bpf: Add support to specify uprobe_multi target via file descriptor

Allow uprobe_multi link to identify the target binary by an already
opened file descriptor.

Adding new BPF_F_UPROBE_MULTI_PATH_FD flag and the path_fd field for
the attr.link_create.uprobe_multi struct.

When the flag is set, we resolve the target from path_fd, without the
flag, we keep the existing string path behavior.

I don't see a use case for supporting O_PATH file descriptors, because
we need to read the binary first to get probes offsets, so I'm using
the CLASS(fd, f), which fails for O_PATH fds.

Assisted-by: Codex:GPT-5.4
Signed-off-by: Jiri Olsa <jolsa@kernel.org>
Link: https://lore.kernel.org/r/20260611114230.950379-4-jolsa@kernel.org
Signed-off-by: Alexei Starovoitov <ast@kernel.org>

diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h
index 11dd610fa5fae849da7933060cb3a7adba4e3191..89b36de5fdbb6da720fd3397607f11b081f71d3f 100644 (file)
--- a/include/uapi/linux/bpf.h
+++ b/include/uapi/linux/bpf.h
@@ -1327,7 +1327,11 @@ enum {
  * BPF_TRACE_UPROBE_MULTI attach type to create return probe.
  */
 enum {
-       BPF_F_UPROBE_MULTI_RETURN = (1U << 0)
+       /* Get return uprobe. */
+       BPF_F_UPROBE_MULTI_RETURN     = (1U << 0),
+
+       /* Get path from provided path_fd. */
+       BPF_F_UPROBE_MULTI_PATH_FD    = (1U << 1),
 };
 
 /* link_create.netfilter.flags used in LINK_CREATE command for
@@ -1864,6 +1868,7 @@ union bpf_attr {
                                __u32           cnt;
                                __u32           flags;
                                __u32           pid;
+                               __u32           path_fd;
                        } uprobe_multi;
                        struct {
                                union {

diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index 7ed949f70f82c1c1be1c93cf57c8aef47a828fa2..b44106c8ea750048575c8f4ec644e61309acb2da 100644 (file)
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -3480,7 +3480,7 @@ static void bpf_link_show_fdinfo(struct seq_file *m, struct file *filp)
                        seq_printf(m, "link_type:\t%s\n", link->flags == BPF_F_KPROBE_MULTI_RETURN ?
                                   "kretprobe_multi" : "kprobe_multi");
                else if (link->type == BPF_LINK_TYPE_UPROBE_MULTI)
-                       seq_printf(m, "link_type:\t%s\n", link->flags == BPF_F_UPROBE_MULTI_RETURN ?
+                       seq_printf(m, "link_type:\t%s\n", link->flags & BPF_F_UPROBE_MULTI_RETURN ?
                                   "uretprobe_multi" : "uprobe_multi");
                else
                        seq_printf(m, "link_type:\t%s\n", bpf_link_type_strs[type]);
@@ -5840,7 +5840,7 @@ err_put:
        return err;
 }
 
-#define BPF_LINK_CREATE_LAST_FIELD link_create.uprobe_multi.pid
+#define BPF_LINK_CREATE_LAST_FIELD link_create.uprobe_multi.path_fd
 static int link_create(union bpf_attr *attr, bpfptr_t uattr)
 {
        struct bpf_prog *prog;

diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
index f8990bc6b64c3b95c12e2e76310593556c27c803..82f8feea69311a5d7624bf7430022396343f9bf1 100644 (file)
--- a/kernel/trace/bpf_trace.c
+++ b/kernel/trace/bpf_trace.c
@@ -23,6 +23,7 @@
 #include <linux/sort.h>
 #include <linux/key.h>
 #include <linux/namei.h>
+#include <linux/file.h>
 
 #include <net/bpf_sk_storage.h>
 
@@ -3214,6 +3215,38 @@ static u64 bpf_uprobe_multi_cookie(struct bpf_run_ctx *ctx)
        return run_ctx->uprobe->cookie;
 }
 
