From mboxrd@z Thu Jan 1 00:00:00 1970 From: Arnaldo Carvalho de Melo Subject: Re: len = bpf_probe_read_str(); bpf_perf_event_output(... len) == FAIL Date: Mon, 13 Nov 2017 12:08:20 -0300 Message-ID: <20171113150820.GA15366@kernel.org> References: <20171113143047.GH15684@kernel.org> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="tKW2IUtsqtDRztdT" Cc: Gianluca Borello , Alexei Starovoitov , David Miller , Linux Networking Development Mailing List To: Daniel Borkmann Return-path: Received: from mail.kernel.org ([198.145.29.99]:45300 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752336AbdKMPIX (ORCPT ); Mon, 13 Nov 2017 10:08:23 -0500 Content-Disposition: inline In-Reply-To: Sender: netdev-owner@vger.kernel.org List-ID: --tKW2IUtsqtDRztdT Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable Em Mon, Nov 13, 2017 at 03:56:14PM +0100, Daniel Borkmann escreveu: > On 11/13/2017 03:30 PM, Arnaldo Carvalho de Melo wrote: > > Hi, > >=20 > > In a5e8c07059d0 ("bpf: add bpf_probe_read_str helper") you > > state: > >=20 > > "This is suboptimal because the size of the string needs to be estim= ated > > at compile time, causing more memory to be copied than often necess= ary, > > and can become more problematic if further processing on buf is don= e, > > for example by pushing it to userspace via bpf_perf_event_output(), > > since the real length of the string is unknown and the entire buffer > > must be copied (and defining an unrolled strnlen() inside the bpf > > program is a very inefficient and unfeasible approach)." > >=20 > > So I went on to try this with 'perf trace' but it isn't working if I use > > the return from bpf_probe_read_str(), I must be missing something > > here...=20 > >=20 > > I.e. this works: > >=20 > > [root@jouet bpf]# cat open.c > > #include "bpf.h" > >=20 > > SEC("prog=3Ddo_sys_open filename") > > int prog(void *ctx, int err, const char __user *filename_ptr) > > { > > char filename[128]; > > const unsigned len =3D bpf_probe_read_str(filename, sizeof(filename), = filename_ptr); > > perf_event_output(ctx, &__bpf_stdout__, get_smp_processor_id(), filena= me, 32); >=20 > By the way, you can just use BPF_F_CURRENT_CPU flag instead of the helper > call get_smp_processor_id() to get current CPU. Thanks, switched to it. > > But then if I use the return value to push just the string lenght, it > > doesn't work: > >=20 > > [root@jouet bpf]# cat open.c > > #include "bpf.h" > >=20 > > SEC("prog=3Ddo_sys_open filename") > > int prog(void *ctx, int err, const char __user *filename_ptr) > > { > > char filename[128]; > > const unsigned len =3D bpf_probe_read_str(filename, sizeof(filename), = filename_ptr); > > perf_event_output(ctx, &__bpf_stdout__, get_smp_processor_id(), filena= me, len); >=20 > The below issue 'invalid stack type R4 off=3D-128 access_size=3D0' is bas= ically that > unsigned len is unknown at verification time, thus unbounded. Can you try= the > following to see if that passes? >=20 > if (len > 0 && len <=3D sizeof(filename)) > perf_event_output(ctx, &__bpf_stdout__, get_smp_processor_id(), filen= ame, len); I had it like: if (len > 0 && len < 32) And it didn't helped, now I did exactly as you suggested: [root@jouet bpf]# cat open.c #include "bpf.h" SEC("prog=3Ddo_sys_open filename") int prog(void *ctx, int err, const char __user *filename_ptr) { char