From 3d3f598b5c0bcb4e2cf020e0e3f58debfa05623e Mon Sep 17 00:00:00 2001 From: Martin Cermak Date: Tue, 3 Jan 2017 10:09:11 +0100 Subject: [PATCH] PR20333/socketpair --- tapset/linux/nd_syscalls2.stp | 82 ------------------- tapset/linux/sysc_socketpair.stp | 135 +++++++++++++++++++++++++++++++ tapset/linux/syscalls2.stp | 64 --------------- 3 files changed, 135 insertions(+), 146 deletions(-) create mode 100644 tapset/linux/sysc_socketpair.stp diff --git a/tapset/linux/nd_syscalls2.stp b/tapset/linux/nd_syscalls2.stp index 652b4f319..af3b1a401 100644 --- a/tapset/linux/nd_syscalls2.stp +++ b/tapset/linux/nd_syscalls2.stp @@ -1,86 +1,4 @@ -# commented out because this seems redundant -# socketcall _________________________________________________ -# -# long sys_socketcall(int call, unsigned long __user *args) -# -#probe nd_syscall.socketcall = kprobe.function("sys_socketcall") ? -#{ -# name = "socketcall" -# call = $call -# args_uaddr = $args -# argstr = sprintf("%d, %p", $call, args_uaddr) -#} -#probe nd_syscall.socketcall.return = kprobe.function("sys_socketcall").return ? -#{ -# name = "socketcall" -# retstr = returnstr(1) -#} - -# socketpair _________________________________________________ -# long sys_socketpair(int family, -# int type, -# int protocol, -# int __user *usockvec) -# -probe nd_syscall.socketpair = __nd_syscall.socketpair ?, - __nd_syscall.socketcall.socketpair ?, - __nd_syscall.compat_socketcall.socketpair ? -{ - name = "socketpair" - asmlinkage() - argstr = sprintf("%s, %s, %s, %p", _sock_family_str(family), - _sock_type_str(type), - _sock_protocol_str(family, protocol), sv_uaddr) -} -probe __nd_syscall.socketpair = kprobe.function("sys_socketpair") ? -{ - @__syscall_gate(@const("__NR_socketpair")) - asmlinkage() - family = int_arg(1) - type = int_arg(2) - protocol = int_arg(3) - sv_uaddr = pointer_arg(4) -} -probe __nd_syscall.socketcall.socketpair = - kprobe.function("sys_socketcall").call ? -{ - asmlinkage() - if (int_arg(1) != @const("SYS_SOCKETPAIR")) next; - __args = &@cast(pointer_arg(2), "ulong", "kernel") - family = __int32(user_ulong(&(__args)[0])) - type = __int32(user_ulong(&(__args)[1])) - protocol = __int32(user_ulong(&(__args)[2])) - sv_uaddr = user_ulong(&(__args)[3]) -} -probe __nd_syscall.compat_socketcall.socketpair = - kprobe.function("compat_sys_socketcall").call ? -{ - asmlinkage() - if (int_arg(1) != @const("SYS_SOCKETPAIR")) next; - __args = &@cast(pointer_arg(2), "unsigned int", "kernel") - family = user_int(&(__args)[0]) - type = user_int(&(__args)[1]) - protocol = user_int(&(__args)[2]) - sv_uaddr = user_uint32(&(__args)[3]) -} -probe nd_syscall.socketpair.return = __nd_syscall.socketpair.return ?, - __nd_syscall.socketcall.socketpair.return ? -{ - name = "socketpair" - retstr = returnstr(1) -} -probe __nd_syscall.socketpair.return = kprobe.function("sys_socketpair").return ? -{ - @__syscall_gate(@const("__NR_socketpair")) -} -probe __nd_syscall.socketcall.socketpair.return = - kprobe.function("sys_socketcall").return ?, - kprobe.function("compat_sys_socketcall").return ? -{ - if (@entry(__asmlinkage_int_arg(1)) != @const("SYS_SOCKETPAIR")) next; -} - # splice ___________________________________________________ # # long sys_splice(int fd_in, loff_t __user *off_in, diff --git a/tapset/linux/sysc_socketpair.stp b/tapset/linux/sysc_socketpair.stp new file mode 100644 index 000000000..2c1938eb4 --- /dev/null +++ b/tapset/linux/sysc_socketpair.stp @@ -0,0 +1,135 @@ +# socketpair _________________________________________________ +# long sys_socketpair(int family, +# int type, +# int protocol, +# int __user *usockvec) +# + +@define _SYSCALL_SOCKETPAIR_NAME +%( + name = "socketpair" +%) + +@define _SYSCALL_SOCKETPAIR_ARGSTR +%( + argstr = sprintf("%s, %s, %s, %p", family_str, type_str, + protocol_str, sv_uaddr) +%) + +probe syscall.socketpair = dw_syscall.socketpair !, nd_syscall.socketpair {} +probe syscall.socketpair.return = dw_syscall.socketpair.return !, nd_syscall.socketpair.return {} + +# dw_socketpair _____________________________________________________ + +probe dw_syscall.socketpair = __syscall.socketpair ?, + __syscall.socketcall.socketpair ?, + __syscall.compat_socketcall.socketpair ? +{ + @_SYSCALL_SOCKETPAIR_NAME + family_str = _sock_family_str(family) + type_str = _sock_type_str(type) + protocol_str = _sock_protocol_str(family, protocol) + @_SYSCALL_SOCKETPAIR_ARGSTR +} +probe __syscall.socketpair = kernel.function("sys_socketpair").call ? +{ + @__syscall_gate(@const("__NR_socketpair")) + family = __int32($family) + type = __int32($type) + protocol = __int32($protocol) + sv_uaddr = $usockvec +} +probe __syscall.socketcall.socketpair = kernel.function("sys_socketcall").call ? +{ + if ($call != @const("SYS_SOCKETPAIR")) next; + family = __int32(user_ulong(&@cast($args, "ulong")[0])) + type = __int32(user_ulong(&@cast($args, "ulong")[1])) + protocol = __int32(user_ulong(&@cast($args, "ulong")[2])) + sv_uaddr = __uint32(user_ulong(&@cast($args, "ulong")[3])) +} +probe __syscall.compat_socketcall.socketpair = + kernel.function("compat_sys_socketcall").call ? +{ + if ($call != @const("SYS_SOCKETPAIR")) next; + family = user_int(&@cast($args, "unsigned int")[0]) + type = user_int(&@cast($args, "unsigned int")[1]) + protocol = user_int(&@cast($args, "unsigned int")[2]) + sv_uaddr = user_uint32(&@cast($args, "unsigned int")[3]) +} +probe dw_syscall.socketpair.return = __syscall.socketpair.return ?, + __syscall.socketcall.socketpair.return ? +{ + @_SYSCALL_SOCKETPAIR_NAME + retstr = return_str(1, $return) +} +probe __syscall.socketpair.return = kernel.function("sys_socketpair").return ? +{ + @__syscall_gate(@const("__NR_socketpair")) +} +probe __syscall.socketcall.socketpair.return = + kernel.function("sys_socketcall").return ?, + kernel.function("compat_sys_socketcall").return ? +{ + if (@entry($call) != @const("SYS_SOCKETPAIR")) next; +} + +# nd_socketpair _____________________________________________________ + +probe nd_syscall.socketpair = __nd_syscall.socketpair ?, + __nd_syscall.socketcall.socketpair ?, + __nd_syscall.compat_socketcall.socketpair ? +{ + @_SYSCALL_SOCKETPAIR_NAME + asmlinkage() + family_str = _sock_family_str(family) + type_str = _sock_type_str(type) + protocol_str = _sock_protocol_str(family, protocol) + @_SYSCALL_SOCKETPAIR_ARGSTR +} +probe __nd_syscall.socketpair = kprobe.function("sys_socketpair") ? +{ + @__syscall_gate(@const("__NR_socketpair")) + asmlinkage() + family = int_arg(1) + type = int_arg(2) + protocol = int_arg(3) + sv_uaddr = pointer_arg(4) +} +probe __nd_syscall.socketcall.socketpair = + kprobe.function("sys_socketcall").call ? +{ + asmlinkage() + if (int_arg(1) != @const("SYS_SOCKETPAIR")) next; + __args = &@cast(pointer_arg(2), "ulong", "kernel") + family = __int32(user_ulong(&(__args)[0])) + type = __int32(user_ulong(&(__args)[1])) + protocol = __int32(user_ulong(&(__args)[2])) + sv_uaddr = user_ulong(&(__args)[3]) +} +probe __nd_syscall.compat_socketcall.socketpair = + kprobe.function("compat_sys_socketcall").call ? +{ + asmlinkage() + if (int_arg(1) != @const("SYS_SOCKETPAIR")) next; + __args = &@cast(pointer_arg(2), "unsigned int", "kernel") + family = user_int(&(__args)[0]) + type = user_int(&(__args)[1]) + protocol = user_int(&(__args)[2]) + sv_uaddr = user_uint32(&(__args)[3]) +} +probe nd_syscall.socketpair.return = __nd_syscall.socketpair.return ?, + __nd_syscall.socketcall.socketpair.return ? +{ + @_SYSCALL_SOCKETPAIR_NAME + retstr = returnstr(1) +} +probe __nd_syscall.socketpair.return = kprobe.function("sys_socketpair").return ? +{ + @__syscall_gate(@const("__NR_socketpair")) +} +probe __nd_syscall.socketcall.socketpair.return = + kprobe.function("sys_socketcall").return ?, + kprobe.function("compat_sys_socketcall").return ? +{ + if (@entry(__asmlinkage_int_arg(1)) != @const("SYS_SOCKETPAIR")) next; +} diff --git a/tapset/linux/syscalls2.stp b/tapset/linux/syscalls2.stp index 430222fd0..79f7931bd 100644 --- a/tapset/linux/syscalls2.stp +++ b/tapset/linux/syscalls2.stp @@ -1,68 +1,4 @@ -# socketcall _________________________________________________ -# -# long sys_socketcall(int call, unsigned long __user *args) -# -# Note that we don't handle socketcall directly. socketcall() is just -# a multiplexer for other syscalls (accept, bind, socket, etc.). - -# socketpair _________________________________________________ -# long sys_socketpair(int family, -# int type, -# int protocol, -# int __user *usockvec) -# -probe syscall.socketpair = __syscall.socketpair ?, - __syscall.socketcall.socketpair ?, - __syscall.compat_socketcall.socketpair ? -{ - name = "socketpair" - argstr = sprintf("%s, %s, %s, %p", _sock_family_str(family), - _sock_type_str(type), - _sock_protocol_str(family, protocol), sv_uaddr) -} -probe __syscall.socketpair = kernel.function("sys_socketpair").call ? -{ - @__syscall_gate(@const("__NR_socketpair")) - family = __int32($family) - type = __int32($type) - protocol = __int32($protocol) - sv_uaddr = $usockvec -} -probe __syscall.socketcall.socketpair = kernel.function("sys_socketcall").call ? -{ - if ($call != @const("SYS_SOCKETPAIR")) next; - family = __int32(user_ulong(&@cast($args, "ulong")[0])) - type = __int32(user_ulong(&@cast($args, "ulong")[1])) - protocol = __int32(user_ulong(&@cast($args, "ulong")[2])) - sv_uaddr = __uint32(user_ulong(&@cast($args, "ulong")[3])) -} -probe __syscall.compat_socketcall.socketpair = - kernel.function("compat_sys_socketcall").call ? -{ - if ($call != @const("SYS_SOCKETPAIR")) next; - family = user_int(&@cast($args, "unsigned int")[0]) - type = user_int(&@cast($args, "unsigned int")[1]) - protocol = user_int(&@cast($args, "unsigned int")[2]) - sv_uaddr = user_uint32(&@cast($args, "unsigned int")[3]) -} -probe syscall.socketpair.return = __syscall.socketpair.return ?, - __syscall.socketcall.socketpair.return ? -{ - name = "socketpair" - retstr = return_str(1, $return) -} -probe __syscall.socketpair.return = kernel.function("sys_socketpair").return ? -{ - @__syscall_gate(@const("__NR_socketpair")) -} -probe __syscall.socketcall.socketpair.return = - kernel.function("sys_socketcall").return ?, - kernel.function("compat_sys_socketcall").return ? -{ - if (@entry($call) != @const("SYS_SOCKETPAIR")) next; -} - # splice ___________________________________________________ # # long sys_splice(int fd_in, loff_t __user *off_in, -- 2.43.5