+static int bpf_uprobe_multi_get_path(const union bpf_attr *attr, struct path *path)
+{
+       void __user *upath = u64_to_user_ptr(attr->link_create.uprobe_multi.path);
+       u32 path_fd = attr->link_create.uprobe_multi.path_fd;
+       u32 flags = attr->link_create.uprobe_multi.flags;
+
+       if (flags & BPF_F_UPROBE_MULTI_PATH_FD) {
+               /*
+                * When BPF_F_UPROBE_MULTI_PATH_FD is set, the executable is
+                * identified by path_fd, upath must be NULL.
+                */
+               if (upath)
+                       return -EINVAL;
+
+               CLASS(fd, f)(path_fd);
+               if (fd_empty(f))
+                       return -EBADF;
+               *path = fd_file(f)->f_path;
+               path_get(path);
+               return 0;
+       }
+
+       /*
+        * When BPF_F_UPROBE_MULTI_PATH_FD is not set, the path is resolved
+        * relative to the cwd (AT_FDCWD) or absolute using the upath string.
+        */
+       if (!upath || path_fd)
+               return -EINVAL;
+
+       return user_path_at(AT_FDCWD, upath, LOOKUP_FOLLOW, path);
+}
+
 int bpf_uprobe_multi_link_attach(const union bpf_attr *attr, struct bpf_prog *prog)
 {
        struct bpf_uprobe_multi_link *link = NULL;
@@ -3223,7 +3256,6 @@ int bpf_uprobe_multi_link_attach(const union bpf_attr *attr, struct bpf_prog *pr
        struct task_struct *task = NULL;
        unsigned long __user *uoffsets;
        u64 __user *ucookies;
-       void __user *upath;
        unsigned long size;
        u32 flags, cnt, i;
        struct path path;
@@ -3241,19 +3273,18 @@ int bpf_uprobe_multi_link_attach(const union bpf_attr *attr, struct bpf_prog *pr
                return -EINVAL;
 
        flags = attr->link_create.uprobe_multi.flags;
-       if (flags & ~BPF_F_UPROBE_MULTI_RETURN)
+       if (flags & ~(BPF_F_UPROBE_MULTI_RETURN | BPF_F_UPROBE_MULTI_PATH_FD))
                return -EINVAL;
 
        /*
-        * path, offsets and cnt are mandatory,
+        * offsets and cnt are mandatory,
         * ref_ctr_offsets and cookies are optional
         */
-       upath = u64_to_user_ptr(attr->link_create.uprobe_multi.path);
        uoffsets = u64_to_user_ptr(attr->link_create.uprobe_multi.offsets);
        cnt = attr->link_create.uprobe_multi.cnt;
        pid = attr->link_create.uprobe_multi.pid;
 
-       if (!upath || !uoffsets || !cnt || pid < 0)
+       if (!uoffsets || !cnt || pid < 0)
                return -EINVAL;
        if (cnt > MAX_UPROBE_MULTI_CNT)
                return -E2BIG;
@@ -3271,7 +3302,7 @@ int bpf_uprobe_multi_link_attach(const union bpf_attr *attr, struct bpf_prog *pr
            !access_ok(ucookies, size))
                return -EFAULT;
 
-       err = user_path_at(AT_FDCWD, upath, LOOKUP_FOLLOW, &path);
+       err = bpf_uprobe_multi_get_path(attr, &path);
        if (err)
                return err;
 

diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h
index 11dd610fa5fae849da7933060cb3a7adba4e3191..89b36de5fdbb6da720fd3397607f11b081f71d3f 100644 (file)
--- a/tools/include/uapi/linux/bpf.h
+++ b/tools/include/uapi/linux/bpf.h
@@ -1327,7 +1327,11 @@ enum {
  * BPF_TRACE_UPROBE_MULTI attach type to create return probe.
  */
 enum {
-       BPF_F_UPROBE_MULTI_RETURN = (1U << 0)
+       /* Get return uprobe. */
+       BPF_F_UPROBE_MULTI_RETURN     = (1U << 0),
+
+       /* Get path from provided path_fd. */
+       BPF_F_UPROBE_MULTI_PATH_FD    = (1U << 1),
 };
 
 /* link_create.netfilter.flags used in LINK_CREATE command for
@@ -1864,6 +1868,7 @@ union bpf_attr {
                                __u32           cnt;
                                __u32           flags;
                                __u32           pid;
+                               __u32           path_fd;
                        } uprobe_multi;
                        struct {
                                union {