filename[128]; const unsigned len =3D bpf_probe_read_str(filename, sizeof(filename), file= name_ptr); if (len > 0 && len <=3D sizeof(filename)) perf_event_output(ctx, &__bpf_stdout__, BPF_F_CURRENT_CPU, filename, len); return 1; } [root@jouet bpf]# trace -e open,open.c touch /etc/passwd bpf: builtin compilation failed: -95, try external compiler event syntax error: 'open.c' \___ Kernel verifier blocks program loading [root@jouet bpf]#=20 The -v output looks the same: =02[root@jouet bpf]# trace -v -e open,open.c touch /etc/passwd bpf: builtin compilation failed: -95, try external compiler Kernel build dir is set to /lib/modules/4.14.0-rc6+/build set env: KBUILD_DIR=3D/lib/modules/4.14.0-rc6+/build unset env: KBUILD_OPTS include option is set to -nostdinc -isystem /usr/lib/gcc/x86_64-redhat-lin= ux/7/include -I/home/acme/git/linux/arch/x86/include -I./arch/x86/include/g= enerated -I/home/acme/git/linux/include -I./include -I/home/acme/git/linux= /arch/x86/include/uapi -I./arch/x86/include/generated/uapi -I/home/acme/git= /linux/include/uapi -I./include/generated/uapi -include /home/acme/git/linu= x/include/linux/kconfig.h=20 set env: NR_CPUS=3D4 set env: LINUX_VERSION_CODE=3D0x40e00 set env: CLANG_EXEC=3D/usr/local/bin/clang unset env: CLANG_OPTIONS set env: KERNEL_INC_OPTIONS=3D -nostdinc -isystem /usr/lib/gcc/x86_64-redha= t-linux/7/include -I/home/acme/git/linux/arch/x86/include -I./arch/x86/incl= ude/generated -I/home/acme/git/linux/include -I./include -I/home/acme/git/= linux/arch/x86/include/uapi -I./arch/x86/include/generated/uapi -I/home/acm= e/git/linux/include/uapi -I./include/generated/uapi -include /home/acme/git= /linux/include/linux/kconfig.h=20 set env: WORKING_DIR=3D/lib/modules/4.14.0-rc6+/build set env: CLANG_SOURCE=3D/home/acme/bpf/open.c llvm compiling command template: $CLANG_EXEC -D__KERNEL__ -D__NR_CPUS__=3D$= NR_CPUS -DLINUX_VERSION_CODE=3D$LINUX_VERSION_CODE $CLANG_OPTIONS $KERNEL_I= NC_OPTIONS -Wno-unused-value -Wno-pointer-sign -working-directory $WORKING_= DIR -c "$CLANG_SOURCE" -target bpf -O2 -o - libbpf: loading object 'open.c' from buffer libbpf: section .strtab, size 103, link 0, flags 0, type=3D3 libbpf: section .text, size 0, link 0, flags 6, type=3D1 libbpf: section prog=3Ddo_sys_open filename, size 184, link 0, flags 6, typ= e=3D1 libbpf: found program prog=3Ddo_sys_open filename libbpf: section .relprog=3Ddo_sys_open filename, size 16, link 8, flags 0, = type=3D9 libbpf: section maps, size 16, link 0, flags 3, type=3D1 libbpf: section license, size 4, link 0, flags 3, type=3D1 libbpf: license of open.c is GPL libbpf: section version, size 4, link 0, flags 3, type=3D1 libbpf: kernel version of open.c is 40e00 libbpf: section .symtab, size 144, link 1, flags 0, type=3D2 libbpf: maps in open.c: 1 maps in 16 bytes libbpf: map 0 is "__bpf_stdout__" libbpf: collecting relocating info for: 'prog=3Ddo_sys_open filename' libbpf: relocation: insn_idx=3D15 libbpf: relocation: find map 0 (__bpf_stdout__) for insn 15 bpf: config program 'prog=3Ddo_sys_open filename' symbol:do_sys_open file:(null) line:0 offset:0 return:0 lazy:(null) parsing arg: filename into filename bpf: config 'prog=3Ddo_sys_open filename' is ok Looking at the vmlinux_path (8 entries long) Using /lib/modules/4.14.0-rc6+/build/vmlinux for symbols Open Debuginfo file: /lib/modules/4.14.0-rc6+/build/vmlinux