38261f369f
clang build kernel failed the selftest probe_user. $ ./test_progs -t probe_user $ ... $ test_probe_user:PASS:get_kprobe_res 0 nsec $ test_probe_user:FAIL:check_kprobe_res wrong kprobe res from probe read: 0.0.0.0:0 $ #94 probe_user:FAIL The test attached to kernel function __sys_connect(). In net/socket.c, we have int __sys_connect(int fd, struct sockaddr __user *uservaddr, int addrlen) { ...... } ... SYSCALL_DEFINE3(connect, int, fd, struct sockaddr __user *, uservaddr, int, addrlen) { return __sys_connect(fd, uservaddr, addrlen); } The gcc compiler (8.5.0) does not inline __sys_connect() in syscall entry function. But latest clang trunk did the inlining. So the bpf program is not triggered. To make the test more reliable, let us kprobe the syscall entry function instead. Note that x86_64, arm64 and s390 have syscall wrappers and they have to be handled specially. Signed-off-by: Yonghong Song <yhs@fb.com> Signed-off-by: Andrii Nakryiko <andrii@kernel.org> Link: https://lore.kernel.org/bpf/20210929033000.3711921-1-yhs@fb.com
51 lines
1.1 KiB
C
51 lines
1.1 KiB
C
// SPDX-License-Identifier: GPL-2.0
|
|
|
|
#include <linux/ptrace.h>
|
|
#include <linux/bpf.h>
|
|
|
|
#include <netinet/in.h>
|
|
|
|
#include <bpf/bpf_helpers.h>
|
|
#include <bpf/bpf_tracing.h>
|
|
|
|
#if defined(__TARGET_ARCH_x86)
|
|
#define SYSCALL_WRAPPER 1
|
|
#define SYS_PREFIX "__x64_"
|
|
#elif defined(__TARGET_ARCH_s390)
|
|
#define SYSCALL_WRAPPER 1
|
|
#define SYS_PREFIX "__s390x_"
|
|
#elif defined(__TARGET_ARCH_arm64)
|
|
#define SYSCALL_WRAPPER 1
|
|
#define SYS_PREFIX "__arm64_"
|
|
#else
|
|
#define SYSCALL_WRAPPER 0
|
|
#define SYS_PREFIX ""
|
|
#endif
|
|
|
|
static struct sockaddr_in old;
|
|
|
|
SEC("kprobe/" SYS_PREFIX "sys_connect")
|
|
int BPF_KPROBE(handle_sys_connect)
|
|
{
|
|
#if SYSCALL_WRAPPER == 1
|
|
struct pt_regs *real_regs;
|
|
#endif
|
|
struct sockaddr_in new;
|
|
void *ptr;
|
|
|
|
#if SYSCALL_WRAPPER == 0
|
|
ptr = (void *)PT_REGS_PARM2(ctx);
|
|
#else
|
|
real_regs = (struct pt_regs *)PT_REGS_PARM1(ctx);
|
|
bpf_probe_read_kernel(&ptr, sizeof(ptr), &PT_REGS_PARM2(real_regs));
|
|
#endif
|
|
|
|
bpf_probe_read_user(&old, sizeof(old), ptr);
|
|
__builtin_memset(&new, 0xab, sizeof(new));
|
|
bpf_probe_write_user(ptr, &new, sizeof(new));
|
|
|
|
return 0;
|
|
}
|
|
|
|
char _license[] SEC("license") = "GPL";
|