From patchwork Fri Nov 8 11:34:24 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Marco Elver X-Patchwork-Id: 13868074 Received: from mail-yw1-f202.google.com (mail-yw1-f202.google.com [209.85.128.202]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 91D801E3DE7 for ; Fri, 8 Nov 2024 11:35:05 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.202 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1731065708; cv=none; b=glPx9uoOiAqUQtH0kHiVkdivvnqbMq0VpsMw/dflZqTpw37RXTn27cPbvpXdqpW+AH3FsujTlMipjS2REXT8wumnKyL5UwoHueIZm9h0zx2W/jcBtwKPHfXWD8KnPMpYZbhuz1dUEfIC9t/XgHCStV74fOYsAo4atqw9j6Pz8l4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1731065708; c=relaxed/simple; bh=JnIM12tM59+qUat5gAdMpFMhoi5YbwtxL7M88YFC6fk=; h=Date:Mime-Version:Message-ID:Subject:From:To:Cc:Content-Type; b=FpHY1a9ic33Hs6ZYJKDswMTXwAzBG2ySUvelUWPoGXgVfoGNOMO40QLBQN/oMfqN4efiQ8LKqXB4HTZ0j/3aaCwNRA1GcFN0t0dOogMrWkg+rOiB4fg5pRwzz1y/zdat4mX6iBfAfSugi8OlEU7enWGVSluP2Ba2pjfNeNrQMTc= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--elver.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=Rvzxnz8A; arc=none smtp.client-ip=209.85.128.202 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--elver.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="Rvzxnz8A" Received: by mail-yw1-f202.google.com with SMTP id 00721157ae682-6ea863ecfe9so40771617b3.3 for ; Fri, 08 Nov 2024 03:35:05 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20230601; t=1731065704; x=1731670504; darn=vger.kernel.org; h=cc:to:from:subject:message-id:mime-version:date:from:to:cc:subject :date:message-id:reply-to; bh=D42rLpD50SsNXuzg8LivD2CtXeeoEvwN95ZboPt7X8w=; b=Rvzxnz8AF+NGI7IMPu2BZ8mPBH2ftlv+zUTNutN4wSMQcuUuNME8oSftBxVPeFhLBU ZUJJ30G4rTlcxKb/ccrOIGI7uPI/DRzgFuOuBd/CTbYZYQoGvStrPj4ohAXlV/WcV2te mLuE2WXh4wvSB9ylPoPSEbWEshIMD9ieZqISpxdvCVtRq+rp8dL3wAtKLlj+JPRPn+gf EoihGd+0I9igTmVFkJp9wFmqLlMr0hmHNNdQypZhi1WvojEiriCijJDbMY+2kvTQ0Ifs NWNQKUPNbebi3bcGK/gCxO1OHviIVrR9LVoDPGrgk5H1zl/imylc2HU5V3gETg2XRjsY KIfA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1731065704; x=1731670504; h=cc:to:from:subject:message-id:mime-version:date:x-gm-message-state :from:to:cc:subject:date:message-id:reply-to; bh=D42rLpD50SsNXuzg8LivD2CtXeeoEvwN95ZboPt7X8w=; b=YcER5kjmT4zzJQfbCi1sjAwADQ5VztvatA8VzSxfmMAIu9xz+1VxI/PqjQrJ/LU1nM jkGmOOoDhx2D9OlBSeiZfBDPDa/8jHp9Q6B1q0Tsoa9kfEwC9ZD7Geffh4iO0cf8xC5J JyrKAXkvFdU+1iu5SuNjTmPseZBpN7+q46xGKIl5xyXKopfQZ7Ue7rqr5eb4zm137A7g R314wk9FYcHOrIKkT3frK2VCWAefKPmlM/RheH8U9KbjongvQcA0K6AsQIiI9M5NVm/f 23zmzxmmo+XCV92C1hH1jNoJByaWwYzbNJvWVInzTzlk/5uWRX5Q5cco7m4320KvecUH odVA== X-Forwarded-Encrypted: i=1; AJvYcCWDIbo5ZnNvIbmSfqsOQrEfCb/fAWyseISNShEMsVbyTnNitnTEp/38dtJOUsvJSMwwsvqyULLLeG68btxlrGGdjng=@vger.kernel.org X-Gm-Message-State: AOJu0YxjrssYLa7jVfLFn3/HttpzqcBfCZIVHIMbCuO/hj29ns/Ot6I4 BeijzXier2hWu4rI9pvCRkD2H48GfSl+nM+EldOMsuNRKlbOreFV1ujVoLtOYj0UzBgWO/fp/A= = X-Google-Smtp-Source: AGHT+IEVq4ZB92RQ+5XO1N4eDbZds8vMWL4j02TjhgOSlo3OfmFG5yrjMs51CXGdV/j3StLTZosV0Tjm4Q== X-Received: