1// SPDX-License-Identifier: GPL-2.0-only
2/* Copyright (c) 2020 Facebook */
3
4#include <linux/init.h>
5#include <linux/namei.h>
6#include <linux/pid_namespace.h>
7#include <linux/fs.h>
8#include <linux/filter.h>
9#include <linux/bpf_mem_alloc.h>
10#include <linux/btf_ids.h>
11#include <linux/mm_types.h>
12#include "mmap_unlock_work.h"
13
14static const char * const iter_task_type_names[] = {
15 "ALL",
16 "TID",
17 "PID",
18};
19
20struct bpf_iter_seq_task_common {
21 struct pid_namespace *ns;
22 enum bpf_iter_task_type type;
23 u32 pid;
24 u32 pid_visiting;
25};
26
27struct bpf_iter_seq_task_info {
28 /* The first field must be struct bpf_iter_seq_task_common.
29 * this is assumed by {init, fini}_seq_pidns() callback functions.
30 */
31 struct bpf_iter_seq_task_common common;
32 u32 tid;
33};
34
35static struct task_struct *task_group_seq_get_next(struct bpf_iter_seq_task_common *common,
36 u32 *tid,
37 bool skip_if_dup_files)
38{
39 struct task_struct *task;
40 struct pid *pid;
41 u32 next_tid;
42
43 if (!*tid) {
44 /* The first time, the iterator calls this function. */
45 pid = find_pid_ns(nr: common->pid, ns: common->ns);
46 task = get_pid_task(pid, PIDTYPE_TGID);
47 if (!task)
48 return NULL;
49
50 *tid = common->pid;
51 common->pid_visiting = common->pid;
52
53 return task;
54 }
55
56 /* If the control returns to user space and comes back to the
57 * kernel again, *tid and common->pid_visiting should be the
58 * same for task_seq_start() to pick up the correct task.
59 */
60 if (*tid == common->pid_visiting) {
61 pid = find_pid_ns(nr: common->pid_visiting, ns: common->ns);
62 task = get_pid_task(pid, PIDTYPE_PID);
63
64 return task;
65 }
66
67 task = find_task_by_pid_ns(nr: common->pid_visiting, ns: common->ns);
68 if (!task)
69 return NULL;
70
71retry:
72 task = __next_thread(p: task);
73 if (!task)
74 return NULL;
75
76 next_tid = __task_pid_nr_ns(task, type: PIDTYPE_PID, ns: common->ns);
77 if (!next_tid)
78 goto retry;
79
80 if (skip_if_dup_files && task->files == task->group_leader->files)
81 goto retry;
82
83 *tid = common->pid_visiting = next_tid;
84 get_task_struct(t: task);
85 return task;
86}
87
88static struct task_struct *task_seq_get_next(struct bpf_iter_seq_task_common *common,
89 u32 *tid,
90 bool skip_if_dup_files)
91{
92 struct task_struct *task = NULL;
93 struct pid *pid;
94
95 if (common->type == BPF_TASK_ITER_TID) {
96 if (*tid && *tid != common->pid)
97 return NULL;
98 rcu_read_lock();
99 pid = find_pid_ns(nr: common->pid, ns: common->ns);
100 if (pid) {
101 task = get_pid_task(pid, PIDTYPE_PID);
102 *tid = common->pid;
103 }
104 rcu_read_unlock();
105
106 return task;
107 }
108
109 if (common->type == BPF_TASK_ITER_TGID) {
110 rcu_read_lock();
111 task = task_group_seq_get_next(common, tid, skip_if_dup_files);
112 rcu_read_unlock();
113
114 return task;
115 }
116
117 rcu_read_lock();
118retry:
119 pid = find_ge_pid(nr: *tid, common->ns);
120 if (pid) {
121 *tid = pid_nr_ns(pid, ns: common->ns);
122 task = get_pid_task(pid, PIDTYPE_PID);
123 if (!task) {
124 ++*tid;
125 goto retry;
126 } else if (skip_if_dup_files && !thread_group_leader(p: task) &&
127 task->files == task->group_leader->files) {
128 put_task_struct(t: task);
129 task = NULL;
130 ++*tid;
131 goto retry;
132 }
133 }
134 rcu_read_unlock();
135
136 return task;
137}
138
139static void *task_seq_start(struct seq_file *seq, loff_t *pos)
