]> Git Repo - linux.git/commit
bpf: Add bpf_probe_write_user BPF helper to be called in tracers
authorSargun Dhillon <[email protected]>
Mon, 25 Jul 2016 12:54:46 +0000 (05:54 -0700)
committerDavid S. Miller <[email protected]>
Tue, 26 Jul 2016 01:07:48 +0000 (18:07 -0700)
commit96ae52279594470622ff0585621a13e96b700600
tree72b6be55be49c626dfd6d1b1ac2673b4a0cd649b
parent9b022a6e0f26af108b9105b16b310393c898d9bd
bpf: Add bpf_probe_write_user BPF helper to be called in tracers

This allows user memory to be written to during the course of a kprobe.
It shouldn't be used to implement any kind of security mechanism
because of TOC-TOU attacks, but rather to debug, divert, and
manipulate execution of semi-cooperative processes.

Although it uses probe_kernel_write, we limit the address space
the probe can write into by checking the space with access_ok.
We do this as opposed to calling copy_to_user directly, in order
to avoid sleeping. In addition we ensure the threads's current fs
/ segment is USER_DS and the thread isn't exiting nor a kernel thread.

Given this feature is meant for experiments, and it has a risk of
crashing the system, and running programs, we print a warning on
when a proglet that attempts to use this helper is installed,
along with the pid and process name.

Signed-off-by: Sargun Dhillon <[email protected]>
Cc: Alexei Starovoitov <[email protected]>
Cc: Daniel Borkmann <[email protected]>
Acked-by: Alexei Starovoitov <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
include/uapi/linux/bpf.h
kernel/trace/bpf_trace.c
samples/bpf/bpf_helpers.h
This page took 0.056136 seconds and 4 git commands to generate.