from elver.muc.corp.google.com ([2a00:79e0:9c:201:1d41:9aa5:8c04:911]) (user=elver job=sendgmr) by 2002:a0d:e703:0:b0:64a:e220:bfb5 with SMTP id 00721157ae682-6eaddd87123mr145677b3.1.1731065704476; Fri, 08 Nov 2024 03:35:04 -0800 (PST) Date: Fri, 8 Nov 2024 12:34:24 +0100 Precedence: bulk X-Mailing-List: linux-trace-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 X-Mailer: git-send-email 2.47.0.277.g8800431eea-goog Message-ID: <20241108113455.2924361-1-elver@google.com> Subject: [PATCH v3 1/2] tracing: Add task_prctl_unknown tracepoint From: Marco Elver To: elver@google.com, Steven Rostedt , Kees Cook Cc: Masami Hiramatsu , Mathieu Desnoyers , Andrew Morton , Oleg Nesterov , linux-kernel@vger.kernel.org, linux-trace-kernel@vger.kernel.org, Dmitry Vyukov , kasan-dev@googlegroups.com prctl() is a complex syscall which multiplexes its functionality based on a large set of PR_* options. Currently we count 64 such options. The return value of unknown options is -EINVAL, and doesn't distinguish from known options that were passed invalid args that also return -EINVAL. To understand if programs are attempting to use prctl() options not yet available on the running kernel, provide the task_prctl_unknown tracepoint. Note, this tracepoint is in an unlikely cold path, and would therefore be suitable for continuous monitoring (e.g. via perf_event_open). While the above is likely the simplest usecase, additionally this tracepoint can help unlock some testing scenarios (where probing sys_enter or sys_exit causes undesirable performance overheads): a. unprivileged triggering of a test module: test modules may register a probe to be called back on task_prctl_unknown, and pick a very large unknown prctl() option upon which they perform a test function for an unprivileged user; b. unprivileged triggering of an eBPF program function: similar as idea (a). Example trace_pipe output: test-380 [001] ..... 78.142904: task_prctl_unknown: option=1234 arg2=101 arg3=102 arg4=103 arg5=104 Signed-off-by: Marco Elver --- v3: * Remove "comm". v2: * Remove "pid" in trace output (suggested by Steven). --- include/trace/events/task.h | 37 +++++++++++++++++++++++++++++++++++++ kernel/sys.c | 3 +++ 2 files changed, 40 insertions(+) diff --git a/include/trace/events/task.h b/include/trace/events/task.h index 47b527464d1a..209d315852fb 100644 --- a/include/trace/events/task.h +++ b/include/trace/events/task.h @@ -56,6 +56,43 @@ TRACE_EVENT(task_rename, __entry->newcomm, __entry->oom_score_adj) ); +/** + * task_prctl_unknown - called on unknown prctl() option + * @option: option passed + * @arg2: arg2 passed + * @arg3: arg3 passed + * @arg4: arg4 passed + * @arg5: arg5 passed + * + * Called on an unknown prctl() option. + */ +TRACE_EVENT(task_prctl_unknown, + + TP_PROTO(int option, unsigned long arg2, unsigned long arg3, + unsigned long arg4, unsigned long arg5), + + TP_ARGS(option, arg2, arg3, arg4, arg5), + + TP_STRUCT__entry( + __field( int, option) + __field( unsigned long, arg2) + __field( unsigned