linux-kernel - Re: [FIX bpf,perf] bpf,perf: return EOPNOTSUPP for bpf handler on PERF_COUNT_SW

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20201117153902.GA6933@der-flo.net>
Date:   Tue, 17 Nov 2020 16:39:02 +0100
From:   Florian Lehner <dev@...-flo.net>
To:     Peter Zijlstra <peterz@...radead.org>
Cc:     acme@...nel.org, andrii@...nel.org, ast@...nel.org,
        bpf@...r.kernel.org, daniel@...earbox.net,
        john.fastabend@...il.com, kafai@...com,
        linux-kernel@...r.kernel.org, mingo@...hat.com,
        netdev@...r.kernel.org
Subject: Re: [FIX bpf,perf] bpf,perf: return EOPNOTSUPP for bpf handler on
 PERF_COUNT_SW_DUMMY

On Tue, Nov 17, 2020 at 08:53:34AM +0100, Peter Zijlstra wrote:
> On Mon, Nov 16, 2020 at 01:02:09PM -0800, Martin KaFai Lau wrote:
> > On Mon, Nov 16, 2020 at 07:37:52PM +0100, Florian Lehner wrote:
> > > bpf handlers for perf events other than tracepoints, kprobes or uprobes
> > > are attached to the overflow_handler of the perf event.
> > > 
> > > Perf events of type software/dummy are placeholder events. So when
> > > attaching a bpf handle to an overflow_handler of such an event, the bpf
> > > handler will not be triggered.
> > > 
> > > This fix returns the error EOPNOTSUPP to indicate that attaching a bpf
> > > handler to a perf event of type software/dummy is not supported.
> > > 
> > > Signed-off-by: Florian Lehner <dev@...-flo.net>
> > It is missing a Fixes tag.
> 
> I don't think it actually fixes anything. worse it could break things.
> 
> Atatching a bpf filter to a dummy event is pointless, but harmless. We
> allow it now, disallowing it will break whatever programs out there are
> doing harmless silly things.
> 
> I really don't see the point of this patch. It grows the kernel code for
> absolutely no distinguishable benefit.

I agree, this fix does not implement the functionality of attaching a
bpf handler to a perf event of type software/dummy. Instead it returns
an error code and let the user know that this kind of action is not
supported (yet).
As a user I would prefer to get an error for something that is pointless
than needing to debug why an attached bpf handler is never execute.

Do you think it would be better to improve documentation to point this
out? And if so, which documentation would be best to update?