Skip to content

uprobe,bpf: Allow to change app registers from uprobe registers #9764

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 6 commits into
base: bpf-next_base
Choose a base branch
from
Open

uprobe,bpf: Allow to change app registers from uprobe registers #9764

wants to merge 6 commits into from
+289 −3

Conversation

kernel-patches-daemon-bpf[bot]
Copy link

Pull request for series with
subject: uprobe,bpf: Allow to change app registers from uprobe registers
version: 1
url: https://patchwork.kernel.org/project/netdevbpf/list/?series=1003090

@kernel-patches-daemon-bpf
Copy link
Author

Upstream branch: b13448d
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=1003090
version: 1

@kernel-patches-daemon-bpf
Copy link
Author

Upstream branch: 180a46b
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=1003090
version: 1

@kernel-patches-daemon-bpf
Copy link
Author

Upstream branch: a24a2dd
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=1003090
version: 1

@kernel-patches-daemon-bpf
Copy link
Author

Upstream branch: 6ff4a0f
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=1003090
version: 1

@kernel-patches-daemon-bpf
Copy link
Author

Upstream branch: 3547a61
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=1003090
version: 1

@olsajiri
bpf: Allow uprobe program to change context registers
4cd9dc1 
Currently uprobe (BPF_PROG_TYPE_KPROBE) program can't write to the
context registers data. While this makes sense for kprobe attachments,
for uprobe attachment it might make sense to be able to change user
space registers to alter application execution.

Since uprobe and kprobe programs share the same type (BPF_PROG_TYPE_KPROBE),
we can't deny write access to context during the program load. We need
to check on it during program attachment to see if it's going to be
kprobe or uprobe.

Storing the program's write attempt to context and checking on it
during the attachment.

Acked-by: Andrii Nakryiko <[email protected]>
Signed-off-by: Jiri Olsa <[email protected]>
@olsajiri
uprobe: Do not emulate/sstep original instruction when ip is changed
d6705b7 
If uprobe handler changes instruction pointer we still execute single
step) or emulate the original instruction and increment the (new) ip
with its length.

This makes the new instruction pointer bogus and application will
likely crash on illegal instruction execution.

If user decided to take execution elsewhere, it makes little sense
to execute the original instruction, so let's skip it.

Acked-by: Oleg Nesterov <[email protected]>
Acked-by: Andrii Nakryiko <[email protected]>
Signed-off-by: Jiri Olsa <[email protected]>
@olsajiri
selftests/bpf: Add uprobe context registers changes test
56324f6 
Adding test to check we can change common register values through
uprobe program.

It's x86_64 specific test.

Acked-by: Andrii Nakryiko <[email protected]>
Signed-off-by: Jiri Olsa <[email protected]>
@kernel-patches-daemon-bpf
Copy link
Author

Upstream branch: 8cd189e
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=1003090
version: 1

@olsajiri
selftests/bpf: Add uprobe context ip register change test
84e6203 
Adding test to check we can change the application execution
through instruction pointer change through uprobe program.

It's x86_64 specific test.

Acked-by: Andrii Nakryiko <[email protected]>
Signed-off-by: Jiri Olsa <[email protected]>
@olsajiri
selftests/bpf: Add kprobe write ctx attach test
a13be25 
Adding test to check we can't attach standard kprobe program that
writes to the context.

It's x86_64 specific test.

Acked-by: Andrii Nakryiko <[email protected]>
Signed-off-by: Jiri Olsa <[email protected]>
@olsajiri
selftests/bpf: Add kprobe multi write ctx attach test
802bb54 
Adding test to check we can't attach kprobe multi program
that writes to the context.

It's x86_64 specific test.

Acked-by: Andrii Nakryiko <[email protected]>
Signed-off-by: Jiri Olsa <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
bpf-next new V1-ci-pass V1
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@olsajiri