140{
141 struct bpf_iter_seq_task_info *info = seq->private;
142 struct task_struct *task;
143
144 task = task_seq_get_next(common: &info->common, tid: &info->tid, skip_if_dup_files: false);
145 if (!task)
146 return NULL;
147
148 if (*pos == 0)
149 ++*pos;
150 return task;
151}
152
153static void *task_seq_next(struct seq_file *seq, void *v, loff_t *pos)
154{
155 struct bpf_iter_seq_task_info *info = seq->private;
156 struct task_struct *task;
157
158 ++*pos;
159 ++info->tid;
160 put_task_struct(t: (struct task_struct *)v);
161 task = task_seq_get_next(common: &info->common, tid: &info->tid, skip_if_dup_files: false);
162 if (!task)
163 return NULL;
164
165 return task;
166}
167
168struct bpf_iter__task {
169 __bpf_md_ptr(struct bpf_iter_meta *, meta);
170 __bpf_md_ptr(struct task_struct *, task);
171};
172
173DEFINE_BPF_ITER_FUNC(task, struct bpf_iter_meta *meta, struct task_struct *task)
174
175static int __task_seq_show(struct seq_file *seq, struct task_struct *task,
176 bool in_stop)
177{
178 struct bpf_iter_meta meta;
179 struct bpf_iter__task ctx;
180 struct bpf_prog *prog;
181
182 meta.seq = seq;
183 prog = bpf_iter_get_info(meta: &meta, in_stop);
184 if (!prog)
185 return 0;
186
187 ctx.meta = &meta;
188 ctx.task = task;
189 return bpf_iter_run_prog(prog, ctx: &ctx);
190}
191
192static int task_seq_show(struct seq_file *seq, void *v)
193{
194 return __task_seq_show(seq, task: v, in_stop: false);
195}
196
197static void task_seq_stop(struct seq_file *seq, void *v)
198{
199 if (!v)
200 (void)__task_seq_show(seq, task: v, in_stop: true);
201 else
202 put_task_struct(t: (struct task_struct *)v);
203}
204
205static int bpf_iter_attach_task(struct bpf_prog *prog,
206 union bpf_iter_link_info *linfo,
207 struct bpf_iter_aux_info *aux)
208{
209 unsigned int flags;
210 struct pid *pid;
211 pid_t tgid;
212
213 if ((!!linfo->task.tid + !!linfo->task.pid + !!linfo->task.pid_fd) > 1)
214 return -EINVAL;
215
216 aux->task.type = BPF_TASK_ITER_ALL;
217 if (linfo->task.tid != 0) {
218 aux->task.type = BPF_TASK_ITER_TID;
219 aux->task.pid = linfo->task.tid;
220 }
221 if (linfo->task.pid != 0) {
222 aux->task.type = BPF_TASK_ITER_TGID;
223 aux->task.pid = linfo->task.pid;
224 }
225 if (linfo->task.pid_fd != 0) {
226 aux->task.type = BPF_TASK_ITER_TGID;
227
228 pid = pidfd_get_pid(fd: linfo->task.pid_fd, flags: &flags);
229 if (IS_ERR(ptr: pid))
230 return PTR_ERR(ptr: pid);
231
232 tgid = pid_nr_ns(pid, ns: task_active_pid_ns(current));
233 aux->task.pid = tgid;
234 put_pid(pid);
235 }
236
237 return 0;
238}
239
240static const struct seq_operations task_seq_ops = {
241 .start = task_seq_start,
242 .next = task_seq_next,
243 .stop = task_seq_stop,
244 .show = task_seq_show,
245};
246
247struct bpf_iter_seq_task_file_info {
248 /* The first field must be struct bpf_iter_seq_task_common.
249 * this is assumed by {init, fini}_seq_pidns() callback functions.
250 */
251 struct bpf_iter_seq_task_common common;
252 struct task_struct *task;
253 u32 tid;
254 u32 fd;
255};
256
257static struct file *
258task_file_seq_get_next(struct bpf_iter_seq_task_file_info *info)
259{
260 u32 saved_tid = info->tid;
261 struct task_struct *curr_task;
262 unsigned int curr_fd = info->fd;
263 struct file *f;
264
265 /* If this function returns a non-NULL file object,
266 * it held a reference to the task/file.
267 * Otherwise, it does not hold any reference.
