linux-kernel - Re: [PATCHv2 bpf 3/3] bpf: Force cookies array to follow symbols sorting

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Yp+tTsqPOuVdjpba@krava>
Date:   Tue, 7 Jun 2022 21:55:58 +0200
From:   Jiri Olsa <olsajiri@...il.com>
To:     Alexei Starovoitov <alexei.starovoitov@...il.com>
Cc:     Alexei Starovoitov <ast@...nel.org>,
        Daniel Borkmann <daniel@...earbox.net>,
        Andrii Nakryiko <andrii@...nel.org>,
        Network Development <netdev@...r.kernel.org>,
        bpf <bpf@...r.kernel.org>, lkml <linux-kernel@...r.kernel.org>,
        Martin KaFai Lau <kafai@...com>,
        Song Liu <songliubraving@...com>, Yonghong Song <yhs@...com>,
        John Fastabend <john.fastabend@...il.com>,
        KP Singh <kpsingh@...omium.org>,
        Steven Rostedt <rostedt@...dmis.org>,
        Masami Hiramatsu <mhiramat@...nel.org>
Subject: Re: [PATCHv2 bpf 3/3] bpf: Force cookies array to follow symbols
 sorting

On Tue, Jun 07, 2022 at 11:40:47AM -0700, Alexei Starovoitov wrote:
> On Mon, Jun 6, 2022 at 11:48 AM Jiri Olsa <jolsa@...nel.org> wrote:
> >
> > When user specifies symbols and cookies for kprobe_multi link
> > interface it's very likely the cookies will be misplaced and
> > returned to wrong functions (via get_attach_cookie helper).
> >
> > The reason is that to resolve the provided functions we sort
> > them before passing them to ftrace_lookup_symbols, but we do
> > not do the same sort on the cookie values.
> >
> > Fixing this by using sort_r function with custom swap callback
> > that swaps cookie values as well.
> >
> > Fixes: 0236fec57a15 ("bpf: Resolve symbols with ftrace_lookup_symbols for kprobe multi link")
> > Signed-off-by: Jiri Olsa <jolsa@...nel.org>
> 
> It looks good, but something in this patch is causing a regression:
> ./test_progs -t kprobe_multi
> test_kprobe_multi_test:PASS:load_kallsyms 0 nsec
> #80/1    kprobe_multi_test/skel_api:OK
> #80/2    kprobe_multi_test/link_api_addrs:OK
> #80/3    kprobe_multi_test/link_api_syms:OK
> #80/4    kprobe_multi_test/attach_api_pattern:OK
> #80/5    kprobe_multi_test/attach_api_addrs:OK
> #80/6    kprobe_multi_test/attach_api_syms:OK
> #80/7    kprobe_multi_test/attach_api_fails:OK
> test_bench_attach:PASS:get_syms 0 nsec
> test_bench_attach:PASS:kprobe_multi_empty__open_and_load 0 nsec
> libbpf: prog 'test_kprobe_empty': failed to attach: No such process
> test_bench_attach:FAIL:bpf_program__attach_kprobe_multi_opts
> unexpected error: -3
> #80/8    kprobe_multi_test/bench_attach:FAIL
> #80      kprobe_multi_test:FAIL

looks like kallsyms search failed to find some symbol,
but I can't reproduce with:

  ./vmtest.sh -- ./test_progs -t kprobe_multi

can you share .config you used?

thanks,
jirka

> 
> CI is unfortunately green, because we don't run it there:
> #80/1 kprobe_multi_test/skel_api:OK
> #80/2 kprobe_multi_test/link_api_addrs:OK
> #80/3 kprobe_multi_test/link_api_syms:OK
> #80/4 kprobe_multi_test/attach_api_pattern:OK
> #80/5 kprobe_multi_test/attach_api_addrs:OK
> #80/6 kprobe_multi_test/attach_api_syms:OK
> #80/7 kprobe_multi_test/attach_api_fails:OK
> #80 kprobe_multi_test:OK