linux-kernel - Re: [PATCH v2 0/2] perf trace: Fix support for the new BPF feature in clang 12

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Zxfv3BupKqhi3zGV@x1>
Date: Tue, 22 Oct 2024 15:33:00 -0300
From: Arnaldo Carvalho de Melo <acme@...nel.org>
To: Namhyung Kim <namhyung@...nel.org>
Cc: Song Liu <songliubraving@...com>, Howard Chu <howardchu95@...il.com>,
	Andrea Righi <andrea.righi@...ux.dev>, peterz@...radead.org,
	mingo@...hat.com, mark.rutland@....com,
	alexander.shishkin@...ux.intel.com, jolsa@...nel.org,
	irogers@...gle.com, adrian.hunter@...el.com,
	kan.liang@...ux.intel.com, linux-perf-users@...r.kernel.org,
	linux-kernel@...r.kernel.org, james.clark@...aro.org,
	alan.maguire@...cle.com
Subject: Re: [PATCH v2 0/2] perf trace: Fix support for the new BPF feature
 in clang 12

On Tue, Oct 22, 2024 at 10:04:52AM -0700, Namhyung Kim wrote:
> Hi Arnaldo,
> 
> On Wed, Oct 16, 2024 at 11:22:15AM -0300, Arnaldo Carvalho de Melo wrote:
> > On Tue, Oct 15, 2024 at 07:06:35PM -0700, Namhyung Kim wrote:
> > > Hi Arnaldo,
> > > 
> > > On Tue, Oct 15, 2024 at 05:37:38PM -0300, Arnaldo Carvalho de Melo wrote:
> > > > On Tue, Oct 15, 2024 at 04:58:56PM -0300, Arnaldo Carvalho de Melo wrote:
> > > > > So I'm trying adding extra bounds checking, marking the index as
> > > > > volatile, adding compiler barriers, etc, all the fun with the verifier,
> > > > > but got distracted with other stuff, coming back to this now.
> > > >  
> > > > > Ok, the following seems to do the trick:
> > > >  
> > > > > [acme@...l-per740-01 perf-tools]$ git diff
> > > > > diff --git a/tools/perf/util/bpf_skel/augmented_raw_syscalls.bpf.c b/tools/perf/util/bpf_skel/augmented_raw_syscalls.bpf.c
> > > > > index 3b30aa74a3ae..ef87a04ff8d0 100644
> > > > > --- a/tools/perf/util/bpf_skel/augmented_raw_syscalls.bpf.c
> > > > > +++ b/tools/perf/util/bpf_skel/augmented_raw_syscalls.bpf.c
> > > > > @@ -486,6 +486,7 @@ static int augment_sys_enter(void *ctx, struct syscall_enter_args *args)
> > > > >                                 augmented = true;
> > > > >                 } else if (size < 0 && size >= -6) { /* buffer */
> > > > >                         index = -(size + 1);
> > > > > +                       index &= 7; // To satisfy the bounds checking with the verifier in some kernels
> > > > >                         aug_size = args->args[index];
> > > > >  
> > > > >                         if (aug_size > TRACE_AUG_MAX_BUF)
> > > > > 
> > > > > I'll now test it without Howard's patch to see if it fixes the RHEL8 +
> > > > > clang 17 case.
> > > > 
> > > > It works with this one-liner + the simplified patch from Howard and also
> > > > on this other system (RHEL9), as well as with Fedora 40, it would be
> > > > nice if someone could test with clang 16 and report back the version of
> > > > the kernel tested as well as the distro name/release, that way I can try
> > > > to get my hands on such as system and test there as well.
> > > > 
> > > > Its all at:
> > > > 
> > > > https://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools.git tmp.perf-tools
> > > > 
> > > > This is the current set of patches that when further tested will go to
> > > > Linus for v6.12:
> > > > 
> > > > ⬢[acme@...lbox perf-tools]$ git log --oneline torvalds/master..
> > > > ff14baa7a290bf42 (HEAD -> perf-tools, x1/perf-tools, perf-tools/tmp.perf-tools) perf trace augmented_raw_syscalls: Add more checks to pass the verifier
> > > > 46180bec048aad85 perf trace augmented_raw_syscalls: Add extra array index bounds checking to satisfy some BPF verifiers
> > > > 45d1aadac64869a2 perf build: Change the clang check back to 12.0.1
> > > 
> > > Wouldn't it be better to have this change after fixing the verifier
> > > issues in the later commits?
> > 
> > I'm still testing it, this is a one-liner, so I think that the order in
> > which the patches are applied isn't important. Also Howard's patch (the
> > simplified one) doesn't clash with it.
> 
> I'm afraid if it'd break git bisect by allowing old clang versions
> before the fix.

I can reorder the patches if you think it is interesting, but from the
extended set of tests I'm performing on different kernel and clang
version and in x86_64 and arm 64-bit, 32-bit and various distros, I'm
not sure bisection is an option for BPF programs at this stage 8-)

There, did it now it looks like this:

⬢ [acme@...lbox perf-tools]$ git log --oneline torvalds/master..
5d3a1b9ca3b1a059 (HEAD -> perf-tools) perf trace arm32: Fix iteration of syscall ids in syscalltbl->entries
34d2358a24fb5963 perf trace augmented_raw_syscalls: Add more checks to pass the verifier
cdb84c31bd2813de perf trace augmented_raw_syscalls: Add extra array index bounds checking to satisfy some BPF verifiers
e5c1811c590c4312 perf build: Change the clang check back to 12.0.1
39c6a356201ebbd7 perf trace: The return from 'write' isn't a pid
ab8aaab874c4aa37 tools headers UAPI: Sync linux/const.h with the kernel headers
⬢ [acme@...lbox perf-tools]$

Is that what you meant?

Thanks,

- Arnaldo