Try to find probe point from debuginfo. Matched function: do_sys_open [2a2bbbe] Probe point found: do_sys_open+0 Searching 'filename' variable in context. Converting variable filename into trace event. filename type is (null). Opening /sys/kernel/debug/tracing//README write=3D0 Found 1 probe_trace_events. Opening /sys/kernel/debug/tracing//kprobe_events write=3D1 Writing event: p:perf_bpf_probe/prog _text+2493152 filename=3D%si:x64 In map_prologue, ntevs=3D1 mapping[0]=3D0 libbpf: create map __bpf_stdout__: fd=3D3 prologue: pass validation prologue: fast path libbpf: load bpf program failed: Permission denied libbpf: -- BEGIN DUMP LOG --- libbpf:=20 0: (79) r3 =3D *(u64 *)(r1 +104) 1: (b7) r2 =3D 0 2: (bf) r6 =3D r1 3: (bf) r1 =3D r10 4: (07) r1 +=3D -128 5: (b7) r2 =3D 128 6: (85) call bpf_probe_read_str#45 7: (bf) r1 =3D r0 8: (07) r1 +=3D -1 9: (67) r1 <<=3D 32 10: (77) r1 >>=3D 32 11: (25) if r1 > 0x7f goto pc+11 R0=3Dinv(id=3D0) R1=3Dinv(id=3D0,umax_value=3D127,var_off=3D(0x0; 0x7f)) R= 6=3Dctx(id=3D0,off=3D0,imm=3D0) R10=3Dfp0 12: (67) r0 <<=3D 32 13: (77) r0 >>=3D 32 14: (bf) r4 =3D r10 15: (07) r4 +=3D -128 16: (bf) r1 =3D r6 17: (18) r2 =3D 0xffffa0b74ba91000 19: (18) r3 =3D 0xffffffff 21: (bf) r5 =3D r0 22: (85) call bpf_perf_event_output#25 invalid stack type R4 off=3D-128 access_size=3D0 libbpf: -- END LOG -- libbpf: Loading the 0th instance of program 'prog=3Ddo_sys_open filename' f= ailed libbpf: failed to load program 'prog=3Ddo_sys_open filename' libbpf: failed to load object 'open.c' bpf: load objects failed event syntax error: 'open.c' \___ Kernel verifier blocks program loading Also: [root@jouet bpf]# clang -v clang version 4.0.0 (http://llvm.org/git/clang.git f5be8ba13adc4ba1011a7ccd= 60c844bd60427c1c) (http://llvm.org/git/llvm.git efca1a37676f4cd276d947658cf= 90b0fb625abfd) Target: x86_64-unknown-linux-gnu Thread model: posix InstalledDir: /usr/local/bin Found candidate GCC installation: /usr/lib/gcc/x86_64-redhat-linux/7 Selected GCC installation: /usr/lib/gcc/x86_64-redhat-linux/7 Candidate multilib: .;@m64 Candidate multilib: 32;@m32 Selected multilib: .;@m64 [root@jouet bpf]# And now I've really attached that bpf.h header I use. - Arnaldo --tKW2IUtsqtDRztdT Content-Type: text/plain; charset=us-ascii Content-Disposition: attachment; filename="bpf.h" #include struct bpf_map_def { unsigned int type; unsigned int key_size; unsigned int value_size; unsigned int max_entries; }; #define SEC(NAME) __attribute__((section(NAME), used)) static int (*get_smp_processor_id)(void) = (void *)BPF_FUNC_get_smp_processor_id; static int (*perf_event_output)(void *, struct bpf_map_def *, int, void *, unsigned long) = (void *)BPF_FUNC_perf_event_output; static int (*bpf_probe_read_str)(void *dst, int size, const void *unsafe_addr) = (void *)BPF_FUNC_probe_read_str; static int (*trace_printk)(const char *fmt, int fmt_size, ...) = (void *)BPF_FUNC_trace_printk; struct bpf_map_def SEC("maps") __bpf_stdout__ = { .type = BPF_MAP_TYPE_PERF_EVENT_ARRAY, .key_size = sizeof(int), .value_size = sizeof(u32), .max_entries = __NR_CPUS__, }; #define printf(msg) \ ({ char str[] = msg; perf_event_output(ctx, &__bpf_stdout__, get_smp_processor_id(), &str, sizeof(str)); }) char _license[] SEC("license") = "GPL"; int _version SEC("version") = LINUX_VERSION_CODE; --tKW2IUtsqtDRztdT--