268 */
269again:
270 if (info->task) {
271 curr_task = info->task;
272 curr_fd = info->fd;
273 } else {
274 curr_task = task_seq_get_next(common: &info->common, tid: &info->tid, skip_if_dup_files: true);
275 if (!curr_task) {
276 info->task = NULL;
277 return NULL;
278 }
279
280 /* set info->task */
281 info->task = curr_task;
282 if (saved_tid == info->tid)
283 curr_fd = info->fd;
284 else
285 curr_fd = 0;
286 }
287
288 f = fget_task_next(task: curr_task, fd: &curr_fd);
289 if (f) {
290 /* set info->fd */
291 info->fd = curr_fd;
292 return f;
293 }
294
295 /* the current task is done, go to the next task */
296 put_task_struct(t: curr_task);
297
298 if (info->common.type == BPF_TASK_ITER_TID) {
299 info->task = NULL;
300 return NULL;
301 }
302
303 info->task = NULL;
304 info->fd = 0;
305 saved_tid = ++(info->tid);
306 goto again;
307}
308
309static void *task_file_seq_start(struct seq_file *seq, loff_t *pos)
310{
311 struct bpf_iter_seq_task_file_info *info = seq->private;
312 struct file *file;
313
314 info->task = NULL;
315 file = task_file_seq_get_next(info);
316 if (file && *pos == 0)
317 ++*pos;
318
319 return file;
320}
321
322static void *task_file_seq_next(struct seq_file *seq, void *v, loff_t *pos)
323{
324 struct bpf_iter_seq_task_file_info *info = seq->private;
325
326 ++*pos;
327 ++info->fd;
328 fput((struct file *)v);
329 return task_file_seq_get_next(info);
330}
331
332struct bpf_iter__task_file {
333 __bpf_md_ptr(struct bpf_iter_meta *, meta);
334 __bpf_md_ptr(struct task_struct *, task);
335 u32 fd __aligned(8);
336 __bpf_md_ptr(struct file *, file);
337};
338
339DEFINE_BPF_ITER_FUNC(task_file, struct bpf_iter_meta *meta,
340 struct task_struct *task, u32 fd,
341 struct file *file)
342
343static int __task_file_seq_show(struct seq_file *seq, struct file *file,
344 bool in_stop)
345{
346 struct bpf_iter_seq_task_file_info *info = seq->private;
347 struct bpf_iter__task_file ctx;
348 struct bpf_iter_meta meta;
349 struct bpf_prog *prog;
350
351 meta.seq = seq;
352 prog = bpf_iter_get_info(meta: &meta, in_stop);
353 if (!prog)
354 return 0;
355
356 ctx.meta = &meta;
357 ctx.task = info->task;
358 ctx.fd = info->fd;
359 ctx.file = file;
360 return bpf_iter_run_prog(prog, ctx: &ctx);
361}
362
363static int task_file_seq_show(struct seq_file *seq, void *v)
364{
365 return __task_file_seq_show(seq, file: v, in_stop: false);
366}
367
368static void task_file_seq_stop(struct seq_file *seq, void *v)
369{
370 struct bpf_iter_seq_task_file_info *info = seq->private;
371
372 if (!v) {
373 (void)__task_file_seq_show(seq, file: v, in_stop: true);
374 } else {
375 fput((struct file *)v);
376 put_task_struct(t: info->task);
377 info->task = NULL;
378 }
379}
380
381static int init_seq_pidns(void *priv_data, struct bpf_iter_aux_info *aux)
382{
383 struct bpf_iter_seq_task_common *common = priv_data;
384
385 common->ns = get_pid_ns(ns: task_active_pid_ns(current));
386 common->type = aux->task.type;
387 common->pid = aux->task.pid;
388
389 return 0;
390}
391
392static void fini_seq_pidns(void *priv_data)
393{
394 struct bpf_iter_seq_task_common *common = priv_data;
395
396 put_pid_ns(ns: common->ns);
397}
398
399static const struct seq_operations task_file_seq_ops = {
400 .start = task_file_seq_start,
401 .next = task_file_seq_next,
402 .stop = task_file_seq_stop,
403 .show = task_file_seq_show,
404};
405
406struct bpf_iter_seq_task_vma_info {
407 /* The first field must be struct bpf_iter_seq_task_common.
408 * this is assumed by {init, fini}_seq_pidns() callback functions.
409 */
410 struct bpf_iter_seq_task_common common;
411 struct task_struct *task;
412 struct mm_struct *mm;
413 struct vm_area_struct *vma;
414 u32 tid;
415 unsigned long prev_vm_start;
416 unsigned long prev_vm_end;
417};
418
419enum bpf_task_vma_iter_find_op {
420 task_vma_iter_first_vma, /* use find_vma() with addr 0 */
421 task_vma_iter_next_vma, /* use vma_next() with curr_vma */
422 task_vma_iter_find_vma, /* use find_vma() to find next vma */
423};
424
425static struct vm_area_struct *
426task_vma_seq_get_next(struct bpf_iter_seq_task_vma_info *info)
427{
428 enum bpf_task_vma_iter_find_op op;
429 struct vm_area_struct *curr_vma;
430 struct task_struct *curr_task;
431 struct mm_struct *curr_mm;
432 u32 saved_tid = info->tid;
433
434 /* If this function returns a non-NULL vma, it holds a reference to
435 * the task_struct, holds a refcount on mm->mm_users, and holds
436 * read lock on vma->mm->mmap_lock.
437 * If this function returns NULL, it does not hold any reference or
438 * lock.
439 */
440 if (info->task) {
441 curr_task = info->task;
442 curr_vma = info->vma;
443 curr_mm = info->mm;
444 /* In case of lock contention, drop mmap_lock to unblock
445 * the writer.
446 *
447 * After relock, call find(mm, prev_vm_end - 1) to find
448 * new vma to process.
