linux-kernel - Re: [PATCH 0/2] kprobe: Fix: add symbols to kprobe blacklist

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20170717005935.dcdf6840d221a265c85f01e4@kernel.org>
Date:   Mon, 17 Jul 2017 00:59:35 +0900
From:   Masami Hiramatsu <mhiramat@...nel.org>
To:     Steven Rostedt <rostedt@...dmis.org>
Cc:     Francis Deslauriers <francis.deslauriers@...icios.com>,
        mhiramat@...nel.org, peterz@...radead.org,
        mathieu.desnoyers@...icios.com, linux-kernel@...r.kernel.org
Subject: Re: [PATCH 0/2] kprobe: Fix: add symbols to kprobe blacklist

On Fri, 14 Jul 2017 14:27:56 -0400
Steven Rostedt <rostedt@...dmis.org> wrote:

> On Fri, 14 Jul 2017 10:58:33 -0400
> Francis Deslauriers <francis.deslauriers@...icios.com> wrote:
> 
> 
> > Kretprobe on ftrace_ops_assist_func and another function:
> > Those crashes are triggered when hooking a kretprobe on the
> > ftrace_ops_assist_func symbol and some other functions to make the this first
> > function reacheable. From my understanding, ftrace_ops_assist_func is the
> > function called directly when the kprobe is hit. Thus it should be marked
> > with NOKPROBE_SYMBOL.
> > 
> 
> Hmm, I'm wondering if I should just make an ftrace section, and black
> list the entire thing. Also that section could be used to not allow
> ftrace to use it either. I've been wanting to start letting ftrace
> trace the tracing code, and perf for that matter. It would be nice to
> be able to debug things like that.

Tracer usually has 2 parts, one is off-line setting part (kicked by
user) and another is core online tracing part (which kicked from
anywhere). Former can be traced but latter is not.
Yeah, I did same thing when I introduced NOKPROBE_SYMBOL() macro.
And I also think that is good for kgdb.

> I would like to also make sections that can be enabled or disabled in
> groups. To group things like the tracing facility and perf and have
> them by default not be traced, but then set a flag that says "sure go
> ahead and trace them". This shouldn't be too hard to do.

We have to notice that is a trigger which allows to shoot yourself
in the foot :)

Thanks,

> 
> Hmm, I'll add this as another topic to have for the Linux Plumbers
> tracing track, as well as the kernel tracing topic.
> 
> -- Steve


-- 
Masami Hiramatsu <mhiramat@...nel.org>