[Bug tapsets/26015] New: make syscall arguments symbol-writeable again

["fche at redhat dot com" <sourceware-bugzilla@sourceware.org>]

https://sourceware.org/bugzilla/show_bug.cgi?id=26015

            Bug ID: 26015
           Summary: make syscall arguments symbol-writeable again
           Product: systemtap
           Version: unspecified
            Status: NEW
          Severity: normal
          Priority: P2
         Component: tapsets
          Assignee: systemtap at sourceware dot org
          Reporter: fche at redhat dot com
            Blocks: 25580
  Target Milestone: ---

With the linux 4.17+ transition to pt_regs passing syscall wrappers (the
nd2_syscall.* family of probe point aliases), as well as the tracepoint
fallbacks (the tp_syscall.* family), we've lost the ability to modify syscall
parameters, even in guru mode.  That's because the parameters are copied out of
pt_regs into script level variables, but that's a one-way trip only.

IOW, previously we could do this, because the syscall alias expanded to a dwarf
probe of the low level syscall handler function:

    stap -g -e 'probe syscall.foo { if (uid() == 0) $var = 2 }'

but now there is no $var.


One way might be to extend the nd2_* and tp_* suite with a construct using
epilogue-style probe aliases to copy back modified values into the pt_regs. 
This might almost work:

old:

probe nd2_syscall.mknod = kprobe.function(@arch_syscall_prefix "sys_mknod") ?
{ // ....
  _SYSCALL_MKNOD_REGARGS
  // ....
}

@define _SYSCALL_MKNOD_REGARGS
%(
  pathname = user_string_quoted(pointer_arg(1))
  mode = uint_arg(2)
  mode_str = _mknod_mode_str(mode)
  dev = uint_arg(3)
%)


add:

probe nd2_syscall.mknod += kprobe.function(@arch_syscall_prefix "sys_mknod") ?
{ // ...
  _SYSCALL_MKNOD_REGARGS_STORE
}

@define _SYSCALL_MKNOD_REGARGS_STORE
%(
   store_user_string(pointer_arg(1), pathname) // or punt
   set_uint_arg(2, mode)
   set_uint_arg(3, dev)
   // ...
%)

then

   stap -g -e 'probe syscall.mknod { if (uid() == 0) mode &= 0700 }'

would work (to make root mknod's always have umask 077, apprx.).


Or we may be able to expose the $mode name as an rvalue & lvalue, via some sort
of newfangled macro trickery?  Maybe let probe points include a list of
simulated context variables in context, with getter/setter expansion
expressions kind of like tree rewriting rules:

probe nd2_syscall.mknod = kprobe.function(@arch_syscall_prefix "sys_mknod") ?
[$mode, get_uint_arg(2), set_uint_arg(2,$mode)]
{
   mode = $mode
}

where then the $mode symbol itself becomes read-write.


Referenced Bugs:

https://sourceware.org/bugzilla/show_bug.cgi?id=25580
[Bug 25580] lp tracker
-- 
You are receiving this mail because:
You are the assignee for the bug.