linux-kernel - Re: [PATCH] perf probe: Fix kprobe blacklist checking condition

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 29 Aug 2017 11:51:12 -0300
From:   Arnaldo Carvalho de Melo <acme@...nel.org>
To:     Li Bin <huawei.libin@...wei.com>
Cc:     Peter Zijlstra <peterz@...radead.org>,
        Namhyung Kim <namhyung@...nel.org>,
        Masami Hiramatsu <mhiramat@...nel.org>,
        linux-kernel@...r.kernel.org, Wang Nan <wangnan0@...wei.com>,
        zhangmengting@...wei.com
Subject: Re: [PATCH] perf probe: Fix kprobe blacklist checking condition

Em Tue, Aug 29, 2017 at 08:57:23PM +0800, Li Bin escreveu:
> The commit 9aaf5a5("perf probe: Check kprobes blacklist
> when adding new events"), perf probe supports checking
> the blacklist of the fuctions which can not be probed.
> But the checking condition is wrong, that the end_addr
> of the symbol which is the start_addr of the next symbol
> can't be included.

Applied, with the following committer notes added:

    Committer notes:
    
    IOW make it match its kernel counterpart in kernel/kprobes.c:
    
      bool within_kprobe_blacklist(unsigned long addr)
    
    Each entry have as its end address not its end address, but the first
    address _outside_ that symbol, which for related functions, is the first
    address of the next symbol, like these from kernel/trace/trace_probe.c:
    
    0xffffffffbd198df0-0xffffffffbd198e40   print_type_u8
    0xffffffffbd198e40-0xffffffffbd198e90   print_type_u16
    0xffffffffbd198e90-0xffffffffbd198ee0   print_type_u32
    0xffffffffbd198ee0-0xffffffffbd198f30   print_type_u64
    0xffffffffbd198f30-0xffffffffbd198f80   print_type_s8
    0xffffffffbd198f80-0xffffffffbd198fd0   print_type_s16
    0xffffffffbd198fd0-0xffffffffbd199020   print_type_s32
    0xffffffffbd199020-0xffffffffbd199070   print_type_s64
    0xffffffffbd199070-0xffffffffbd1990c0   print_type_x8
    0xffffffffbd1990c0-0xffffffffbd199110   print_type_x16
    0xffffffffbd199110-0xffffffffbd199160   print_type_x32
    0xffffffffbd199160-0xffffffffbd1991b0   print_type_x64
    
    But not always:
    
    0xffffffffbd1997b0-0xffffffffbd1997c0   fetch_kernel_stack_address (kernel/trace/trace_probe.c)
    0xffffffffbd1c57f0-0xffffffffbd1c58b0   __context_tracking_enter   (kernel/context_tracking.c)
    
    Fixes: 9aaf5a5f479b ("perf probe: Check kprobes blacklist when adding new events")