=; b=EivVOmLNk176rC1BaDYKctnghwXfBJ8z7Vtqp3kgoYE9GywHRyCXiLuUXCFTUOrUxa /l5zZGyjrAbnUwyPs1Y9iN/ilkHw2xWvXklsmM8mKMvuW9Q+H9ispA2Wt6bxLoWZ8Ba/ g/vBv3cyAQaJSj+Ve66wA52pJQBf8mNihZ/cQ= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=0L00r4rPHemcbzcKizDl5R/fNH5uAoaWPolJKjNNL9c=; b=fTomrpXC/8lt1zxpMvsNUaCXb5eJ4Ongmfz2Ru675KHkwljNbCMdD9VwLJXQKSz+QV dwp1J6ibYc2xeu88hL14pSCtYdPXL5V8d5wbPfMKbc5uSAh0g8Ap4lK121T/x5N+E0Ap 2T8b5NwO4ELONprhWX6SVFHb63EVLYSZSwpB/4iCsLKs8Qm8Y1xxmOKX1kFoCRtPqlIR 11poNyCU2fEJODILr2b8sBq4F6j4ap5P7SZK3IJ113BtNJnLniPvnJFKxKWctqyU+flO XDuYAxwwpOhBrIgVXlDJANQjlqGP/lijiKeGRCCqEVZ30+vES6SDDDyC4hfV8R2dN/3O Ox4w== X-Gm-Message-State: AOAM530bV5anQgvuwsobeiRwWONZR9H2K3tkNDATp+W1OIJ2ZP02XZWA mZtpVj7IdbS1dGjM4mT4m8YxVWLuSfOeKmqW X-Google-Smtp-Source: ABdhPJyIgpPGSqDwYRnHLR+STfy/X3mG/aOhmRn390E4IPISSzL02fN4S0cJfWSOd/Lw11+HIV2Kkg== X-Received: by 2002:a1c:1f16:: with SMTP id f22mr4243742wmf.108.1606409943063; Thu, 26 Nov 2020 08:59:03 -0800 (PST) Received: from revest.zrh.corp.google.com ([2a00:79e0:42:204:f693:9fff:fef4:a569]) by smtp.gmail.com with ESMTPSA id 17sm8768032wmf.48.2020.11.26.08.59.02 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 26 Nov 2020 08:59:02 -0800 (PST) From: Florent Revest X-Google-Original-From: Florent Revest To: bpf@vger.kernel.org Cc: ast@kernel.org, daniel@iogearbox.net, andrii@kernel.org, kpsingh@chromium.org, revest@google.com, linux-kernel@vger.kernel.org Subject: [PATCH bpf-next 1/2] bpf: Add a bpf_kallsyms_lookup helper Date: Thu, 26 Nov 2020 17:57:47 +0100 Message-Id: <20201126165748.1748417-1-revest@google.com> X-Mailer: git-send-email 2.29.2.454.gaff20da3a2-goog MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: bpf@vger.kernel.org X-Patchwork-Delegate: bpf@iogearbox.net This helper exposes the kallsyms_lookup function to eBPF tracing programs. This can be used to retrieve the name of the symbol at an address. For example, when hooking into nf_register_net_hook, one can audit the name of the registered netfilter hook and potentially also the name of the module in which the symbol is located. Signed-off-by: Florent Revest Reported-by: kernel test robot --- include/uapi/linux/bpf.h | 16 +++++++++++++ kernel/trace/bpf_trace.c | 41 ++++++++++++++++++++++++++++++++++ tools/include/uapi/linux/bpf.h | 16 +++++++++++++ 3 files changed, 73 insertions(+) diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h index c3458ec1f30a..670998635eac 100644 --- a/include/uapi/linux/bpf.h +++ b/include/uapi/linux/bpf.h @@ -3817,6 +3817,21 @@ union bpf_attr { * The **hash_algo** is returned on success, * **-EOPNOTSUP** if IMA is disabled or **-EINVAL** if * invalid arguments are passed. + * + * long bpf_kallsyms_lookup(u64 address, char *symbol, u32 symbol_size, char *module, u32 module_size) + * Description + * Uses kallsyms to write the name of the symbol at *address* + * into *symbol* of size *symbol_sz*. This is guaranteed to be + * zero terminated. + * If the symbol is in a module, up to *module_size* bytes of + * the module name is written in *module*. This is also + * guaranteed to be zero-terminated. Note: a module name + * is always shorter than 64 bytes. + * Return + * On success, the strictly positive length of the full symbol + * name, If this is greater than *symbol_size*, the written + * symbol is truncated. + * On error, a negative value. */ #define __BPF_FUNC_MAPPER(FN) \ FN(unspec), \ @@ -3981,6 +3996,7 @@ union bpf_attr { FN(bprm_opts_set), \ FN(ktime_get_coarse_ns), \ FN(ima_inode_hash), \ + FN(kallsyms_lookup), \ /* */ /* integer value in 'imm' field of BPF_CALL instruction selects which helper diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c index d255bc9b2bfa..9d86e20c2b13 100644 --- a/kernel/trace/bpf_trace.c +++ b/kernel/trace/bpf_trace.c @@ -17,6 +17,7 @@ #include #include #include +#include #include @@ -1260,6 +1261,44 @@ const struct bpf_func_proto bpf_snprintf_btf_proto = { .arg5_type = ARG_ANYTHING, }; +BPF_CALL_5(bpf_kallsyms_lookup, u64, address, char *, symbol, u32, symbol_size, + char *, module, u32, module_size) +{ + char buffer[KSYM_SYMBOL_LEN]; + unsigned long offset, size; + const char *name; + char *modname; + long ret; + + name = kallsyms_lookup(address, &size, &offset, &modname, buffer); + if (!name) + return -EINVAL; + + ret = strlen(name) + 1; + if (symbol_size) { + strncpy(symbol, name, symbol_size); + symbol[symbol_size - 1] = '\0'; + } + + if (modname && module_size) { + strncpy(module, modname, module_size); + module[module_size - 1] = '\0'; + } + + return ret; +} + +const struct bpf_func_proto bpf_kallsyms_lookup_proto = { + .func = bpf_kallsyms_lookup, + .gpl_only = false, + .ret_type = RET_INTEGER, + .arg1_type = ARG_ANYTHING, + .arg2_type = ARG_PTR_TO_MEM, + .arg3_type = ARG_CONST_SIZE, + .arg4_type = ARG_PTR_TO_MEM, + .arg5_type = ARG_CONST_SIZE, +}; + const struct bpf_func_proto * bpf_tracing_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog) { @@ -1356,6 +1395,8 @@ bpf_tracing_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog) return &bpf_per_cpu_ptr_proto; case BPF_FUNC_bpf_this_cpu_ptr: return &bpf_this_cpu_ptr_proto; + case BPF_FUNC_kallsyms_lookup: + return &bpf_kallsyms_lookup_proto; default: return NULL; } diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h index c3458ec1f30a..670998635eac 100644 --- a/tools/include/uapi/linux/bpf.h +++ b/tools/include/uapi/linux/bpf.h @@ -3817,6 +3817,21 @@ union bpf_attr { * The **hash_algo** is returned on success, * **-EOPNOTSUP** if IMA is disabled or **-EINVAL** if * invalid arguments are passed. + * + * long bpf_kallsyms_lookup(u64 address, char *symbol, u32 symbol_size, char *module, u32 module_size) + * Description + * Uses kallsyms to write the name of the symbol at *address* + * into *symbol* of size *symbol_sz*. This is guaranteed to be + * zero terminated. + * If the symbol is in a module, up to *module_size* bytes of + * the module name is written in *module*. This is also + * guaranteed to be zero-terminated. Note: a module name + * is always shorter than 64 bytes. + * Return + * On success, the strictly positive length of the full symbol + * name, If this is greater than *symbol_size*, the written + * symbol is truncated. + * On error, a negative value. */ #define __BPF_FUNC_MAPPER(FN) \ FN(unspec), \ @@ -3981,6 +3996,7 @@ union bpf_attr { FN(bprm_opts_set), \ FN(ktime_get_coarse_ns), \ FN(ima_inode_hash), \ + FN(kallsyms_lookup), \ /* */ /* integer value in 'imm' field of BPF_CALL instruction selects which helper From patchwork Thu Nov 26 16:57:48 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Florent Revest X-Patchwork-Id: 11934371 X-Patchwork-Delegate: bpf@iogearbox.net Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-18.