linux-kernel - Re: perf: fuzzer leads to trace_kprobe: Could not insert message flood

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 12 Apr 2018 09:52:20 +0200
From:   Ingo Molnar <mingo@...nel.org>
To:     Song Liu <songliubraving@...com>
Cc:     Vince Weaver <vincent.weaver@...ne.edu>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        Peter Zijlstra <peterz@...radead.org>
Subject: Re: perf: fuzzer leads to trace_kprobe: Could not insert message
 flood


* Song Liu <songliubraving@...com> wrote:

> > spamming the kernel log ...
> 
> Yeah, the new API allows non-root user to trigger this message. We should only 
> allow root to create kprobe with perf_event_open(). 
> 
> On the other hand, do we need to fix this for root? In fact, a simple bash loop 
> can create something similar through the text interface (with root):
> 
> root@...t-test:~# for x in {0..5} ; do echo p:xx xx+$x >> /sys/kernel/debug/tracing/kprobe_events ; done
> -bash: echo: write error: No such file or directory
> -bash: echo: write error: No such file or directory
> -bash: echo: write error: No such file or directory
> -bash: echo: write error: No such file or directory
> -bash: echo: write error: No such file or directory
> -bash: echo: write error: No such file or directory
> root@...t-test:~# dmesg | tail -n 5
> [  664.208374] trace_kprobe: Could not insert probe at xx+1: -2
> [  664.237882] trace_kprobe: Could not insert probe at xx+2: -2
> [  664.268067] trace_kprobe: Could not insert probe at xx+3: -2
> [  664.297395] trace_kprobe: Could not insert probe at xx+4: -2
> [  664.327614] trace_kprobe: Could not insert probe at xx+5: -2
> 
> This happens before the new API is introduced. 
> 
> The following patch does capable(CAP_SYS_ADMIN) for perf_kprobe and 
> perf_uprobe at an earlier stage, so non-root user cannot trigger 
> this error message. Please let me know whether we need to fix this 
> for root. 

That's two bugs then, and yes, I think we should fix the log spamming: what's the 
point? We already get an error code from the write.

I'll apply your CAP_SYS_ADMIN fix.

Thanks,

	Ingo