linux-kernel - Re: [PATCH v1 8/8] tracing/bpf: Add might

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <822ba601-700f-4b6a-b300-77423d943410@efficios.com>
Date: Thu, 3 Oct 2024 20:13:24 -0400
From: Mathieu Desnoyers <mathieu.desnoyers@...icios.com>
To: Steven Rostedt <rostedt@...dmis.org>
Cc: Masami Hiramatsu <mhiramat@...nel.org>, linux-kernel@...r.kernel.org,
 Peter Zijlstra <peterz@...radead.org>, Alexei Starovoitov <ast@...nel.org>,
 Yonghong Song <yhs@...com>, "Paul E . McKenney" <paulmck@...nel.org>,
 Ingo Molnar <mingo@...hat.com>, Arnaldo Carvalho de Melo <acme@...nel.org>,
 Mark Rutland <mark.rutland@....com>,
 Alexander Shishkin <alexander.shishkin@...ux.intel.com>,
 Namhyung Kim <namhyung@...nel.org>,
 Andrii Nakryiko <andrii.nakryiko@...il.com>, bpf@...r.kernel.org,
 Joel Fernandes <joel@...lfernandes.org>, linux-trace-kernel@...r.kernel.org,
 Andrii Nakryiko <andrii@...nel.org>, Michael Jeanson <mjeanson@...icios.com>
Subject: Re: [PATCH v1 8/8] tracing/bpf: Add might_fault check to syscall
 probes

On 2024-10-04 00:38, Steven Rostedt wrote:
> On Thu,  3 Oct 2024 11:16:38 -0400
> Mathieu Desnoyers <mathieu.desnoyers@...icios.com> wrote:
> 
>> Add a might_fault() check to validate that the bpf sys_enter/sys_exit
>> probe callbacks are indeed called from a context where page faults can
>> be handled.
>>
>> Signed-off-by: Mathieu Desnoyers <mathieu.desnoyers@...icios.com>
>> Acked-by: Andrii Nakryiko <andrii@...nel.org>
>> Tested-by: Andrii Nakryiko <andrii@...nel.org> # BPF parts
>> Cc: Michael Jeanson <mjeanson@...icios.com>
>> Cc: Steven Rostedt <rostedt@...dmis.org>
>> Cc: Masami Hiramatsu <mhiramat@...nel.org>
>> Cc: Peter Zijlstra <peterz@...radead.org>
>> Cc: Alexei Starovoitov <ast@...nel.org>
>> Cc: Yonghong Song <yhs@...com>
>> Cc: Paul E. McKenney <paulmck@...nel.org>
>> Cc: Ingo Molnar <mingo@...hat.com>
>> Cc: Arnaldo Carvalho de Melo <acme@...nel.org>
>> Cc: Mark Rutland <mark.rutland@....com>
>> Cc: Alexander Shishkin <alexander.shishkin@...ux.intel.com>
>> Cc: Namhyung Kim <namhyung@...nel.org>
>> Cc: Andrii Nakryiko <andrii.nakryiko@...il.com>
>> Cc: bpf@...r.kernel.org
>> Cc: Joel Fernandes <joel@...lfernandes.org>
>> ---
>>   include/trace/bpf_probe.h | 1 +
>>   1 file changed, 1 insertion(+)
>>
>> diff --git a/include/trace/bpf_probe.h b/include/trace/bpf_probe.h
>> index 211b98d45fc6..099df5c3e38a 100644
>> --- a/include/trace/bpf_probe.h
>> +++ b/include/trace/bpf_probe.h
>> @@ -57,6 +57,7 @@ __bpf_trace_##call(void *__data, proto)					\
>>   static notrace void							\
>>   __bpf_trace_##call(void *__data, proto)					\
>>   {									\
>> +	might_fault();							\
> 
> And I think this gets called at places that do not allow faults.

Context matters:

#undef DECLARE_EVENT_SYSCALL_CLASS
#define DECLARE_EVENT_SYSCALL_CLASS(call, proto, args, tstruct, assign, print) \
__DECLARE_EVENT_CLASS(call, PARAMS(proto), PARAMS(args), PARAMS(tstruct), \
                       PARAMS(assign), PARAMS(print))                    \
static notrace void                                                     \
perf_trace_##call(void *__data, proto)                                  \
{                                                                       \
         u64 __count __attribute__((unused));                            \
         struct task_struct *__task __attribute__((unused));             \
                                                                         \
         might_fault();                                                  \
         guard(preempt_notrace)();                                       \
         do_perf_trace_##call(__data, args);                             \
}

Not an issue.

Thanks,

Mathieu

> 
> -- Steve
> 
>>   	guard(preempt_notrace)();					\
>>   	CONCATENATE(bpf_trace_run, COUNT_ARGS(args))(__data, CAST_TO_U64(args));	\
>>   }
> 

-- 
Mathieu Desnoyers
EfficiOS Inc.
https://www.efficios.com