test_varlen.c (3127B)
1// SPDX-License-Identifier: GPL-2.0 2/* Copyright (c) 2020 Facebook */ 3 4#include "vmlinux.h" 5#include <bpf/bpf_helpers.h> 6#include <bpf/bpf_tracing.h> 7#include <bpf/bpf_core_read.h> 8 9#define MAX_LEN 256 10 11char buf_in1[MAX_LEN] = {}; 12char buf_in2[MAX_LEN] = {}; 13 14int test_pid = 0; 15bool capture = false; 16 17/* .bss */ 18__u64 payload1_len1 = 0; 19__u64 payload1_len2 = 0; 20__u64 total1 = 0; 21char payload1[MAX_LEN + MAX_LEN] = {}; 22 23/* .data */ 24int payload2_len1 = -1; 25int payload2_len2 = -1; 26int total2 = -1; 27char payload2[MAX_LEN + MAX_LEN] = { 1 }; 28 29int payload3_len1 = -1; 30int payload3_len2 = -1; 31int total3= -1; 32char payload3[MAX_LEN + MAX_LEN] = { 1 }; 33 34int payload4_len1 = -1; 35int payload4_len2 = -1; 36int total4= -1; 37char payload4[MAX_LEN + MAX_LEN] = { 1 }; 38 39SEC("raw_tp/sys_enter") 40int handler64_unsigned(void *regs) 41{ 42 int pid = bpf_get_current_pid_tgid() >> 32; 43 void *payload = payload1; 44 u64 len; 45 46 /* ignore irrelevant invocations */ 47 if (test_pid != pid || !capture) 48 return 0; 49 50 len = bpf_probe_read_kernel_str(payload, MAX_LEN, &buf_in1[0]); 51 if (len <= MAX_LEN) { 52 payload += len; 53 payload1_len1 = len; 54 } 55 56 len = bpf_probe_read_kernel_str(payload, MAX_LEN, &buf_in2[0]); 57 if (len <= MAX_LEN) { 58 payload += len; 59 payload1_len2 = len; 60 } 61 62 total1 = payload - (void *)payload1; 63 64 return 0; 65} 66 67SEC("raw_tp/sys_exit") 68int handler64_signed(void *regs) 69{ 70 int pid = bpf_get_current_pid_tgid() >> 32; 71 void *payload = payload3; 72 long len; 73 74 /* ignore irrelevant invocations */ 75 if (test_pid != pid || !capture) 76 return 0; 77 78 len = bpf_probe_read_kernel_str(payload, MAX_LEN, &buf_in1[0]); 79 if (len >= 0) { 80 payload += len; 81 payload3_len1 = len; 82 } 83 len = bpf_probe_read_kernel_str(payload, MAX_LEN, &buf_in2[0]); 84 if (len >= 0) { 85 payload += len; 86 payload3_len2 = len; 87 } 88 total3 = payload - (void *)payload3; 89 90 return 0; 91} 92 93SEC("tp/raw_syscalls/sys_enter") 94int handler32_unsigned(void *regs) 95{ 96 int pid = bpf_get_current_pid_tgid() >> 32; 97 void *payload = payload2; 98 u32 len; 99 100 /* ignore irrelevant invocations */ 101 if (test_pid != pid || !capture) 102 return 0; 103 104 len = bpf_probe_read_kernel_str(payload, MAX_LEN, &buf_in1[0]); 105 if (len <= MAX_LEN) { 106 payload += len; 107 payload2_len1 = len; 108 } 109 110 len = bpf_probe_read_kernel_str(payload, MAX_LEN, &buf_in2[0]); 111 if (len <= MAX_LEN) { 112 payload += len; 113 payload2_len2 = len; 114 } 115 116 total2 = payload - (void *)payload2; 117 118 return 0; 119} 120 121SEC("tp/raw_syscalls/sys_exit") 122int handler32_signed(void *regs) 123{ 124 int pid = bpf_get_current_pid_tgid() >> 32; 125 void *payload = payload4; 126 int len; 127 128 /* ignore irrelevant invocations */ 129 if (test_pid != pid || !capture) 130 return 0; 131 132 len = bpf_probe_read_kernel_str(payload, MAX_LEN, &buf_in1[0]); 133 if (len >= 0) { 134 payload += len; 135 payload4_len1 = len; 136 } 137 len = bpf_probe_read_kernel_str(payload, MAX_LEN, &buf_in2[0]); 138 if (len >= 0) { 139 payload += len; 140 payload4_len2 = len; 141 } 142 total4 = payload - (void *)payload4; 143 144 return 0; 145} 146 147SEC("tp/syscalls/sys_exit_getpid") 148int handler_exit(void *regs) 149{ 150 long bla; 151 152 if (bpf_probe_read_kernel(&bla, sizeof(bla), 0)) 153 return 1; 154 else 155 return 0; 156} 157 158char LICENSE[] SEC("license") = "GPL";