linux-kernel - Re: [PATCH] perf tools: Add bpf image check to __map__is

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Thu, 3 Sep 2020 16:05:39 -0300
From:   Arnaldo Carvalho de Melo <acme@...nel.org>
To:     Jiri Olsa <jolsa@...nel.org>
Cc:     lkml <linux-kernel@...r.kernel.org>,
        Ingo Molnar <mingo@...nel.org>,
        Namhyung Kim <namhyung@...nel.org>,
        Alexander Shishkin <alexander.shishkin@...ux.intel.com>,
        Peter Zijlstra <a.p.zijlstra@...llo.nl>,
        Michael Petlan <mpetlan@...hat.com>,
        Ian Rogers <irogers@...gle.com>,
        Stephane Eranian <eranian@...gle.com>,
        Andi Kleen <ak@...ux.intel.com>,
        Adrian Hunter <adrian.hunter@...el.com>
Subject: Re: [PATCH] perf tools: Add bpf image check to __map__is_kmodule

Em Wed, Aug 26, 2020 at 11:30:17PM +0200, Jiri Olsa escreveu:
> When validating kcore modules the do_validate_kcore_modules
> function checks on every kernel module dso against modules
> record. The __map__is_kmodule check is used to get only
> kernel module dso objects through.
> 
> Currently the bpf images are slipping through the check and
> making the validation to fail, so report falls back from kcore
> usage to kallsyms.
> 
> Adding __map__is_bpf_image check for bpf image and adding
> it to __map__is_kmodule check.

looks ok, applied to perf/urgent.

Thanks,

- Arnaldo
 
> Fixes: 3c29d4483e85 ("perf annotate: Add basic support for bpf_image")
> Signed-off-by: Jiri Olsa <jolsa@...nel.org>
> ---
>  tools/perf/util/machine.c |  6 ------
>  tools/perf/util/map.c     | 16 ++++++++++++++++
>  tools/perf/util/map.h     |  9 ++++++++-
>  3 files changed, 24 insertions(+), 7 deletions(-)
> 
> diff --git a/tools/perf/util/machine.c b/tools/perf/util/machine.c
> index 208b813e00ea..85587de027a5 100644
> --- a/tools/perf/util/machine.c
> +++ b/tools/perf/util/machine.c
> @@ -736,12 +736,6 @@ int machine__process_switch_event(struct machine *machine __maybe_unused,
>  	return 0;
>  }
>  
> -static int is_bpf_image(const char *name)
> -{
> -	return strncmp(name, "bpf_trampoline_", sizeof("bpf_trampoline_") - 1) == 0 ||
> -	       strncmp(name, "bpf_dispatcher_", sizeof("bpf_dispatcher_") - 1) == 0;
> -}
> -
>  static int machine__process_ksymbol_register(struct machine *machine,
>  					     union perf_event *event,
>  					     struct perf_sample *sample __maybe_unused)
> diff --git a/tools/perf/util/map.c b/tools/perf/util/map.c
> index 1d7210804639..cc0faf8f1321 100644
> --- a/tools/perf/util/map.c
> +++ b/tools/perf/util/map.c
> @@ -267,6 +267,22 @@ bool __map__is_bpf_prog(const struct map *map)
>  	return name && (strstr(name, "bpf_prog_") == name);
>  }
>  
> +bool __map__is_bpf_image(const struct map *map)
> +{
> +	const char *name;
> +
> +	if (map->dso->binary_type == DSO_BINARY_TYPE__BPF_IMAGE)
> +		return true;
> +
> +	/*
> +	 * If PERF_RECORD_KSYMBOL is not included, the dso will not have
> +	 * type of DSO_BINARY_TYPE__BPF_IMAGE. In such cases, we can
> +	 * guess the type based on name.
> +	 */
> +	name = map->dso->short_name;
> +	return name && is_bpf_image(name);
> +}
> +
>  bool __map__is_ool(const struct map *map)
>  {
>  	return map->dso && map->dso->binary_type == DSO_BINARY_TYPE__OOL;
> diff --git a/tools/perf/util/map.h b/tools/perf/util/map.h
> index 9e312ae2d656..c2f5d28fe73a 100644
> --- a/tools/perf/util/map.h
> +++ b/tools/perf/util/map.h
> @@ -147,12 +147,14 @@ int map__set_kallsyms_ref_reloc_sym(struct map *map, const char *symbol_name,
>  bool __map__is_kernel(const struct map *map);
>  bool __map__is_extra_kernel_map(const struct map *map);
>  bool __map__is_bpf_prog(const struct map *map);
> +bool __map__is_bpf_image(const struct map *map);
>  bool __map__is_ool(const struct map *map);
>  
>  static inline bool __map__is_kmodule(const struct map *map)
>  {
>  	return !__map__is_kernel(map) && !__map__is_extra_kernel_map(map) &&
> -	       !__map__is_bpf_prog(map) && !__map__is_ool(map);
> +	       !__map__is_bpf_prog(map) && !__map__is_ool(map) &&
> +	       !__map__is_bpf_image(map);
>  }
>  
>  bool map__has_symbols(const struct map *map);
> @@ -164,4 +166,9 @@ static inline bool is_entry_trampoline(const char *name)
>  	return !strcmp(name, ENTRY_TRAMPOLINE_NAME);
>  }
>  
> +static inline bool is_bpf_image(const char *name)
> +{
> +	return strncmp(name, "bpf_trampoline_", sizeof("bpf_trampoline_") - 1) == 0 ||
> +	       strncmp(name, "bpf_dispatcher_", sizeof("bpf_dispatcher_") - 1) == 0;
> +}
>  #endif /* __PERF_MAP_H */
> -- 
> 2.25.4
> 

-- 

- Arnaldo