Commit 05b2083c authored by Paul Chaignon's avatar Paul Chaignon

Limit dereference rewriter to tracepoint and kprobes contexts

We should only track and rewrite external pointers from the context
pointer for tracing programs.  Other types of context pointers point
to e.g. packets and do not require a rewrite to a bpf_probe_read
call.
parent 8996719b
...@@ -911,7 +911,16 @@ void BTypeConsumer::HandleTranslationUnit(ASTContext &Context) { ...@@ -911,7 +911,16 @@ void BTypeConsumer::HandleTranslationUnit(ASTContext &Context) {
if (fe_.is_rewritable_ext_func(F)) { if (fe_.is_rewritable_ext_func(F)) {
for (auto arg : F->parameters()) { for (auto arg : F->parameters()) {
if (arg == F->getParamDecl(0)) { if (arg == F->getParamDecl(0)) {
probe_visitor1_.set_ctx(arg); /**
* Limit tracing of pointers from context to tracing contexts.
* We're whitelisting instead of blacklisting to avoid issues with
* existing programs if new context types are added in the future.
*/
string type = arg->getType().getAsString();
if (type == "struct pt_regs *" ||
type == "struct bpf_raw_tracepoint_args *" ||
type.substr(0, 19) == "struct tracepoint__")
probe_visitor1_.set_ctx(arg);
} else if (!arg->getType()->isFundamentalType()) { } else if (!arg->getType()->isFundamentalType()) {
probe_visitor1_.set_ptreg(arg); probe_visitor1_.set_ptreg(arg);
} }
......
...@@ -810,6 +810,25 @@ int test(struct pt_regs *ctx) { ...@@ -810,6 +810,25 @@ int test(struct pt_regs *ctx) {
b = BPF(text=text) b = BPF(text=text)
fn = b.load_func("test", BPF.KPROBE) fn = b.load_func("test", BPF.KPROBE)
@skipUnless(kernel_version_ge(4,7), "requires kernel >= 4.7")
def test_probe_read_tc_ctx(self):
text = """
#include <uapi/linux/pkt_cls.h>
#include <linux/if_ether.h>
int test(struct __sk_buff *ctx) {
void* data_end = (void*)(long)ctx->data_end;
void* data = (void*)(long)ctx->data;
if (data + sizeof(struct ethhdr) > data_end)
return TC_ACT_SHOT;
struct ethhdr *eh = (struct ethhdr *)data;
if (eh->h_proto == 0x1)
return TC_ACT_SHOT;
return TC_ACT_OK;
}
"""
b = BPF(text=text)
fn = b.load_func("test", BPF.SCHED_CLS)
if __name__ == "__main__": if __name__ == "__main__":
main() main()
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment