bpf: Add pid filter support for uprobe_multi link

Adding support to specify pid for uprobe_multi link and the uprobes are created only for task with given pid value. Using the consumer.filter filter callback for that, so the task gets filtered during the uprobe installation. We still need to check the task during runtime in the uprobe handler, because the handler could get executed if there's another system wide consumer on the same uprobe (thanks Oleg for the insight).

Jiri Olsa committed 3 years ago

Commit b733eea1 parent 0b779b64 files · +36 −1Browse files

Unified · Split

4 files

include/uapi/linux/bpf.h +1 −0
kernel/bpf/syscall.c +1 −1
kernel/trace/bpf_trace.c +33 −0
tools/include/uapi/linux/bpf.h +1 −0

include/uapi/linux/bpf.h+1−0

@@ -1642,6 +1642,7 @@ union bpf_attr { · 1641 unmodified lines
1642	__aligned_u64 cookies;	1642	__aligned_u64 cookies;
1643	__u32 cnt;	1643	__u32 cnt;
1644	__u32 flags;	1644	__u32 flags;
		1645	__u32 pid;
1645	} uprobe_multi;	1646	} uprobe_multi;
1646	};	1647	};
1647	} link_create;	1648	} link_create;

kernel/bpf/syscall.c+1−1

@@ -4882,7 +4882,7 @@ err_put: · 4881 unmodified lines
4882	return err;	4882	return err;
4883	}	4883	}
4884		4884
4885	#define BPF_LINK_CREATE_LAST_FIELD link_create.uprobe_multi.flags	4885	#define BPF_LINK_CREATE_LAST_FIELD link_create.uprobe_multi.pid
4886	static int link_create(union bpf_attr *attr, bpfptr_t uattr)	4886	static int link_create(union bpf_attr *attr, bpfptr_t uattr)
4887	{	4887	{
4888	struct bpf_prog *prog;	4888	struct bpf_prog *prog;

kernel/trace/bpf_trace.c+33−0

 	struct bpf_link link;
 	u32 cnt;
 	struct bpf_uprobe *uprobes;
+	struct task_struct *task;
 };
 struct bpf_uprobe_multi_run_ctx {
 	struct bpf_uprobe_multi_link *umulti_link;
 	umulti_link = container_of(link, struct bpf_uprobe_multi_link, link);
+	if (umulti_link->task)
+		put_task_struct(umulti_link->task);
 	path_put(&umulti_link->path);
 	kvfree(umulti_link->uprobes);
 	kfree(umulti_link);
 	struct bpf_run_ctx *old_run_ctx;
 	int err = 0;
+	if (link->task && current != link->task)
+		return 0;
 	if (sleepable)
 		rcu_read_lock_trace();
 	else
 	return err;
 }
+static bool
+uprobe_multi_link_filter(struct uprobe_consumer *con, enum uprobe_filter_ctx ctx,
+			 struct mm_struct *mm)
+{
+	struct bpf_uprobe *uprobe;
+	uprobe = container_of(con, struct bpf_uprobe, consumer);
+	return uprobe->link->task->mm == mm;
+}
 static int
 uprobe_multi_link_handler(struct uprobe_consumer *con, struct pt_regs *regs)
 {
 	unsigned long *ref_ctr_offsets = NULL;
 	struct bpf_link_primer link_primer;
 	struct bpf_uprobe *uprobes = NULL;
+	struct task_struct *task = NULL;
 	unsigned long __user *uoffsets;
 	u64 __user *ucookies;
 	void __user *upath;
 	u32 flags, cnt, i;
 	struct path path;
 	char *name;
+	pid_t pid;
 	int err;
 	/* no support for 32bit archs yet */
 		goto error_path_put;
 	}
+	pid = attr->link_create.uprobe_multi.pid;
+	if (pid) {
+		rcu_read_lock();
+		task = get_pid_task(find_vpid(pid), PIDTYPE_PID);
+		rcu_read_unlock();
+		if (!task)
+			goto error_path_put;
+	}
 	err = -ENOMEM;
 	link = kzalloc(sizeof(*link), GFP_KERNEL);
 			uprobes[i].consumer.ret_handler = uprobe_multi_link_ret_handler;
 		else
 			uprobes[i].consumer.handler = uprobe_multi_link_handler;
+		if (pid)
+			uprobes[i].consumer.filter = uprobe_multi_link_filter;
 	}
 	link->cnt = cnt;
 	link->uprobes = uprobes;
 	link->path = path;
+	link->task = task;
 	bpf_link_init(&link->link, BPF_LINK_TYPE_UPROBE_MULTI,
 		      &bpf_uprobe_multi_link_lops, prog);
 	kvfree(ref_ctr_offsets);
 	kvfree(uprobes);
 	kfree(link);
+	if (task)
+		put_task_struct(task);
 error_path_put:
 	path_put(&path);
 	return err;

tools/include/uapi/linux/bpf.h+1−0

@@ -1642,6 +1642,7 @@ union bpf_attr { · 1641 unmodified lines
1642	__aligned_u64 cookies;	1642	__aligned_u64 cookies;
1643	__u32 cnt;	1643	__u32 cnt;
1644	__u32 flags;	1644	__u32 flags;
		1645	__u32 pid;
1645	} uprobe_multi;	1646	} uprobe_multi;
1646	};	1647	};
1647	} link_create;	1648	} link_create;