[PATCH bpf] samples/bpf: Fix broken tracex1 due to kprobe argument change

[PATCH bpf] samples/bpf: Fix broken tracex1 due to kprobe argument change

[Yaqi Chen]

From commit c0bbbdc32feb ("__netif_receive_skb_core: pass skb by
reference"), the first argument passed into __netif_receive_skb_core
has changed to reference of a skb pointer.

This commit fixes by using bpf_probe_read_kernel.

Signed-off-by: Yaqi Chen <chendotjs@gmail.com>
---
 samples/bpf/tracex1_kern.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/samples/bpf/tracex1_kern.c b/samples/bpf/tracex1_kern.c
index 3f4599c9a202..ef30d2b353b0 100644
--- a/samples/bpf/tracex1_kern.c
+++ b/samples/bpf/tracex1_kern.c
@@ -26,7 +26,7 @@
 SEC("kprobe/__netif_receive_skb_core")
 int bpf_prog1(struct pt_regs *ctx)
 {
-	/* attaches to kprobe netif_receive_skb,
+	/* attaches to kprobe __netif_receive_skb_core,
 	 * looks for packets on loobpack device and prints them
 	 */
 	char devname[IFNAMSIZ];
@@ -35,7 +35,7 @@ int bpf_prog1(struct pt_regs *ctx)
 	int len;
 
 	/* non-portable! works for the given kernel only */
-	skb = (struct sk_buff *) PT_REGS_PARM1(ctx);
+	bpf_probe_read_kernel(&skb, sizeof(skb), (void *)PT_REGS_PARM1(ctx));
 	dev = _(skb->dev);
 	len = _(skb->len);
 
-- 
2.18.4

Re: [PATCH bpf] samples/bpf: Fix broken tracex1 due to kprobe argument change

[Yonghong Song]

On 4/16/21 8:48 AM, Yaqi Chen wrote:
>  From commit c0bbbdc32feb ("__netif_receive_skb_core: pass skb by
> reference"), the first argument passed into __netif_receive_skb_core
> has changed to reference of a skb pointer.
> 
> This commit fixes by using bpf_probe_read_kernel.
> 
> Signed-off-by: Yaqi Chen <chendotjs@gmail.com>

Acked-by: Yonghong Song <yhs@fb.com>

Re: [PATCH bpf] samples/bpf: Fix broken tracex1 due to kprobe argument change

[Andrii Nakryiko]

On Fri, Apr 16, 2021 at 8:48 AM Yaqi Chen <chendotjs@gmail.com> wrote:
>
> From commit c0bbbdc32feb ("__netif_receive_skb_core: pass skb by
> reference"), the first argument passed into __netif_receive_skb_core
> has changed to reference of a skb pointer.
>
> This commit fixes by using bpf_probe_read_kernel.
>
> Signed-off-by: Yaqi Chen <chendotjs@gmail.com>
> ---
>  samples/bpf/tracex1_kern.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/samples/bpf/tracex1_kern.c b/samples/bpf/tracex1_kern.c
> index 3f4599c9a202..ef30d2b353b0 100644
> --- a/samples/bpf/tracex1_kern.c
> +++ b/samples/bpf/tracex1_kern.c
> @@ -26,7 +26,7 @@
>  SEC("kprobe/__netif_receive_skb_core")
>  int bpf_prog1(struct pt_regs *ctx)

This is a good opportunity to use BPF_KPROBE from bpf_tracing.h
helper. It would look like:

SEC("kprobe/__netif_receive_skb_core")
int BPF_KPROBE(struct sk_buff **pskb, bool pfmemalloc, struct
packet_type **ppt_prev)
{

    /* and here you'll be able to read sk_buff pointer as */
    bpf_probe_read_kernel(&skb, sizeof(skb), pskb);

}


>  {
> -       /* attaches to kprobe netif_receive_skb,
> +       /* attaches to kprobe __netif_receive_skb_core,
>          * looks for packets on loobpack device and prints them
>          */
>         char devname[IFNAMSIZ];
> @@ -35,7 +35,7 @@ int bpf_prog1(struct pt_regs *ctx)
>         int len;
>
>         /* non-portable! works for the given kernel only */
> -       skb = (struct sk_buff *) PT_REGS_PARM1(ctx);
> +       bpf_probe_read_kernel(&skb, sizeof(skb), (void *)PT_REGS_PARM1(ctx));
>         dev = _(skb->dev);
>         len = _(skb->len);
>
> --
> 2.18.4
>