449 *
450 * +------+------+-----------+
451 * | VMA1 | VMA2 | VMA3 |
452 * +------+------+-----------+
453 * | | | |
454 * 4k 8k 16k 400k
455 *
456 * For example, curr_vma == VMA2. Before unlock, we set
457 *
458 * prev_vm_start = 8k
459 * prev_vm_end = 16k
460 *
461 * There are a few cases:
462 *
463 * 1) VMA2 is freed, but VMA3 exists.
464 *
465 * find_vma() will return VMA3, just process VMA3.
466 *
467 * 2) VMA2 still exists.
468 *
469 * find_vma() will return VMA2, process VMA2->next.
470 *
471 * 3) no more vma in this mm.
472 *
473 * Process the next task.
474 *
475 * 4) find_vma() returns a different vma, VMA2'.
476 *
477 * 4.1) If VMA2 covers same range as VMA2', skip VMA2',
478 * because we already covered the range;
479 * 4.2) VMA2 and VMA2' covers different ranges, process
480 * VMA2'.
481 */
482 if (mmap_lock_is_contended(mm: curr_mm)) {
483 info->prev_vm_start = curr_vma->vm_start;
484 info->prev_vm_end = curr_vma->vm_end;
485 op = task_vma_iter_find_vma;
486 mmap_read_unlock(mm: curr_mm);
487 if (mmap_read_lock_killable(mm: curr_mm)) {
488 mmput(curr_mm);
489 goto finish;
490 }
491 } else {
492 op = task_vma_iter_next_vma;
493 }
494 } else {
495again:
496 curr_task = task_seq_get_next(common: &info->common, tid: &info->tid, skip_if_dup_files: true);
497 if (!curr_task) {
498 info->tid++;
499 goto finish;
500 }
501
502 if (saved_tid != info->tid) {
503 /* new task, process the first vma */
504 op = task_vma_iter_first_vma;
505 } else {
506 /* Found the same tid, which means the user space
507 * finished data in previous buffer and read more.
508 * We dropped mmap_lock before returning to user
509 * space, so it is necessary to use find_vma() to
510 * find the next vma to process.
511 */
512 op = task_vma_iter_find_vma;
513 }
514
515 curr_mm = get_task_mm(task: curr_task);
516 if (!curr_mm)
517 goto next_task;
518
519 if (mmap_read_lock_killable(mm: curr_mm)) {
520 mmput(curr_mm);
521 goto finish;
522 }
523 }
524
525 switch (op) {
526 case task_vma_iter_first_vma:
527 curr_vma = find_vma(mm: curr_mm, addr: 0);
528 break;
529 case task_vma_iter_next_vma:
530 curr_vma = find_vma(mm: curr_mm, addr: curr_vma->vm_end);
531 break;
532 case task_vma_iter_find_vma:
533 /* We dropped mmap_lock so it is necessary to use find_vma
534 * to find the next vma. This is similar to the mechanism
535 * in show_smaps_rollup().
536 */
537 curr_vma = find_vma(mm: curr_mm, addr: info->prev_vm_end - 1);
538 /* case 1) and 4.2) above just use curr_vma */
539
540 /* check for case 2) or case 4.1) above */
541 if (curr_vma &&
542 curr_vma->vm_start == info->prev_vm_start &&
543 curr_vma->vm_end == info->prev_vm_end)
544 curr_vma = find_vma(mm: curr_mm, addr: curr_vma->vm_end);
545 break;
546 }
547 if (!curr_vma) {
548 /* case 3) above, or case 2) 4.1) with vma->next == NULL */
549 mmap_read_unlock(mm: curr_mm);
550 mmput(curr_mm);
551 goto next_task;
552 }
553 info->task = curr_task;
554 info->vma = curr_vma;
555 info->mm = curr_mm;
556 return curr_vma;
557
558next_task:
559 if (info->common.type == BPF_TASK_ITER_TID)
560 goto finish;
561
562 put_task_struct(t: curr_task);
563 info->task = NULL;
564 info->mm = NULL;
565 info->tid++;
566 goto again;
567
568finish:
569 if (curr_task)
570 put_task_struct(t: curr_task);
571 info->task = NULL;
572 info->vma = NULL;
573 info->mm = NULL;
574 return NULL;
575}
576
577static void *task_vma_seq_start(struct seq_file *seq, loff_t *pos)
578{
579 struct bpf_iter_seq_task_vma_info *info = seq->private;
580 struct vm_area_struct *vma;
581
582 vma = task_vma_seq_get_next(info);
