linux-kernel - Re: [PATCH bpf-next 2/3] bpf: Add size arg to build_id

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 14 Jan 2021 21:01:20 +0100
From:   Jiri Olsa <jolsa@...hat.com>
To:     Yonghong Song <yhs@...com>
Cc:     Jiri Olsa <jolsa@...nel.org>,
        Arnaldo Carvalho de Melo <acme@...nel.org>,
        Alexei Starovoitov <ast@...nel.org>,
        Song Liu <songliubraving@...com>,
        lkml <linux-kernel@...r.kernel.org>, bpf@...r.kernel.org,
        Peter Zijlstra <a.p.zijlstra@...llo.nl>,
        Ingo Molnar <mingo@...nel.org>,
        Mark Rutland <mark.rutland@....com>,
        Namhyung Kim <namhyung@...nel.org>,
        Alexander Shishkin <alexander.shishkin@...ux.intel.com>,
        Michael Petlan <mpetlan@...hat.com>,
        Ian Rogers <irogers@...gle.com>,
        Stephane Eranian <eranian@...gle.com>,
        Alexei Budankov <abudankov@...wei.com>,
        Andi Kleen <ak@...ux.intel.com>,
        Adrian Hunter <adrian.hunter@...el.com>
Subject: Re: [PATCH bpf-next 2/3] bpf: Add size arg to build_id_parse function

On Thu, Jan 14, 2021 at 10:56:33AM -0800, Yonghong Song wrote:
> 
> 
> On 1/14/21 5:40 AM, Jiri Olsa wrote:
> > It's possible to have other build id types (other than default SHA1).
> > Currently there's also ld support for MD5 build id.
> 
> Currently, bpf build_id based stackmap does not returns the size of
> the build_id. Did you see an issue here? I guess user space can check
> the length of non-zero bits of the build id to decide what kind of
> type it is, right?

you can have zero bytes in the build id hash, so you need to get the size

I never saw MD5 being used in practise just SHA1, but we added the
size to be complete and make sure we'll fit with build id, because
there's only limited space in mmap2 event

jirka

> 
> > 
> > Adding size argument to build_id_parse function, that returns (if defined)
> > size of the parsed build id, so we can recognize the build id type.
> > 
> > Cc: Alexei Starovoitov <ast@...nel.org>
> > Cc: Song Liu <songliubraving@...com>
> > Signed-off-by: Jiri Olsa <jolsa@...nel.org>
> > ---
> >   include/linux/buildid.h |  3 ++-
> >   kernel/bpf/stackmap.c   |  2 +-
> >   lib/buildid.c           | 29 +++++++++++++++++++++--------
> >   3 files changed, 24 insertions(+), 10 deletions(-)
> > 
> > diff --git a/include/linux/buildid.h b/include/linux/buildid.h
> > index 08028a212589..40232f90db6e 100644
> > --- a/include/linux/buildid.h
> > +++ b/include/linux/buildid.h
> > @@ -6,6 +6,7 @@
> >   #define BUILD_ID_SIZE_MAX 20
> > -int build_id_parse(struct vm_area_struct *vma, unsigned char *build_id);
> > +int build_id_parse(struct vm_area_struct *vma, unsigned char *build_id,
> > +		   __u32 *size);
> >   #endif
> > diff --git a/kernel/bpf/stackmap.c b/kernel/bpf/stackmap.c
> > index 55d254a59f07..cabaf7db8efc 100644
> > --- a/kernel/bpf/stackmap.c
> > +++ b/kernel/bpf/stackmap.c
> > @@ -189,7 +189,7 @@ static void stack_map_get_build_id_offset(struct bpf_stack_build_id *id_offs,
> >   	for (i = 0; i < trace_nr; i++) {
> >   		vma = find_vma(current->mm, ips[i]);
> > -		if (!vma || build_id_parse(vma, id_offs[i].build_id)) {
> > +		if (!vma || build_id_parse(vma, id_offs[i].build_id, NULL)) {
> >   			/* per entry fall back to ips */
> >   			id_offs[i].status = BPF_STACK_BUILD_ID_IP;
> >   			id_offs[i].ip = ips[i];
> > diff --git a/lib/buildid.c b/lib/buildid.c
> > index 4a4f520c0e29..6156997c3895 100644
> > --- a/lib/buildid.c
> > +++ b/lib/buildid.c
> > @@ -12,6 +12,7 @@
> >    */
> >   static inline int parse_build_id(void *page_addr,
> >   				 unsigned char *build_id,
> > +				 __u32 *size,
> >   				 void *note_start,
> >   				 Elf32_Word note_size)
> >   {
> > @@ -38,6 +39,8 @@ static inline int parse_build_id(void *page_addr,
> >   			       nhdr->n_descsz);
> >   			memset(build_id + nhdr->n_descsz, 0,
> >   			       BUILD_ID_SIZE_MAX - nhdr->n_descsz);
> > +			if (size)
> > +				*size = nhdr->n_descsz;
> >   			return 0;
> >   		}
> >   		new_offs = note_offs + sizeof(Elf32_Nhdr) +
> > @@ -50,7 +53,8 @@ static inline int parse_build_id(void *page_addr,
> >   }
> [...]
>