linux-kernel - Re: [PATCH 1/2] tracing: kprobes: Prohibit probing on notrace functions

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20180725211356.725079e1@vmware.local.home>
Date:   Wed, 25 Jul 2018 21:13:56 -0400
From:   Steven Rostedt <rostedt@...dmis.org>
To:     Masami Hiramatsu <mhiramat@...nel.org>
Cc:     Francis Deslauriers <francis.deslauriers@...icios.com>,
        peterz@...radead.org, mathieu.desnoyers@...icios.com,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH 1/2] tracing: kprobes: Prohibit probing on notrace
 functions

On Thu, 26 Jul 2018 09:41:06 +0900
Masami Hiramatsu <mhiramat@...nel.org> wrote:

> On Fri, 13 Jul 2018 08:18:03 -0400
> Steven Rostedt <rostedt@...dmis.org> wrote:
> 
> > On Fri, 13 Jul 2018 11:53:01 +0900
> > Masami Hiramatsu <mhiramat@...nel.org> wrote:
> >   
> > > On Thu, 12 Jul 2018 13:54:12 -0400
> > > Francis Deslauriers <francis.deslauriers@...icios.com> wrote:
> > >   
> > > > From: Masami Hiramatsu <mhiramat@...nel.org>
> > > > 
> > > > Prohibit kprobe-events probing on notrace function.
> > > > Since probing on the notrace function can cause recursive
> > > > event call. In most case those are just skipped, but
> > > > in some case it falls into infinite recursive call.    
> > > 
> > > BTW, I'm considering to add an option to allow putting
> > > kprobes on notrace function - just for debugging 
> > > ftrace by kprobes. That is "developer only" option
> > > so generally it should be disabled, but for debugging
> > > the ftrace, we still need it. Or should I introduce
> > > another kprobes module for debugging it?  
> > 
> > No, I think the former is better (to add an option to allow putting
> > kprobes on notrace functions). By default we let people protect
> > themselves. But if then provide a switch that lets you do things that
> > might let you shoot yourself in the foot.  
> 
> I'm adding CONFIG_KPROBE_EVENTS_ON_NOTRACE kconfig which allows
> kprobes on notrace function. I think we don't need to make it
> online switchable, since it is only good for ftrace developers.
> 

Works for me.

Thanks!

-- Steve