583 if (vma && *pos == 0)
584 ++*pos;
585
586 return vma;
587}
588
589static void *task_vma_seq_next(struct seq_file *seq, void *v, loff_t *pos)
590{
591 struct bpf_iter_seq_task_vma_info *info = seq->private;
592
593 ++*pos;
594 return task_vma_seq_get_next(info);
595}
596
597struct bpf_iter__task_vma {
598 __bpf_md_ptr(struct bpf_iter_meta *, meta);
599 __bpf_md_ptr(struct task_struct *, task);
600 __bpf_md_ptr(struct vm_area_struct *, vma);
601};
602
603DEFINE_BPF_ITER_FUNC(task_vma, struct bpf_iter_meta *meta,
604 struct task_struct *task, struct vm_area_struct *vma)
605
606static int __task_vma_seq_show(struct seq_file *seq, bool in_stop)
607{
608 struct bpf_iter_seq_task_vma_info *info = seq->private;
609 struct bpf_iter__task_vma ctx;
610 struct bpf_iter_meta meta;
611 struct bpf_prog *prog;
612
613 meta.seq = seq;
614 prog = bpf_iter_get_info(meta: &meta, in_stop);
615 if (!prog)
616 return 0;
617
618 ctx.meta = &meta;
619 ctx.task = info->task;
620 ctx.vma = info->vma;
621 return bpf_iter_run_prog(prog, ctx: &ctx);
622}
623
624static int task_vma_seq_show(struct seq_file *seq, void *v)
625{
626 return __task_vma_seq_show(seq, in_stop: false);
627}
628
629static void task_vma_seq_stop(struct seq_file *seq, void *v)
630{
631 struct bpf_iter_seq_task_vma_info *info = seq->private;
632
633 if (!v) {
634 (void)__task_vma_seq_show(seq, in_stop: true);
635 } else {
636 /* info->vma has not been seen by the BPF program. If the
637 * user space reads more, task_vma_seq_get_next should
638 * return this vma again. Set prev_vm_start to ~0UL,
639 * so that we don't skip the vma returned by the next
640 * find_vma() (case task_vma_iter_find_vma in
641 * task_vma_seq_get_next()).
642 */
643 info->prev_vm_start = ~0UL;
644 info->prev_vm_end = info->vma->vm_end;
645 mmap_read_unlock(mm: info->mm);
646 mmput(info->mm);
647 info->mm = NULL;
648 put_task_struct(t: info->task);
649 info->task = NULL;
650 }
651}
652
653static const struct seq_operations task_vma_seq_ops = {
654 .start = task_vma_seq_start,
655 .next = task_vma_seq_next,
656 .stop = task_vma_seq_stop,
657 .show = task_vma_seq_show,
658};
659
660static const struct bpf_iter_seq_info task_seq_info = {
661 .seq_ops = &task_seq_ops,
662 .init_seq_private = init_seq_pidns,
663 .fini_seq_private = fini_seq_pidns,
664 .seq_priv_size = sizeof(struct bpf_iter_seq_task_info),
665};
666
667static int bpf_iter_fill_link_info(const struct bpf_iter_aux_info *aux, struct bpf_link_info *info)
668{
669 switch (aux->task.type) {
670 case BPF_TASK_ITER_TID:
671 info->iter.task.tid = aux->task.pid;
672 break;
673 case BPF_TASK_ITER_TGID:
674 info->iter.task.pid = aux->task.pid;
675 break;
676 default:
677 break;
678 }
679 return 0;
680}
681
682static void bpf_iter_task_show_fdinfo(const struct bpf_iter_aux_info *aux, struct seq_file *seq)
683{
684 seq_printf(m: seq, fmt: "task_type:\t%s\n", iter_task_type_names[aux->task.type]);
685 if (aux->task.type == BPF_TASK_ITER_TID)
686 seq_printf(m: seq, fmt: "tid:\t%u\n", aux->task.pid);
687 else if (aux->task.type == BPF_TASK_ITER_TGID)
688 seq_printf(m: seq, fmt: "pid:\t%u\n", aux->task.pid);
689}
690
691static struct bpf_iter_reg task_reg_info = {
692 .target = "task",
693 .attach_target = bpf_iter_attach_task,
694 .feature = BPF_ITER_RESCHED,
695 .ctx_arg_info_size = 1,
696 .ctx_arg_info = {
697 { offsetof(struct bpf_iter__task, task),
698 PTR_TO_BTF_ID_OR_NULL | PTR_TRUSTED },
699 },
700 .seq_info = &task_seq_info,
701 .fill_link_info = bpf_iter_fill_link_info,
702 .show_fdinfo = bpf_iter_task_show_fdinfo,
703};
704
