Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix memfd probes offset. Fixes #214 #219

Closed
wants to merge 1 commit into from
Closed

Fix memfd probes offset. Fixes #214 #219

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 6 additions & 16 deletions GPL/Events/Process/Probe.bpf.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -390,22 +390,18 @@ int BPF_KPROBE(kprobe__ptrace_attach,
}

SEC("tracepoint/syscalls/sys_enter_shmget")
int tracepoint_syscalls_sys_enter_shmget(struct syscall_trace_enter *ctx)
int tracepoint_syscalls_sys_enter_shmget(struct trace_event_raw_sys_enter *ctx)
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Have you seen this? inspektor-gadget/inspektor-gadget#2444 (comment)

(From this PR: #209)

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ack, I'm withdrawing this PR after our meeting yesterday.

I hadn't realized there were two different structures, and using CORE on the ctx's zero len array is not trivial, we need to get btf_size_type and do an ugly dance.

*ON* RHEL9
struct trace_entry {
	short unsigned int type;
	unsigned char flags;
	unsigned char preempt_count;
	int pid;
	char common_preempt;
};

struct syscall_trace_enter {
	struct trace_entry ent;        [0  - 12[
	int nr;                        [12 - 16[
	long unsigned int args[0];     [16 - ..[
};

struct trace_event_raw_sys_enter {
	struct trace_entry ent;        [0  - 12[
	PAD0                           [12 - 16[
	long int id;                   [16 - 24[
	long unsigned int args[6];     [24 - (24 + 6 * 8)[
	char __data[0];                [32 - ..[
};

*NOT* RHEL9
struct syscall_trace_enter {
	struct trace_entry ent;        [0  -  8[
	int nr;                        [8  - 12[
	PAD0                           [12 - 16[ 
	long unsigned int args[0];     [16 - 16[
};

struct trace_event_raw_sys_enter {
	struct trace_entry ent;        [0  -  8[
	long int id;                   [8  - 16[
	long unsigned int args[6];     [16 - ..[
	char __data[0];                [.. - ..[
};

You can see that the args offset on both structures on both RHEL9 and not RHEL9 ends up at 16.
It's all a bit of sheer luck since since only one structure gets padded, so the trace_enter version still works. It's still a bit "wrong" since we use hard coded offsets.

{
if (ebpf_events_is_trusted_pid())
goto out;

struct shmget_args {
short common_type;
char common_flags;
char common_preempt_count;
int common_pid;
int __syscall_nr;
long key;
size_t size;
long shmflg;
};
struct shmget_args *ex_args = (struct shmget_args *)ctx;

struct shmget_args *ex_args = (struct shmget_args *)BPF_CORE_READ(ctx, args);
const struct task_struct *task = (struct task_struct *)bpf_get_current_task();

if (is_kernel_thread(task))
Expand All @@ -430,24 +426,18 @@ int tracepoint_syscalls_sys_enter_shmget(struct syscall_trace_enter *ctx)
}

SEC("tracepoint/syscalls/sys_enter_memfd_create")
int tracepoint_syscalls_sys_enter_memfd_create(struct syscall_trace_enter *ctx)
int tracepoint_syscalls_sys_enter_memfd_create(struct trace_event_raw_sys_enter *ctx)
{
if (ebpf_events_is_trusted_pid())
goto out;

// from: /sys/kernel/debug/tracing/events/syscalls/sys_enter_memfd_create/format
struct memfd_create_args {
short common_type;
char common_flags;
char common_preempt_count;
int common_pid;
int __syscall_nr;
const char *uname;
unsigned long flags;
};
struct memfd_create_args *ex_args = (struct memfd_create_args *)ctx;

const struct task_struct *task = (struct task_struct *)bpf_get_current_task();
struct memfd_create_args *ex_args = (struct memfd_create_args *)BPF_CORE_READ(ctx, args);
const struct task_struct *task = (struct task_struct *)bpf_get_current_task();

if (is_kernel_thread(task))
goto out;
Expand Down
Loading