linux-kernel - Re: [PATCH] uprobe: Warn if unable to install breakpoint

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Thu, 14 Sep 2017 00:46:50 +0530
From:   "Naveen N. Rao" <naveen.n.rao@...ux.vnet.ibm.com>
To:     Michael Ellerman <mpe@...erman.id.au>
Cc:     Ingo Molnar <mingo@...nel.org>, Anton Blanchard <anton@...ba.org>,
        linuxppc-dev@...ts.ozlabs.org, linux-kernel@...r.kernel.org,
        Oleg Nesterov <oleg@...hat.com>,
        Srikar Dronamraju <srikar@...ux.vnet.ibm.com>
Subject: Re: [PATCH] uprobe: Warn if unable to install breakpoint

On 2017/09/01 03:09PM, Michael Ellerman wrote:
> "Naveen N. Rao" <naveen.n.rao@...ux.vnet.ibm.com> writes:
> 
> > When we try to install a uprobe breakpoint in uprobe_mmap(), we ignore
> > all errors encountered in the process per this comment at the top of
> > the function:
> >     /*
> >      * Called from mmap_region/vma_adjust with mm->mmap_sem acquired.
> >      *
> >      * Currently we ignore all errors and always return 0, the callers
> >      * can't handle the failure anyway.
> >      */
> >
> > However, this is very confusing for users since no probe hits are
> > recorded nor is an error logged in dmesg.
> >
> > Fix this by logging an error in dmesg so that users can discover that
> > there was an issue with the uprobe. To facilitate use of uprobe_warn(),
> > we move that function to the top of the file.
> >
> > With this patch, we see a message similar to this in dmesg:
> >     [  201.449213] uprobe: uprobe_t:9740 failed to setup probe at 0x95c (-524)
> >
> > Reported-by: Anton Blanchard <anton@...ba.org>
> > Signed-off-by: Naveen N. Rao <naveen.n.rao@...ux.vnet.ibm.com>
> > ---
> >  kernel/events/uprobes.c | 21 ++++++++++++++-------
> >  1 file changed, 14 insertions(+), 7 deletions(-)
> >
> > diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c
> > index 0e137f98a50c..587c591a535c 100644
> > --- a/kernel/events/uprobes.c
> > +++ b/kernel/events/uprobes.c
> > @@ -112,6 +112,12 @@ struct xol_area {
> >  	unsigned long 			vaddr;		/* Page(s) of instruction slots */
> >  };
> >  
> > +static void uprobe_warn(struct task_struct *t, const char *msg)
> > +{
> > +	pr_warn("uprobe: %s:%d failed to %s\n",
> > +			current->comm, current->pid, msg);
> 
> That should probably be ratelimited no?

Uprobes can only be installed by root today, so it is not as bad. But, I 
do agree that it is good to ratelimit. I will send a subsequent patch to 
do this.

Thanks for the review,
- Naveen