long, arg3) + __field( unsigned long, arg4) + __field( unsigned long, arg5) + ), + + TP_fast_assign( + __entry->option = option; + __entry->arg2 = arg2; + __entry->arg3 = arg3; + __entry->arg4 = arg4; + __entry->arg5 = arg5; + ), + + TP_printk("option=%d arg2=%ld arg3=%ld arg4=%ld arg5=%ld", + __entry->option, __entry->arg2, __entry->arg3, __entry->arg4, __entry->arg5) +); + #endif /* This part must be outside protection */ diff --git a/kernel/sys.c b/kernel/sys.c index 4da31f28fda8..b366cef102ec 100644 --- a/kernel/sys.c +++ b/kernel/sys.c @@ -75,6 +75,8 @@ #include #include +#include + #include "uid16.h" #ifndef SET_UNALIGN_CTL @@ -2785,6 +2787,7 @@ SYSCALL_DEFINE5(prctl, int, option, unsigned long, arg2, unsigned long, arg3, error = RISCV_SET_ICACHE_FLUSH_CTX(arg2, arg3); break; default: + trace_task_prctl_unknown(option, arg2, arg3, arg4, arg5); error = -EINVAL; break; } From patchwork Fri Nov 8 11:34:25 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Marco Elver X-Patchwork-Id: 13868075 Received: from mail-ej1-f74.google.com (mail-ej1-f74.google.com [209.85.218.74]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id DE5B71E47C4 for ; Fri, 8 Nov 2024 11:35:08 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.218.74 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1731065710; cv=none; b=kp0FzTUl4VjKsccL9GgEZTMyKcML2Fm2ZBHVatIlVJQYOu+LMIyKXqmrLMXPdKmKJ1fVrJLO3lJw5b9aeHsB47ejunYQC8tGVxWedZfg5W4NDwzQXa9s1qIk/T6uABdknfJXuxPsuDs0vgScALZPc9xsKRU1Fg6GMED5cfdAX/Y= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1731065710; c=relaxed/simple; bh=hEHya/EWTyjGrJkb2WFQ/xz8flII2H8gY8bYE4SYXJc=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=trr8rw0jISIOznGbRSkUzDL4NA0Lo2JpCDfm+hS/t5qiIJBfiM1jUTro+YedZTp5tyRvWypLfkeO/VGKcCltXw6yPvmnYlTI/qXUwTHhEUzeoItRUgZXQf//T+7klp0dy4vD4A8QvzIAEXomXnpNbjC55JDbC+xmMMalCDB1rpw= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--elver.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=fcpF/lF/; arc=none smtp.client-ip=209.85.218.74 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--elver.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="fcpF/lF/" Received: by mail-ej1-f74.google.com with SMTP id a640c23a62f3a-a9a004bfc1cso151814666b.1 for ; Fri, 08 Nov 2024 03:35:08 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20230601; t=1731065707; x=1731670507; darn=vger.kernel.org; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:from:to:cc:subject:date:message-id:reply-to; bh=WmVAOqvZ/Tu1S1PwD7c/mNbANvvbo6/nc3HYAPUr/Js=; b=fcpF/lF/VD2YmfRPWkre+ZbqYng2N6TmHsRh79VKcKAvNoBX4bhXTFjiZRjEeMa/HV eRjE7dMJTT8mG3hWHX4OnDjKTl4rFOqob5nV1NLKO2SJFgXNw9XzbW+afASmMDpnZx+5 XVNYp74WsG57RcYJWjEPkINX80BBTZdmkRRWquibZ7xM3NSA6/qouLGHW4yiSACFMF1y WYdXPDI7dpTqrppTOjrwPfVJF7qOD0A4wOqNL6sCxf71fpLgV7i1b/AMRMk+17gttAs7 GHavfKCsyq/c6k1UqjyuWYFLHiTB46W3JhjSdLXZTDQnIuKO4oAHcOqfh9Pbo+VUcezL