summaryrefslogtreecommitdiffstats
path: root/include/uapi/linux/bpf.h
diff options
context:
space:
mode:
authorSargun Dhillon2016-07-25 14:54:46 +0200
committerDavid S. Miller2016-07-26 03:07:48 +0200
commit96ae52279594470622ff0585621a13e96b700600 (patch)
tree72b6be55be49c626dfd6d1b1ac2673b4a0cd649b /include/uapi/linux/bpf.h
parentnet/mlx4_core: Check device state before unregistering it (diff)
downloadkernel-qcow2-linux-96ae52279594470622ff0585621a13e96b700600.tar.gz
kernel-qcow2-linux-96ae52279594470622ff0585621a13e96b700600.tar.xz
kernel-qcow2-linux-96ae52279594470622ff0585621a13e96b700600.zip
bpf: Add bpf_probe_write_user BPF helper to be called in tracers
This allows user memory to be written to during the course of a kprobe. It shouldn't be used to implement any kind of security mechanism because of TOC-TOU attacks, but rather to debug, divert, and manipulate execution of semi-cooperative processes. Although it uses probe_kernel_write, we limit the address space the probe can write into by checking the space with access_ok. We do this as opposed to calling copy_to_user directly, in order to avoid sleeping. In addition we ensure the threads's current fs / segment is USER_DS and the thread isn't exiting nor a kernel thread. Given this feature is meant for experiments, and it has a risk of crashing the system, and running programs, we print a warning on when a proglet that attempts to use this helper is installed, along with the pid and process name. Signed-off-by: Sargun Dhillon <sargun@sargun.me> Cc: Alexei Starovoitov <ast@kernel.org> Cc: Daniel Borkmann <daniel@iogearbox.net> Acked-by: Alexei Starovoitov <ast@kernel.org> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'include/uapi/linux/bpf.h')
-rw-r--r--include/uapi/linux/bpf.h10
1 files changed, 10 insertions, 0 deletions
diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h
index 2b7076f5b5ad..da218fec6056 100644
--- a/include/uapi/linux/bpf.h
+++ b/include/uapi/linux/bpf.h
@@ -365,6 +365,16 @@ enum bpf_func_id {
*/
BPF_FUNC_get_current_task,
+ /**
+ * bpf_probe_write_user(void *dst, void *src, int len)
+ * safely attempt to write to a location
+ * @dst: destination address in userspace
+ * @src: source address on stack
+ * @len: number of bytes to copy
+ * Return: 0 on success or negative error
+ */
+ BPF_FUNC_probe_write_user,
+
__BPF_FUNC_MAX_ID,
};