1 // SPDX-License-Identifier: GPL-2.0
2 /* Copyright (c) 2020 Facebook */
5 #include <bpf/bpf_helpers.h>
6 #include <bpf/bpf_tracing.h>
7 #include <bpf/bpf_core_read.h>
11 char buf_in1[MAX_LEN] = {};
12 char buf_in2[MAX_LEN] = {};
18 __u64 payload1_len1 = 0;
19 __u64 payload1_len2 = 0;
21 char payload1[MAX_LEN + MAX_LEN] = {};
22 __u64 ret_bad_read = 0;
25 int payload2_len1 = -1;
26 int payload2_len2 = -1;
28 char payload2[MAX_LEN + MAX_LEN] = { 1 };
30 int payload3_len1 = -1;
31 int payload3_len2 = -1;
33 char payload3[MAX_LEN + MAX_LEN] = { 1 };
35 int payload4_len1 = -1;
36 int payload4_len2 = -1;
38 char payload4[MAX_LEN + MAX_LEN] = { 1 };
40 char payload_bad[5] = { 0x42, 0x42, 0x42, 0x42, 0x42 };
42 SEC("raw_tp/sys_enter")
43 int handler64_unsigned(void *regs)
45 int pid = bpf_get_current_pid_tgid() >> 32;
46 void *payload = payload1;
49 /* ignore irrelevant invocations */
50 if (test_pid != pid || !capture)
53 len = bpf_probe_read_kernel_str(payload, MAX_LEN, &buf_in1[0]);
59 len = bpf_probe_read_kernel_str(payload, MAX_LEN, &buf_in2[0]);
65 total1 = payload - (void *)payload1;
67 ret_bad_read = bpf_probe_read_kernel_str(payload_bad + 2, 1, (void *) -1);
72 SEC("raw_tp/sys_exit")
73 int handler64_signed(void *regs)
75 int pid = bpf_get_current_pid_tgid() >> 32;
76 void *payload = payload3;
79 /* ignore irrelevant invocations */
80 if (test_pid != pid || !capture)
83 len = bpf_probe_read_kernel_str(payload, MAX_LEN, &buf_in1[0]);
88 len = bpf_probe_read_kernel_str(payload, MAX_LEN, &buf_in2[0]);
93 total3 = payload - (void *)payload3;
98 SEC("tp/raw_syscalls/sys_enter")
99 int handler32_unsigned(void *regs)
101 int pid = bpf_get_current_pid_tgid() >> 32;
102 void *payload = payload2;
105 /* ignore irrelevant invocations */
106 if (test_pid != pid || !capture)
109 len = bpf_probe_read_kernel_str(payload, MAX_LEN, &buf_in1[0]);
110 if (len <= MAX_LEN) {
115 len = bpf_probe_read_kernel_str(payload, MAX_LEN, &buf_in2[0]);
116 if (len <= MAX_LEN) {
121 total2 = payload - (void *)payload2;
126 SEC("tp/raw_syscalls/sys_exit")
127 int handler32_signed(void *regs)
129 int pid = bpf_get_current_pid_tgid() >> 32;
130 void *payload = payload4;
133 /* ignore irrelevant invocations */
134 if (test_pid != pid || !capture)
137 len = bpf_probe_read_kernel_str(payload, MAX_LEN, &buf_in1[0]);
142 len = bpf_probe_read_kernel_str(payload, MAX_LEN, &buf_in2[0]);
147 total4 = payload - (void *)payload4;
152 SEC("tp/syscalls/sys_exit_getpid")
153 int handler_exit(void *regs)
157 if (bpf_probe_read_kernel(&bla, sizeof(bla), 0))
163 char LICENSE[] SEC("license") = "GPL";