705static const struct bpf_iter_seq_info task_file_seq_info = {
706 .seq_ops = &task_file_seq_ops,
707 .init_seq_private = init_seq_pidns,
708 .fini_seq_private = fini_seq_pidns,
709 .seq_priv_size = sizeof(struct bpf_iter_seq_task_file_info),
710};
711
712static struct bpf_iter_reg task_file_reg_info = {
713 .target = "task_file",
714 .attach_target = bpf_iter_attach_task,
715 .feature = BPF_ITER_RESCHED,
716 .ctx_arg_info_size = 2,
717 .ctx_arg_info = {
718 { offsetof(struct bpf_iter__task_file, task),
719 PTR_TO_BTF_ID_OR_NULL },
720 { offsetof(struct bpf_iter__task_file, file),
721 PTR_TO_BTF_ID_OR_NULL },
722 },
723 .seq_info = &task_file_seq_info,
724 .fill_link_info = bpf_iter_fill_link_info,
725 .show_fdinfo = bpf_iter_task_show_fdinfo,
726};
727
728static const struct bpf_iter_seq_info task_vma_seq_info = {
729 .seq_ops = &task_vma_seq_ops,
730 .init_seq_private = init_seq_pidns,
731 .fini_seq_private = fini_seq_pidns,
732 .seq_priv_size = sizeof(struct bpf_iter_seq_task_vma_info),
733};
734
735static struct bpf_iter_reg task_vma_reg_info = {
736 .target = "task_vma",
737 .attach_target = bpf_iter_attach_task,
738 .feature = BPF_ITER_RESCHED,
739 .ctx_arg_info_size = 2,
740 .ctx_arg_info = {
741 { offsetof(struct bpf_iter__task_vma, task),
742 PTR_TO_BTF_ID_OR_NULL },
743 { offsetof(struct bpf_iter__task_vma, vma),
744 PTR_TO_BTF_ID_OR_NULL },
745 },
746 .seq_info = &task_vma_seq_info,
747 .fill_link_info = bpf_iter_fill_link_info,
748 .show_fdinfo = bpf_iter_task_show_fdinfo,
749};
750
751BPF_CALL_5(bpf_find_vma, struct task_struct *, task, u64, start,
752 bpf_callback_t, callback_fn, void *, callback_ctx, u64, flags)
753{
754 struct mmap_unlock_irq_work *work = NULL;
755 struct vm_area_struct *vma;
756 bool irq_work_busy = false;
757 struct mm_struct *mm;
758 int ret = -ENOENT;
759
760 if (flags)
761 return -EINVAL;
762
763 if (!task)
764 return -ENOENT;
765
766 mm = task->mm;
767 if (!mm)
768 return -ENOENT;
769
770 irq_work_busy = bpf_mmap_unlock_get_irq_work(work_ptr: &work);
771
772 if (irq_work_busy || !mmap_read_trylock(mm))
773 return -EBUSY;
774
775 vma = find_vma(mm, addr: start);
776
777 if (vma && vma->vm_start <= start && vma->vm_end > start) {
778 callback_fn((u64)(long)task, (u64)(long)vma,
779 (u64)(long)callback_ctx, 0, 0);
780 ret = 0;
781 }
782 bpf_mmap_unlock_mm(work, mm);
783 return ret;
784}
785
786const struct bpf_func_proto bpf_find_vma_proto = {
787 .func = bpf_find_vma,
788 .ret_type = RET_INTEGER,
789 .arg1_type = ARG_PTR_TO_BTF_ID,
790 .arg1_btf_id = &btf_tracing_ids[BTF_TRACING_TYPE_TASK],
791 .arg2_type = ARG_ANYTHING,
792 .arg3_type = ARG_PTR_TO_FUNC,
793 .arg4_type = ARG_PTR_TO_STACK_OR_NULL,
794 .arg5_type = ARG_ANYTHING,
795};
796
797struct bpf_iter_task_vma_kern_data {
798 struct task_struct *task;
799 struct mm_struct *mm;
800 struct mmap_unlock_irq_work *work;
801 struct vma_iterator vmi;
802};
803
804struct bpf_iter_task_vma {
805 /* opaque iterator state; having __u64 here allows to preserve correct
806 * alignment requirements in vmlinux.h, generated from BTF
807 */
808 __u64 __opaque[1];
809} __attribute__((aligned(8)));
810
811/* Non-opaque version of bpf_iter_task_vma */
812struct bpf_iter_task_vma_kern {
813 struct bpf_iter_task_vma_kern_data *data;
814} __attribute__((aligned(8)));
815
816__bpf_kfunc_start_defs();
817
818__bpf_kfunc int bpf_iter_task_vma_new(struct bpf_iter_task_vma *it,
819 struct task_struct *task, u64 addr)
820{
821 struct bpf_iter_task_vma_kern *kit = (void *)it;
822 bool irq_work_busy = false;
823 int err;
824
