Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

sync: 4.0.1+driver #925

Merged
merged 4 commits into from
Feb 28, 2023
Merged

sync: 4.0.1+driver #925

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
59b2919
fix(driver): fix build on linux-6.2
hhoffstaette Feb 21, 2023
b15d312
fix(driver/bpf): fixed bpf probe build on kernel >= 6.2
FedeDP Feb 22, 2023
096d45b
fix(bpf): fixed a couple of clang15 verifier issues.
FedeDP Feb 1, 2023
52c661f
update(driver): updated API_VERSION to 3.0.1 since there were bugfixes.
FedeDP Feb 23, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion driver/API_VERSION
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1 +1 @@
3.0.0
3.0.1
23 changes: 16 additions & 7 deletions driver/bpf/fillers.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -61,7 +61,7 @@ static __always_inline int __bpf_##x(struct filler_data *data); \
__bpf_section(TP_NAME "filler/" #x) \
static __always_inline int bpf_##x(void *ctx) \
{ \
struct filler_data data; \
struct filler_data data = {0}; \
int res; \
\
res = init_filler_data(ctx, &data, is_syscall); \
Expand Down Expand Up @@ -288,7 +288,7 @@ FILLER_RAW(terminate_filler)
if (state->n_drops_scratch_map != ULLONG_MAX) {
++state->n_drops_scratch_map;
}
break;
break;
default:
bpf_printk("Unknown filler res=%d event=%d curarg=%d\n",
state->tail_ctx.prev_res,
Expand Down Expand Up @@ -852,7 +852,12 @@ static __always_inline unsigned long bpf_get_mm_counter(struct mm_struct *mm,
{
long val;

// See 6.2 kernel commit: https://github.com/torvalds/linux/commit/f1a7941243c102a44e8847e3b94ff4ff3ec56f25
#if LINUX_VERSION_CODE < KERNEL_VERSION(6, 2, 0)
bpf_probe_read(&val, sizeof(val), &mm->rss_stat.count[member]);
#else
bpf_probe_read(&val, sizeof(val), &mm->rss_stat[member].count);
#endif
if (val < 0)
val = 0;

Expand Down Expand Up @@ -2313,7 +2318,7 @@ FILLER(proc_startupdate, true)
arg_start = _READ(mm->arg_start);
args_len = arg_end - arg_start;

if (args_len) {
if (args_len > 0) {
if (args_len > ARGS_ENV_SIZE_MAX)
args_len = ARGS_ENV_SIZE_MAX;

Expand All @@ -2340,7 +2345,7 @@ FILLER(proc_startupdate, true)
case PPME_SYSCALL_EXECVE_19_X:
val = bpf_syscall_get_argument(data, 1);
break;

case PPME_SYSCALL_EXECVEAT_X:
val = bpf_syscall_get_argument(data, 2);
break;
Expand All @@ -2358,14 +2363,14 @@ FILLER(proc_startupdate, true)
args_len = 0;
}

if (args_len) {
if (args_len > 0) {
int exe_len;

exe_len = bpf_probe_read_str(&data->buf[data->state->tail_ctx.curoff & SCRATCH_SIZE_HALF],
SCRATCH_SIZE_HALF,
&data->buf[data->state->tail_ctx.curoff & SCRATCH_SIZE_HALF]);

if (exe_len == -EFAULT)
if (exe_len < 0)
return PPM_FAILURE_INVALID_USER_MEMORY;

/*
Expand All @@ -2376,11 +2381,15 @@ FILLER(proc_startupdate, true)
if (res != PPM_SUCCESS)
return res;

args_len -= exe_len;
if (args_len < 0)
return PPM_FAILURE_INVALID_USER_MEMORY;

/*
* Args
*/
data->curarg_already_on_frame = true;
res = __bpf_val_to_ring(data, 0, args_len - exe_len, PT_BYTEBUF, -1, false);
res = __bpf_val_to_ring(data, 0, args_len, PT_BYTEBUF, -1, false);
if (res != PPM_SUCCESS)
return res;
} else {
Expand Down
6 changes: 5 additions & 1 deletion driver/main.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2637,11 +2637,15 @@ static int get_tracepoint_handles(void)
#endif

#if LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 20)
#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 2, 0)
static char *ppm_devnode(const struct device *dev, umode_t *mode)
#else
#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 3, 0)
static char *ppm_devnode(struct device *dev, umode_t *mode)
#else
static char *ppm_devnode(struct device *dev, mode_t *mode)
#endif
#endif /* LINUX_VERSION_CODE > KERNEL_VERSION(3, 3, 0) */
#endif /* LINUX_VERSION_CODE > KERNEL_VERSION(6, 2, 0) */
{
if (mode) {
*mode = 0400;
Expand Down