bpf: Add bpf_copy_from_user_task() helper

This adds a helper for bpf programs to read the memory of other
tasks.

As an example use case at Meta, we are using a bpf task iterator program
and this new helper to print C++ async stack traces for all threads of
a given process.

Signed-off-by: Kenny Yu <kennyyu@fb.com>
Acked-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/r/20220124185403.468466-3-kennyyu@fb.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>

diff --git a/include/linux/bpf.h b/include/linux/bpf.h
index 8c92c974bd12f8f53657e4bccc3cbed11cb41b22..394305a5e02fed778daa2ba087f8837d7ed4a083 100644 (file)
--- a/include/linux/bpf.h
+++ b/include/linux/bpf.h
@@ -2243,6 +2243,7 @@ extern const struct bpf_func_proto bpf_kallsyms_lookup_name_proto;
 extern const struct bpf_func_proto bpf_find_vma_proto;
 extern const struct bpf_func_proto bpf_loop_proto;
 extern const struct bpf_func_proto bpf_strncmp_proto;
+extern const struct bpf_func_proto bpf_copy_from_user_task_proto;
 
 const struct bpf_func_proto *tracing_prog_func_proto(
   enum bpf_func_id func_id, const struct bpf_prog *prog);

diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h
index 16a7574292a53a408f7cdaa0c9afb3e7d8710320..4a2f7041ebae60760c6314b2d615b1ca6a4a5edd 100644 (file)
--- a/include/uapi/linux/bpf.h
+++ b/include/uapi/linux/bpf.h
@@ -5076,6 +5076,16 @@ union bpf_attr {
  *             associated to *xdp_md*, at *offset*.
  *     Return
  *             0 on success, or a negative error in case of failure.
+ *
+ * long bpf_copy_from_user_task(void *dst, u32 size, const void *user_ptr, struct task_struct *tsk, u64 flags)
+ *     Description
+ *             Read *size* bytes from user space address *user_ptr* in *tsk*'s
+ *             address space, and stores the data in *dst*. *flags* is not
+ *             used yet and is provided for future extensibility. This helper
+ *             can only be used by sleepable programs.
+ *     Return
+ *             0 on success, or a negative error in case of failure. On error
+ *             *dst* buffer is zeroed out.
  */
 #define __BPF_FUNC_MAPPER(FN)          \
        FN(unspec),                     \
@@ -5269,6 +5279,7 @@ union bpf_attr {
        FN(xdp_get_buff_len),           \
        FN(xdp_load_bytes),             \
        FN(xdp_store_bytes),            \
+       FN(copy_from_user_task),        \
        /* */
 
 /* integer value in 'imm' field of BPF_CALL instruction selects which helper

diff --git a/kernel/bpf/helpers.c b/kernel/bpf/helpers.c
index 01cfdf40c838c0e538ac895f546695806c47e21b..ed2780b76cc1950aee1c24426b36646d85d70685 100644 (file)
--- a/kernel/bpf/helpers.c
+++ b/kernel/bpf/helpers.c
@@ -16,6 +16,7 @@
 #include <linux/pid_namespace.h>
 #include <linux/proc_ns.h>
 #include <linux/security.h>
+#include <linux/btf_ids.h>
 
 #include "../../lib/kstrtox.h"
 
@@ -671,6 +672,39 @@ const struct bpf_func_proto bpf_copy_from_user_proto = {
        .arg3_type      = ARG_ANYTHING,
 };
 
+BPF_CALL_5(bpf_copy_from_user_task, void *, dst, u32, size,
+          const void __user *, user_ptr, struct task_struct *, tsk, u64, flags)
+{
+       int ret;
+
+       /* flags is not used yet */
+       if (unlikely(flags))
+               return -EINVAL;
+
+       if (unlikely(!size))
+               return 0;
+
+       ret = access_process_vm(tsk, (unsigned long)user_ptr, dst, size, 0);
+       if (ret == size)
+               return 0;
+
+       memset(dst, 0, size);
+       /* Return -EFAULT for partial read */
+       return ret < 0 ? ret : -EFAULT;
+}
+
+const struct bpf_func_proto bpf_copy_from_user_task_proto = {
+       .func           = bpf_copy_from_user_task,
+       .gpl_only       = false,
+       .ret_type       = RET_INTEGER,
+       .arg1_type      = ARG_PTR_TO_UNINIT_MEM,
+       .arg2_type      = ARG_CONST_SIZE_OR_ZERO,
+       .arg3_type      = ARG_ANYTHING,
+       .arg4_type      = ARG_PTR_TO_BTF_ID,
+       .arg4_btf_id    = &btf_tracing_ids[BTF_TRACING_TYPE_TASK],
+       .arg5_type      = ARG_ANYTHING
+};
+
 BPF_CALL_2(bpf_per_cpu_ptr, const void *, ptr, u32, cpu)
 {
        if (cpu >= nr_cpu_ids)

diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
index 06a9e220069ea3d1a620261ea73b6a5e8281fee1..a2024ba32a20dc06a0cc6f914d330cace3ea7281 100644 (file)
--- a/kernel/trace/bpf_trace.c
+++ b/kernel/trace/bpf_trace.c
@@ -1235,6 +1235,8 @@ bpf_tracing_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog)
                return &bpf_get_task_stack_proto;
        case BPF_FUNC_copy_from_user:
                return prog->aux->sleepable ? &bpf_copy_from_user_proto : NULL;
+       case BPF_FUNC_copy_from_user_task:
+               return prog->aux->sleepable ? &bpf_copy_from_user_task_proto : NULL;
        case BPF_FUNC_snprintf_btf:
                return &bpf_snprintf_btf_proto;
        case BPF_FUNC_per_cpu_ptr:

diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h
index 16a7574292a53a408f7cdaa0c9afb3e7d8710320..4a2f7041ebae60760c6314b2d615b1ca6a4a5edd 100644 (file)
--- a/tools/include/uapi/linux/bpf.h
+++ b/tools/include/uapi/linux/bpf.h
@@ -5076,6 +5076,16 @@ union bpf_attr {
  *             associated to *xdp_md*, at *offset*.
  *     Return
  *             0 on success, or a negative error in case of failure.
+ *
+ * long bpf_copy_from_user_task(void *dst, u32 size, const void *user_ptr, struct task_struct *tsk, u64 flags)
+ *     Description
+ *             Read *size* bytes from user space address *user_ptr* in *tsk*'s
+ *             address space, and stores the data in *dst*. *flags* is not
+ *             used yet and is provided for future extensibility. This helper
+ *             can only be used by sleepable programs.
+ *     Return
+ *             0 on success, or a negative error in case of failure. On error
+ *             *dst* buffer is zeroed out.
  */
 #define __BPF_FUNC_MAPPER(FN)          \
        FN(unspec),                     \
@@ -5269,6 +5279,7 @@ union bpf_attr {
        FN(xdp_get_buff_len),           \
        FN(xdp_load_bytes),             \
        FN(xdp_store_bytes),            \
+       FN(copy_from_user_task),        \
        /* */
 
 /* integer value in 'imm' field of BPF_CALL instruction selects which helper