linux-kernel - Re: [PATCHv2 bpf 3/3] bpf: Force cookies array to follow symbols sorting

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAADnVQJGoM9eqcODx2LGo-qLo0=O05gSw=iifRsWXgU0XWifAA@mail.gmail.com>
Date:   Tue, 7 Jun 2022 21:10:32 -0700
From:   Alexei Starovoitov <alexei.starovoitov@...il.com>
To:     Jiri Olsa <olsajiri@...il.com>
Cc:     Alexei Starovoitov <ast@...nel.org>,
        Daniel Borkmann <daniel@...earbox.net>,
        Andrii Nakryiko <andrii@...nel.org>,
        Network Development <netdev@...r.kernel.org>,
        bpf <bpf@...r.kernel.org>, lkml <linux-kernel@...r.kernel.org>,
        Martin KaFai Lau <kafai@...com>,
        Song Liu <songliubraving@...com>, Yonghong Song <yhs@...com>,
        John Fastabend <john.fastabend@...il.com>,
        KP Singh <kpsingh@...omium.org>,
        Steven Rostedt <rostedt@...dmis.org>,
        Masami Hiramatsu <mhiramat@...nel.org>
Subject: Re: [PATCHv2 bpf 3/3] bpf: Force cookies array to follow symbols sorting

On Tue, Jun 7, 2022 at 12:56 PM Jiri Olsa <olsajiri@...il.com> wrote:
>
> On Tue, Jun 07, 2022 at 11:40:47AM -0700, Alexei Starovoitov wrote:
> > On Mon, Jun 6, 2022 at 11:48 AM Jiri Olsa <jolsa@...nel.org> wrote:
> > >
> > > When user specifies symbols and cookies for kprobe_multi link
> > > interface it's very likely the cookies will be misplaced and
> > > returned to wrong functions (via get_attach_cookie helper).
> > >
> > > The reason is that to resolve the provided functions we sort
> > > them before passing them to ftrace_lookup_symbols, but we do
> > > not do the same sort on the cookie values.
> > >
> > > Fixing this by using sort_r function with custom swap callback
> > > that swaps cookie values as well.
> > >
> > > Fixes: 0236fec57a15 ("bpf: Resolve symbols with ftrace_lookup_symbols for kprobe multi link")
> > > Signed-off-by: Jiri Olsa <jolsa@...nel.org>
> >
> > It looks good, but something in this patch is causing a regression:
> > ./test_progs -t kprobe_multi
> > test_kprobe_multi_test:PASS:load_kallsyms 0 nsec
> > #80/1    kprobe_multi_test/skel_api:OK
> > #80/2    kprobe_multi_test/link_api_addrs:OK
> > #80/3    kprobe_multi_test/link_api_syms:OK
> > #80/4    kprobe_multi_test/attach_api_pattern:OK
> > #80/5    kprobe_multi_test/attach_api_addrs:OK
> > #80/6    kprobe_multi_test/attach_api_syms:OK
> > #80/7    kprobe_multi_test/attach_api_fails:OK
> > test_bench_attach:PASS:get_syms 0 nsec
> > test_bench_attach:PASS:kprobe_multi_empty__open_and_load 0 nsec
> > libbpf: prog 'test_kprobe_empty': failed to attach: No such process
> > test_bench_attach:FAIL:bpf_program__attach_kprobe_multi_opts
> > unexpected error: -3
> > #80/8    kprobe_multi_test/bench_attach:FAIL
> > #80      kprobe_multi_test:FAIL
>
> looks like kallsyms search failed to find some symbol,
> but I can't reproduce with:
>
>   ./vmtest.sh -- ./test_progs -t kprobe_multi
>
> can you share .config you used?

I don't think it's config related.
Patch 2 is doing:

- if (!bsearch(&name, args->syms, args->cnt, sizeof(*args->syms), symbols_cmp))
+ sym = bsearch(&name, args->syms, args->cnt, sizeof(*args->syms), symbols_cmp);
+ if (!sym)
+ return 0;
+
+ idx = sym - args->syms;
+ if (args->addrs[idx])
  return 0;

  addr = ftrace_location(addr);
  if (!addr)
  return 0;

- args->addrs[args->found++] = addr;
+ args->addrs[idx] = addr;
+ args->found++;
  return args->found == args->cnt ? 1 : 0;

There are plenty of functions with the same name
in available_filter_functions.
So
 if (args->addrs[idx])
  return 0;
triggers for a lot of them.
At the end args->found != args->cnt.

Here is trivial debug patch:
diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
index 601ccf1b2f09..c567cf56cb57 100644
--- a/kernel/trace/ftrace.c
+++ b/kernel/trace/ftrace.c
@@ -8037,8 +8037,10 @@ static int kallsyms_callback(void *data, const
char *name,
                return 0;

        idx = sym - args->syms;
-       if (args->addrs[idx])
+       if (args->addrs[idx]) {
+               printk("idx %x name %s\n", idx, name);
                return 0;
+       }

        addr = ftrace_location(addr);
        if (!addr)
@@ -8078,6 +8080,7 @@ int ftrace_lookup_symbols(const char
**sorted_syms, size_t cnt, unsigned long *a
        err = kallsyms_on_each_symbol(kallsyms_callback, &args);
        if (err < 0)
                return err;
+       printk("found %zd cnt %zd\n", args.found, args.cnt);
        return args.found == args.cnt ? 0 : -ESRCH;
 }

[   13.096160] idx a500 name unregister_vclock
[   13.096930] idx 82fb name pt_regs_offset
[   13.106969] idx 92be name set_root
[   13.107290] idx 4414 name event_function
[   13.112570] idx 7d1d name phy_init
[   13.114459] idx 7d13 name phy_exit
[   13.114777] idx ab91 name watchdog
[   13.115730] found 46921 cnt 47036

I don't understand how it works for you at all.
It passes in BPF CI only because we don't run
kprobe_multi_test/bench_attach there (yet).