linux-kernel - Re: [PATCH v3 3/3] bpf: make bpf_dump_raw_ok() based on CONFIG

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <131e23cc-1693-bcc7-c9e5-1d51bd8ec930@huawei.com>
Date:   Mon, 5 Jun 2023 19:46:29 +0800
From:   "Leizhen (ThunderTown)" <thunder.leizhen@...wei.com>
To:     Maninder Singh <maninder1.s@...sung.com>, <ast@...nel.org>,
        <daniel@...earbox.net>, <john.fastabend@...il.com>,
        <andrii@...nel.org>, <martin.lau@...ux.dev>, <song@...nel.org>,
        <yhs@...com>, <kpsingh@...nel.org>, <sdf@...gle.com>,
        <haoluo@...gle.com>, <jolsa@...nel.org>, <mcgrof@...nel.org>,
        <boqun.feng@...il.com>, <vincenzopalazzodev@...il.com>,
        <ojeda@...nel.org>, <jgross@...e.com>, <brauner@...nel.org>,
        <michael.christie@...cle.com>, <samitolvanen@...gle.com>,
        <glider@...gle.com>, <peterz@...radead.org>,
        <keescook@...omium.org>, <stephen.s.brennan@...cle.com>,
        <alan.maguire@...cle.com>, <pmladek@...e.com>
CC:     <linux-kernel@...r.kernel.org>, <bpf@...r.kernel.org>,
        Onkarnath <onkarnath.1@...sung.com>
Subject: Re: [PATCH v3 3/3] bpf: make bpf_dump_raw_ok() based on
 CONFIG_KALLSYMS



On 2023/6/5 12:07, Maninder Singh wrote:
> bpf_dump_raw_ok() depends on kallsyms_show_value() and we already
> have a false definition for the !CONFIG_KALLSYMS case. But we have
> expanded kallsyms_show_value() to work for !CONFIG_KALLSYMS case also
> in previous patch.
> 
> And so to make the code easier to follow just provide a direct
> !CONFIG_KALLSYMS definition for bpf_dump_raw_ok() as well.
> 
> As it is heavily dependent on KALLSYMS and checking based on
> kallsyms_show_value() will not work now.

This patch needs to be swapped with 2/3. To avoid unnecessary trouble
for people using "git bisect", assume that they just fall back to patch 2/3.

> 
> Co-developed-by: Onkarnath <onkarnath.1@...sung.com>
> Signed-off-by: Onkarnath <onkarnath.1@...sung.com>
> Signed-off-by: Maninder Singh <maninder1.s@...sung.com>
> Reviewed-by: Luis Chamberlain <mcgrof@...nel.org>
> ---
>  include/linux/filter.h | 14 +++++++++++---
>  1 file changed, 11 insertions(+), 3 deletions(-)
> 
> diff --git a/include/linux/filter.h b/include/linux/filter.h
> index bbce89937fde..1f237a3bb11a 100644
> --- a/include/linux/filter.h
> +++ b/include/linux/filter.h
> @@ -923,13 +923,21 @@ bool bpf_jit_supports_kfunc_call(void);
>  bool bpf_jit_supports_far_kfunc_call(void);
>  bool bpf_helper_changes_pkt_data(void *func);
>  
> +/*
> + * Reconstruction of call-sites is dependent on kallsyms,
> + * thus make dump the same restriction.
> + */
> +#ifdef CONFIG_KALLSYMS
>  static inline bool bpf_dump_raw_ok(const struct cred *cred)
>  {
> -	/* Reconstruction of call-sites is dependent on kallsyms,
> -	 * thus make dump the same restriction.
> -	 */
>  	return kallsyms_show_value(cred);
>  }
> +#else
> +static inline bool bpf_dump_raw_ok(const struct cred *cred)
> +{
> +	return false;
> +}
> +#endif
>  
>  struct bpf_prog *bpf_patch_insn_single(struct bpf_prog *prog, u32 off,
>  				       const struct bpf_insn *patch, u32 len);
> 

-- 
Regards,
  Zhen Lei