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_CR_TRAILER,INCLUDES_PATCH,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id B2DB9C64E7B for ; Thu, 26 Nov 2020 16:59:08 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 76FC6221F8 for ; Thu, 26 Nov 2020 16:59:08 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (1024-bit key) header.d=chromium.org header.i=@chromium.org header.b="JbwJAnnc" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2403927AbgKZQ7H (ORCPT ); Thu, 26 Nov 2020 11:59:07 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:32920 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2403923AbgKZQ7G (ORCPT ); Thu, 26 Nov 2020 11:59:06 -0500 Received: from mail-wm1-x343.google.com (mail-wm1-x343.google.com [IPv6:2a00:1450:4864:20::343]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 8E074C0617A7 for ; Thu, 26 Nov 2020 08:59:05 -0800 (PST) Received: by mail-wm1-x343.google.com with SMTP id 3so334188wmj.4 for ; Thu, 26 Nov 2020 08:59:05 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=yiihBYT29r/F8u49HtrLNtVGlhzIYUGfbvVDX4SQ4Us=; b=JbwJAnnczSMj8Bkfb75JNqFiES00+ZMEGcmdQTL3NapeB7Ia86rKrZ+Mg5Uhjk4qtZ vlAakh+huJ0GfKOIgxXjKgs+9c/lmlJDT875SshAPOpcyP7K9igd08TovQGfwPaiBJtd NvPDNnoVnbWDAoFqVsrSdcO2wgyn+g8yvrnng= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=yiihBYT29r/F8u49HtrLNtVGlhzIYUGfbvVDX4SQ4Us=; b=nJJTuj7nuLL1Ym23iK7skyzLr6qhOXtsNUPpYfOObfiHEGOp4W8JNefJGSyAe5YHAt eVUMLUrFqQTpuyMk7HcZIt74vKN0TGm62VfCmDY+DB+m8QmrsADMUvsx96bslpUWd/XR yTZK+7rgcrRi2T+9lm1zsNz+Qu66j9ahD1TaP57N8Wg7+NgfuWGAhCT4k39YNzqTHY51 9jCoEPBBnJLRoGU2PyMIUylE5cWld4CQ2Vl2Q86bLoaADoeYenGRrglXCkijMu0Ap6jc ScXk0oMzeehwj5Es28/0+lnGbTIsvg8m1yLq2Fn3QH4XqVYzFm/2F+zLAaxXY/xDhw1a 9ejA== X-Gm-Message-State: AOAM53275ZARz8PWKvBNj9JHEFobfMv89AtbUTbOOEZcPpSK8/N7/n2x hazoDOjwXGXFjwdDz5nMOYjIX632eINdQ+qd X-Google-Smtp-Source: ABdhPJxIrqvMoXZzhTP8EI1BkupGBVYUC0Y2SeBVcJDR5a6h+t8bHPKs9RaJGjUL/5zPm4o1reLqrg== X-Received: by 2002:a1c:7318:: with SMTP id d24mr4453757wmb.39.1606409944007; Thu, 26 Nov 2020 08:59:04 -0800 (PST) Received: from revest.zrh.corp.google.com ([2a00:79e0:42:204:f693:9fff:fef4:a569]) by smtp.gmail.com with ESMTPSA id 17sm8768032wmf.48.2020.11.26.08.59.03 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 26 Nov 2020 08:59:03 -0800 (PST) From: Florent Revest X-Google-Original-From: Florent Revest To: bpf@vger.kernel.org Cc: ast@kernel.org, daniel@iogearbox.net, andrii@kernel.org, kpsingh@chromium.org, revest@google.com, linux-kernel@vger.kernel.org Subject: [PATCH bpf-next 2/2] selftests/bpf: Add bpf_kallsyms_lookup test Date: Thu, 26 Nov 2020 17:57:48 +0100 Message-Id: <20201126165748.1748417-2-revest@google.com> X-Mailer: git-send-email 2.29.2.454.gaff20da3a2-goog In-Reply-To: <20201126165748.1748417-1-revest@google.com> References: <20201126165748.1748417-1-revest@google.com> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: bpf@vger.kernel.org X-Patchwork-Delegate: bpf@iogearbox.net This piggybacks on the existing "ksyms" test because this test also relies on a __ksym symbol and requires CONFIG_KALLSYMS. Signed-off-by: Florent Revest --- tools/testing/selftests/bpf/config | 1 + .../testing/selftests/bpf/prog_tests/ksyms.c | 46 ++++++++++++++++++- .../bpf/progs/test_kallsyms_lookup.c | 38 +++++++++++++++ 3 files changed, 84 insertions(+), 1 deletion(-) create mode 100644 tools/testing/selftests/bpf/progs/test_kallsyms_lookup.c diff --git a/tools/testing/selftests/bpf/config b/tools/testing/selftests/bpf/config index 