PvMw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1731065707; x=1731670507; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=WmVAOqvZ/Tu1S1PwD7c/mNbANvvbo6/nc3HYAPUr/Js=; b=YFdE1dSCSJkRXS9lpLdEWSuTGH70n2J+wblaiFrboUEyO19KUfdR5POfLs6gIJQVMk V+Bw1pVu0yaSRxoB762pfoILPS82aUSU9e1lt6Wa4mouBa5/cGTAL27qphdE/e0XR/ss zg/ixXwvABe3ychDVU4r3EU6A5e3zECgna/FVKoNS94O/cMlUfCFvTS1YCL98AHz0hzz NLdTKp0gtNk79wemiVqWtVug1Jfhg1ue4d1AxICXAYLZ1yeR+oXAEikhNop4JIRMt8QC wUwJt/z7gbWFdU68m7O1Mh/MnVV/oyfN0Xv43tVqdU/fBPjR/zzVbQvvkaQS4TtAtbmS pqpw== X-Forwarded-Encrypted: i=1; AJvYcCW+RSHx2SajuhS/+YFWo6iqzX9nXsyfo9wKE9YUQGR3VUnSOohlYVF2VdlZ7kNPOKusADkFMiXDaRHH7VyTpnK9Ssc=@vger.kernel.org X-Gm-Message-State: AOJu0YzoLsaUiQ15u7M0/nJqWcR9kHtYRZYqoCcsfDd0+O+ROQ/cjhyq iX5jt4hKIZKdqbIRUd+sOJYkG5AJEtKdh2+GiyDNw0ZAYobz+bqXAousfNOwOdMwraXlAnD+FQ= = X-Google-Smtp-Source: AGHT+IG2mwQUKoRUSpKj9hUWjVgwtRnTOzorVQZkyuHXLrzTO0C2kG5XBaRDL6I4WJyy3fUtsdzTNRaa+A== X-Received: from elver.muc.corp.google.com ([2a00:79e0:9c:201:1d41:9aa5:8c04:911]) (user=elver job=sendgmr) by 2002:a17:906:2557:b0:a9a:1769:f4db with SMTP id a640c23a62f3a-a9eeff38838mr49766b.5.1731065707141; Fri, 08 Nov 2024 03:35:07 -0800 (PST) Date: Fri, 8 Nov 2024 12:34:25 +0100 In-Reply-To: <20241108113455.2924361-1-elver@google.com> Precedence: bulk X-Mailing-List: linux-trace-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20241108113455.2924361-1-elver@google.com> X-Mailer: git-send-email 2.47.0.277.g8800431eea-goog Message-ID: <20241108113455.2924361-2-elver@google.com> Subject: [PATCH v3 2/2] tracing: Remove pid in task_rename tracing output From: Marco Elver To: elver@google.com, Steven Rostedt , Kees Cook Cc: Masami Hiramatsu , Mathieu Desnoyers , Andrew Morton , Oleg Nesterov , linux-kernel@vger.kernel.org, linux-trace-kernel@vger.kernel.org, Dmitry Vyukov , kasan-dev@googlegroups.com Remove pid in task_rename tracepoint output, since that tracepoint only deals with the current task, and is printed by default. This also saves some space in the entry and avoids wasted padding. Link: https://lkml.kernel.org/r/20241105120247.596a0dc9@gandalf.local.home Suggested-by: Steven Rostedt Signed-off-by: Marco Elver --- v2: * New patch --- include/trace/events/task.h | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/include/trace/events/task.h b/include/trace/events/task.h index 209d315852fb..af535b053033 100644 --- a/include/trace/events/task.h +++ b/include/trace/events/task.h @@ -38,22 +38,19 @@ TRACE_EVENT(task_rename, TP_ARGS(task, comm), TP_STRUCT__entry( - __field( pid_t, pid) __array( char, oldcomm, TASK_COMM_LEN) __array( char, newcomm, TASK_COMM_LEN) __field( short, oom_score_adj) ), TP_fast_assign( - __entry->pid = task->pid; memcpy(entry->oldcomm, task->comm, TASK_COMM_LEN); strscpy(entry->newcomm, comm, TASK_COMM_LEN); __entry->oom_score_adj = task->signal->oom_score_adj; ), - TP_printk("pid=%d oldcomm=%s newcomm=%s oom_score_adj=%hd", - __entry->pid, __entry->oldcomm, - __entry->newcomm, __entry->oom_score_adj) + TP_printk("oldcomm=%s newcomm=%s oom_score_adj=%hd", + __entry->oldcomm, __entry->newcomm, __entry->oom_score_adj) ); /**