825 BUILD_BUG_ON(sizeof(struct bpf_iter_task_vma_kern) != sizeof(struct bpf_iter_task_vma));
826 BUILD_BUG_ON(__alignof__(struct bpf_iter_task_vma_kern) != __alignof__(struct bpf_iter_task_vma));
827
828 /* is_iter_reg_valid_uninit guarantees that kit hasn't been initialized
829 * before, so non-NULL kit->data doesn't point to previously
830 * bpf_mem_alloc'd bpf_iter_task_vma_kern_data
831 */
832 kit->data = bpf_mem_alloc(ma: &bpf_global_ma, size: sizeof(struct bpf_iter_task_vma_kern_data));
833 if (!kit->data)
834 return -ENOMEM;
835
836 kit->data->task = get_task_struct(t: task);
837 kit->data->mm = task->mm;
838 if (!kit->data->mm) {
839 err = -ENOENT;
840 goto err_cleanup_iter;
841 }
842
843 /* kit->data->work == NULL is valid after bpf_mmap_unlock_get_irq_work */
844 irq_work_busy = bpf_mmap_unlock_get_irq_work(work_ptr: &kit->data->work);
845 if (irq_work_busy || !mmap_read_trylock(mm: kit->data->mm)) {
846 err = -EBUSY;
847 goto err_cleanup_iter;
848 }
849
850 vma_iter_init(vmi: &kit->data->vmi, mm: kit->data->mm, addr);
851 return 0;
852
853err_cleanup_iter:
854 if (kit->data->task)
855 put_task_struct(t: kit->data->task);
856 bpf_mem_free(ma: &bpf_global_ma, ptr: kit->data);
857 /* NULL kit->data signals failed bpf_iter_task_vma initialization */
858 kit->data = NULL;
859 return err;
860}
861
862__bpf_kfunc struct vm_area_struct *bpf_iter_task_vma_next(struct bpf_iter_task_vma *it)
863{
864 struct bpf_iter_task_vma_kern *kit = (void *)it;
865
866 if (!kit->data) /* bpf_iter_task_vma_new failed */
867 return NULL;
868 return vma_next(vmi: &kit->data->vmi);
869}
870
871__bpf_kfunc void bpf_iter_task_vma_destroy(struct bpf_iter_task_vma *it)
872{
873 struct bpf_iter_task_vma_kern *kit = (void *)it;
874
875 if (kit->data) {
876 bpf_mmap_unlock_mm(work: kit->data->work, mm: kit->data->mm);
877 put_task_struct(t: kit->data->task);
878 bpf_mem_free(ma: &bpf_global_ma, ptr: kit->data);
879 }
880}
881
882__bpf_kfunc_end_defs();
883
884#ifdef CONFIG_CGROUPS
885
886struct bpf_iter_css_task {
887 __u64 __opaque[1];
888} __attribute__((aligned(8)));
889
890struct bpf_iter_css_task_kern {
891 struct css_task_iter *css_it;
892} __attribute__((aligned(8)));
893
894__bpf_kfunc_start_defs();
895
896__bpf_kfunc int bpf_iter_css_task_new(struct bpf_iter_css_task *it,
897 struct cgroup_subsys_state *css, unsigned int flags)
898{
899 struct bpf_iter_css_task_kern *kit = (void *)it;
900
901 BUILD_BUG_ON(sizeof(struct bpf_iter_css_task_kern) != sizeof(struct bpf_iter_css_task));
902 BUILD_BUG_ON(__alignof__(struct bpf_iter_css_task_kern) !=
903 __alignof__(struct bpf_iter_css_task));
904 kit->css_it = NULL;
905 switch (flags) {
906 case CSS_TASK_ITER_PROCS | CSS_TASK_ITER_THREADED:
907 case CSS_TASK_ITER_PROCS:
908 case 0:
909 break;
910 default:
911 return -EINVAL;
912 }
913
914 kit->css_it = bpf_mem_alloc(ma: &bpf_global_ma, size: sizeof(struct css_task_iter));
915 if (!kit->css_it)
916 return -ENOMEM;
917 css_task_iter_start(css, flags, it: kit->css_it);
918 return 0;
919}
920
921__bpf_kfunc struct task_struct *bpf_iter_css_task_next(struct bpf_iter_css_task *it)
922{
923 struct bpf_iter_css_task_kern *kit = (void *)it;
924
925 if (!kit->css_it)
926 return NULL;
927 return css_task_iter_next(it: kit->css_it);
928}
929
930__bpf_kfunc void bpf_iter_css_task_destroy(struct bpf_iter_css_task *it)
931{
932 struct bpf_iter_css_task_kern *kit = (void *)it;
933
934 if (!kit->css_it)
935 return;
936 css_task_iter_end(it: kit->css_it);
937 bpf_mem_free(ma: &bpf_global_ma, ptr: kit->css_it);
938}
939
940__bpf_kfunc_end_defs();
941