365bf9771b07..791a46e5d013 100644 --- a/tools/testing/selftests/bpf/config +++ b/tools/testing/selftests/bpf/config @@ -43,3 +43,4 @@ CONFIG_IMA=y CONFIG_SECURITYFS=y CONFIG_IMA_WRITE_POLICY=y CONFIG_IMA_READ_POLICY=y +CONFIG_KALLSYMS=y diff --git a/tools/testing/selftests/bpf/prog_tests/ksyms.c b/tools/testing/selftests/bpf/prog_tests/ksyms.c index b295969b263b..0478b67a92ae 100644 --- a/tools/testing/selftests/bpf/prog_tests/ksyms.c +++ b/tools/testing/selftests/bpf/prog_tests/ksyms.c @@ -3,11 +3,12 @@ #include #include "test_ksyms.skel.h" +#include "test_kallsyms_lookup.skel.h" #include static int duration; -void test_ksyms(void) +void test_ksyms_variables(void) { const char *btf_path = "/sys/kernel/btf/vmlinux"; struct test_ksyms *skel; @@ -59,3 +60,46 @@ void test_ksyms(void) cleanup: test_ksyms__destroy(skel); } + +void test_kallsyms_lookup(void) +{ + struct test_kallsyms_lookup *skel; + int err; + + skel = test_kallsyms_lookup__open_and_load(); + if (CHECK(!skel, "skel_open", "failed to open and load skeleton\n")) + return; + + err = test_kallsyms_lookup__attach(skel); + if (CHECK(err, "skel_attach", "skeleton attach failed: %d\n", err)) + goto cleanup; + + /* trigger tracepoint */ + usleep(1); + + CHECK(strcmp(skel->bss->name, "schedule"), "name", + "got \"%s\", exp \"schedule\"\n", skel->bss->name); + CHECK(strcmp(skel->bss->name_truncated, "sched"), "name_truncated", + "got \"%s\", exp \"sched\"\n", skel->bss->name_truncated); + CHECK(strcmp(skel->bss->name_invalid, ""), "name_invalid", + "got \"%s\", exp \"\"\n", skel->bss->name_invalid); + CHECK(strcmp(skel->bss->module_name, ""), "module_name", + "got \"%s\", exp \"\"\n", skel->bss->module_name); + CHECK(skel->bss->schedule_ret != 9, "schedule_ret", + "got %d, exp 0\n", skel->bss->schedule_ret); + CHECK(skel->bss->sched_ret != 9, "sched_ret", + "got %d, exp 0\n", skel->bss->sched_ret); + CHECK(skel->bss->invalid_ret != -EINVAL, "invalid_ret", + "got %d, exp %d\n", skel->bss->invalid_ret, -EINVAL); + +cleanup: + test_kallsyms_lookup__destroy(skel); +} + +void test_ksyms(void) +{ + if (test__start_subtest("ksyms_variables")) + test_ksyms_variables(); + if (test__start_subtest("kallsyms_lookup")) + test_kallsyms_lookup(); +} diff --git a/tools/testing/selftests/bpf/progs/test_kallsyms_lookup.c b/tools/testing/selftests/bpf/progs/test_kallsyms_lookup.c new file mode 100644 index 000000000000..4f15f1527ab4 --- /dev/null +++ b/tools/testing/selftests/bpf/progs/test_kallsyms_lookup.c @@ -0,0 +1,38 @@ +// SPDX-License-Identifier: GPL-2.0 +/* Copyright (c) 2020 Google LLC. */ + +#include +#include + +extern const void schedule __ksym; + +#define SYMBOL_NAME_LEN 10 +char name[SYMBOL_NAME_LEN]; +char name_invalid[SYMBOL_NAME_LEN]; + +#define SYMBOL_TRUNCATED_NAME_LEN 6 +char name_truncated[SYMBOL_TRUNCATED_NAME_LEN]; + +#define MODULE_NAME_LEN 64 +char module_name[MODULE_NAME_LEN]; + +long schedule_ret; +long sched_ret; +long invalid_ret; + +SEC("raw_tp/sys_enter") +int handler(const void *ctx) +{ + schedule_ret = bpf_kallsyms_lookup((__u64)&schedule, + name, SYMBOL_NAME_LEN, + module_name, MODULE_NAME_LEN); + invalid_ret = bpf_kallsyms_lookup(0, + name_invalid, SYMBOL_NAME_LEN, + module_name, MODULE_NAME_LEN); + sched_ret = bpf_kallsyms_lookup((__u64)&schedule, name_truncated, + SYMBOL_TRUNCATED_NAME_LEN, + module_name, MODULE_NAME_LEN); + return 0; +} + +char _license[] SEC("license") = "GPL";