linux-kernel - RE: [PATCH v1 1/2] perf/core: Use sysctl to turn on/off dropping leaked kernel samples

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 15 Jun 2018 13:31:34 +0000
From:   "Liang, Kan" <kan.liang@...el.com>
To:     Peter Zijlstra <peterz@...radead.org>,
        Stephane Eranian <eranian@...gle.com>
CC:     "yao.jin@...ux.intel.com" <yao.jin@...ux.intel.com>,
        "Arnaldo Carvalho de Melo" <acme@...nel.org>,
        Jiri Olsa <jolsa@...nel.org>, Ingo Molnar <mingo@...hat.com>,
        Alexander Shishkin <alexander.shishkin@...ux.intel.com>,
        "me@...ehuey.com" <me@...ehuey.com>,
        LKML <Linux-kernel@...r.kernel.org>,
        Vince Weaver <vincent.weaver@...ne.edu>,
        Will Deacon <will.deacon@....com>,
        Namhyung Kim <namhyung@...nel.org>,
        Andi Kleen <ak@...ux.intel.com>, "Jin, Yao" <yao.jin@...el.com>
Subject: RE: [PATCH v1 1/2] perf/core: Use sysctl to turn on/off dropping
 leaked kernel samples

> On Thu, Jun 14, 2018 at 11:02:53PM -0700, Stephane Eranian wrote:
> > On Thu, Jun 14, 2018 at 7:10 PM Jin Yao <yao.jin@...ux.intel.com> wrote:
> > > +       /*
> > > +        * Due to interrupt latency (AKA "skid"), we may enter the
> > > +        * kernel before taking an overflow, even if the PMU is only
> > > +        * counting user events.
> > > +        * To avoid leaking information to userspace, we must always
> > > +        * reject kernel samples when exclude_kernel is set.
> > > +        */
> > > +       if (event->attr.exclude_kernel && !user_mode(regs))
> > > +               return false;
> > > +
> > And how does that filter PEBS or LBR records?
> 
> I suspect the user_mode() thing actually covers PEBS, but yes LBR might need
> additional filtering.

I think the large PEBS still need to be specially handled.

Thanks,
Kan