Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 8d3b7dce authored by Alexei Starovoitov's avatar Alexei Starovoitov Committed by David S. Miller
Browse files

bpf: add support for %s specifier to bpf_trace_printk() 



%s specifier makes bpf program and kernel debugging easier.
To make sure that trace_printk won't crash the unsafe string
is copied into stack and unsafe pointer is substituted.

The following C program:
 #include <linux/fs.h>
int foo(struct pt_regs *ctx, struct filename *filename)
{
  void *name = 0;

  bpf_probe_read(&name, sizeof(name), &filename->name);
  bpf_trace_printk("executed %s\n", name);
  return 0;
}

when attached to kprobe do_execve()
will produce output in /sys/kernel/debug/tracing/trace_pipe :
    make-13492 [002] d..1  3250.997277: : executed /bin/sh
      sh-13493 [004] d..1  3250.998716: : executed /usr/bin/gcc
     gcc-13494 [002] d..1  3250.999822: : executed /usr/lib/gcc/x86_64-linux-gnu/4.7/cc1
     gcc-13495 [002] d..1  3251.006731: : executed /usr/bin/as
     gcc-13496 [002] d..1  3251.011831: : executed /usr/lib/gcc/x86_64-linux-gnu/4.7/collect2
collect2-13497 [000] d..1  3251.012941: : executed /usr/bin/ld

Suggested-by: default avatarBrendan Gregg <brendan.d.gregg@gmail.com>
Signed-off-by: default avatarAlexei Starovoitov <ast@plumgrid.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 1a6877b9

kernel/trace/bpf_trace.c

+30 −2
Original line number Diff line number Diff line
@@ -81,13 +81,16 @@ static const struct bpf_func_proto bpf_probe_read_proto = { 


/*

 * limited trace_printk()

 * only %d %u %x %ld %lu %lx %lld %llu %llx %p conversion specifiers allowed

 * only %d %u %x %ld %lu %lx %lld %llu %llx %p %s conversion specifiers allowed

 */

static u64 bpf_trace_printk(u64 r1, u64 fmt_size, u64 r3, u64 r4, u64 r5)

{

	char *fmt = (char *) (long) r1;

	bool str_seen = false;

	int mod[3] = {};

	int fmt_cnt = 0;

	u64 unsafe_addr;

	char buf[64];

	int i;



	/*
@@ -114,12 +117,37 @@ static u64 bpf_trace_printk(u64 r1, u64 fmt_size, u64 r3, u64 r4, u64 r5) 
		if (fmt[i] == 'l') {

			mod[fmt_cnt]++;

			i++;

		} else if (fmt[i] == 'p') {

		} else if (fmt[i] == 'p' || fmt[i] == 's') {

			mod[fmt_cnt]++;

			i++;

			if (!isspace(fmt[i]) && !ispunct(fmt[i]) && fmt[i] != 0)

				return -EINVAL;

			fmt_cnt++;

			if (fmt[i - 1] == 's') {

				if (str_seen)

					/* allow only one '%s' per fmt string */

					return -EINVAL;

				str_seen = true;



				switch (fmt_cnt) {

				case 1:

					unsafe_addr = r3;

					r3 = (long) buf;

					break;

				case 2:

					unsafe_addr = r4;

					r4 = (long) buf;

					break;

				case 3:

					unsafe_addr = r5;

					r5 = (long) buf;

					break;

				}

				buf[0] = 0;

				strncpy_from_unsafe(buf,

						    (void *) (long) unsafe_addr,

						    sizeof(buf));

			}

			continue;

		}