linux-kernel - Re: ftrace_direct (used by bpf trampoline) conflicts with live patch

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <F5F02F6F-EEC1-4EB9-9755-97FF29D28A39@fb.com>
Date:   Fri, 1 Apr 2022 21:49:39 +0000
From:   Song Liu <songliubraving@...com>
To:     Steven Rostedt <rostedt@...dmis.org>
CC:     open list <linux-kernel@...r.kernel.org>,
        bpf <bpf@...r.kernel.org>, Ingo Molnar <mingo@...hat.com>,
        Kernel Team <Kernel-team@...com>
Subject: Re: ftrace_direct (used by bpf trampoline) conflicts with live patch



> On Mar 31, 2022, at 6:52 PM, Steven Rostedt <rostedt@...dmis.org> wrote:
> 
> On Thu, 31 Mar 2022 21:48:36 -0400
> Steven Rostedt <rostedt@...dmis.org> wrote:
> 
>>> Does this make sense to you? Did I miss something?  
>> 
>> I thought the BPF trampoline does:
>> 
>> 	call bpf_trace_before_function
>> 	call original_function + X86_PATCH_SIZE
>> 	call bpf_trace_after_function
>> 
>> Thus, the bpf direct trampoline calls the unpatched version of the
>> function call making the live patch useless. Or is this not what it
>> does?
> 
> Or perhaps you are only talking about the part of bpf that does not
> trace the end of a function?

Yeah, we do call original_function + X86_PATCH_SIZE if there is 
fexit or fmod_ret programs. So this alone is not enough to make the 
two work together. :(

Let me see how can we fix it...

Thanks,
Song