linux-kernel - RE: [PATCH v2 bpf-next 1/3] bpf: Add bpf_perf_prog_read

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <C03FZ2ZXKIY9.21PQ3FP3MQYU7@dlxu-fedora-R90QNFJV>
Date:   Thu, 23 Jan 2020 12:09:51 -0800
From:   "Daniel Xu" <dxu@...uu.xyz>
To:     "John Fastabend" <john.fastabend@...il.com>, <bpf@...r.kernel.org>,
        <ast@...nel.org>, <daniel@...earbox.net>, <songliubraving@...com>,
        <yhs@...com>, <andriin@...com>
Cc:     "Daniel Xu" <dxu@...uu.xyz>, <linux-kernel@...r.kernel.org>,
        <kernel-team@...com>, <peterz@...radead.org>, <mingo@...hat.com>,
        <acme@...nel.org>
Subject: RE: [PATCH v2 bpf-next 1/3] bpf: Add bpf_perf_prog_read_branches()
 helper

Hi John, thanks for looking.

On Wed Jan 22, 2020 at 9:39 PM, John Fastabend wrote:
[...]
> > diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h
> > index 033d90a2282d..7350c5be6158 100644
> > --- a/include/uapi/linux/bpf.h
> > +++ b/include/uapi/linux/bpf.h
> > @@ -2885,6 +2885,16 @@ union bpf_attr {
> >   *		**-EPERM** if no permission to send the *sig*.
> >   *
> >   *		**-EAGAIN** if bpf program can try again.
> > + *
> > + * int bpf_perf_prog_read_branches(struct bpf_perf_event_data *ctx, void *buf, u32 buf_size)
> > + * 	Description
> > + * 		For en eBPF program attached to a perf event, retrieve the
> > + * 		branch records (struct perf_branch_entry) associated to *ctx*
> > + * 		and store it in	the buffer pointed by *buf* up to size
> > + * 		*buf_size* bytes.
>
> 
> It seems extra bytes in buf will be cleared. The number of bytes
> copied is returned so I don't see any reason to clear the extra bytes I
> would
> just let the BPF program do this if they care. But it should be noted in
> the description at least.

In include/linux/bpf.h:

        /* the following constraints used to prototype bpf_memcmp() and other
         * functions that access data on eBPF program stack
         */
        ARG_PTR_TO_UNINIT_MEM,  /* pointer to memory does not need to be initialized,
                                 * helper function must fill all bytes or clear
                                 * them in error case.
                                 */

I figured it would be good to clear out the stack b/c this helper
writes data on program stack.

Also bpf_perf_prog_read_value() does something similar (fill zeros on
failure).

[...]
> > +	to_copy = min_t(u32, br_stack->nr * sizeof(struct perf_branch_entry), size);
> > +	to_clear -= to_copy;
> > +
> > +	memcpy(buf, br_stack->entries, to_copy);
> > +	err = to_copy;
> > +clear:
> > +	memset(buf + to_copy, 0, to_clear);
>
> 
> Here, why do this at all? If the user cares they can clear the bytes
> directly from the BPF program. I suspect its probably going to be
> wasted work in most cases. If its needed for some reason provide
> a comment with it.

Same concern as above, right?

I can send a V3 with updated uapi/linux/bpf.h description (and a rebase).

Thanks,
Daniel