942#endif /* CONFIG_CGROUPS */
943
944struct bpf_iter_task {
945 __u64 __opaque[3];
946} __attribute__((aligned(8)));
947
948struct bpf_iter_task_kern {
949 struct task_struct *task;
950 struct task_struct *pos;
951 unsigned int flags;
952} __attribute__((aligned(8)));
953
954enum {
955 /* all process in the system */
956 BPF_TASK_ITER_ALL_PROCS,
957 /* all threads in the system */
958 BPF_TASK_ITER_ALL_THREADS,
959 /* all threads of a specific process */
960 BPF_TASK_ITER_PROC_THREADS
961};
962
963__bpf_kfunc_start_defs();
964
965__bpf_kfunc int bpf_iter_task_new(struct bpf_iter_task *it,
966 struct task_struct *task__nullable, unsigned int flags)
967{
968 struct bpf_iter_task_kern *kit = (void *)it;
969
970 BUILD_BUG_ON(sizeof(struct bpf_iter_task_kern) > sizeof(struct bpf_iter_task));
971 BUILD_BUG_ON(__alignof__(struct bpf_iter_task_kern) !=
972 __alignof__(struct bpf_iter_task));
973
974 kit->pos = NULL;
975
976 switch (flags) {
977 case BPF_TASK_ITER_ALL_THREADS:
978 case BPF_TASK_ITER_ALL_PROCS:
979 break;
980 case BPF_TASK_ITER_PROC_THREADS:
981 if (!task__nullable)
982 return -EINVAL;
983 break;
984 default:
985 return -EINVAL;
986 }
987
988 if (flags == BPF_TASK_ITER_PROC_THREADS)
989 kit->task = task__nullable;
990 else
991 kit->task = &init_task;
992 kit->pos = kit->task;
993 kit->flags = flags;
994 return 0;
995}
996
997__bpf_kfunc struct task_struct *bpf_iter_task_next(struct bpf_iter_task *it)
998{
999 struct bpf_iter_task_kern *kit = (void *)it;
1000 struct task_struct *pos;
1001 unsigned int flags;
1002
1003 flags = kit->flags;
1004 pos = kit->pos;
1005
1006 if (!pos)
1007 return pos;
1008
1009 if (flags == BPF_TASK_ITER_ALL_PROCS)
1010 goto get_next_task;
1011
1012 kit->pos = __next_thread(p: kit->pos);
1013 if (kit->pos || flags == BPF_TASK_ITER_PROC_THREADS)
1014 return pos;
1015
1016get_next_task:
1017 kit->task = next_task(kit->task);
1018 if (kit->task == &init_task)
1019 kit->pos = NULL;
1020 else
1021 kit->pos = kit->task;
1022
1023 return pos;
1024}
1025
1026__bpf_kfunc void bpf_iter_task_destroy(struct bpf_iter_task *it)
1027{
1028}
1029
1030__bpf_kfunc_end_defs();
1031
1032DEFINE_PER_CPU(struct mmap_unlock_irq_work, mmap_unlock_work);
1033
1034static void do_mmap_read_unlock(struct irq_work *entry)
1035{
1036 struct mmap_unlock_irq_work *work;
1037
1038 if (WARN_ON_ONCE(IS_ENABLED(CONFIG_PREEMPT_RT)))
1039 return;
1040
1041 work = container_of(entry, struct mmap_unlock_irq_work, irq_work);
1042 mmap_read_unlock_non_owner(mm: work->mm);
1043}
1044
1045static int __init task_iter_init(void)
1046{
1047 struct mmap_unlock_irq_work *work;
1048 int ret, cpu;
1049
1050 for_each_possible_cpu(cpu) {
1051 work = per_cpu_ptr(&mmap_unlock_work, cpu);
1052 init_irq_work(work: &work->irq_work, func: do_mmap_read_unlock);
1053 }
1054
1055 task_reg_info.ctx_arg_info[0].btf_id = btf_tracing_ids[BTF_TRACING_TYPE_TASK];
1056 ret = bpf_iter_reg_target(reg_info: &task_reg_info);
1057 if (ret)
1058 return ret;
1059
1060 task_file_reg_info.ctx_arg_info[0].btf_id = btf_tracing_ids[BTF_TRACING_TYPE_TASK];
1061 task_file_reg_info.ctx_arg_info[1].btf_id = btf_tracing_ids[BTF_TRACING_TYPE_FILE];
1062 ret = bpf_iter_reg_target(reg_info: &task_file_reg_info);
1063 if (ret)
1064 return ret;
1065
1066 task_vma_reg_info.ctx_arg_info[0].btf_id = btf_tracing_ids[BTF_TRACING_TYPE_TASK];
1067 task_vma_reg_info.ctx_arg_info[1].btf_id = btf_tracing_ids[BTF_TRACING_TYPE_VMA];
1068 return bpf_iter_reg_target(reg_info: &task_vma_reg_info);
1069}
1070late_initcall(task_iter_init);
1071

source code of linux/kernel/bpf/task_iter.c