linux-kernel - Re: [PATCH v3 5/5] selftests/ftrace: Update fprobe test to check enabled

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250226084759.05a4d573@gandalf.local.home>
Date: Wed, 26 Feb 2025 08:47:59 -0500
From: Steven Rostedt <rostedt@...dmis.org>
To: Heiko Carstens <hca@...ux.ibm.com>
Cc: linux-kernel@...r.kernel.org, linux-trace-kernel@...r.kernel.org, Masami
 Hiramatsu <mhiramat@...nel.org>, Mark Rutland <mark.rutland@....com>,
 Mathieu Desnoyers <mathieu.desnoyers@...icios.com>, Andrew Morton
 <akpm@...ux-foundation.org>, Sven Schnelle <svens@...ux.ibm.com>, Vasily
 Gorbik <gor@...ux.ibm.com>, Alexander Gordeev <agordeev@...ux.ibm.com>
Subject: Re: [PATCH v3 5/5] selftests/ftrace: Update fprobe test to check
 enabled_functions file

On Wed, 26 Feb 2025 11:50:28 +0100
Heiko Carstens <hca@...ux.ibm.com> wrote:

> Bah.. :) this doesn't work always, since at least with Fedora 41 the
> assumption that there are zero enabled functions before this test is
> executed is not necessarily true:
> 
> # cat tracing/enabled_functions 
> free_user_ns (1) R         
> bpf_lsm_path_mkdir (1) R   D   M        tramp: ftrace_regs_caller+0x0/0x68 (call_direct_funcs+0x0/0x20)
>         direct-->bpf_trampoline_6442505669+0x0/0x148
> bpf_lsm_path_mknod (1) R   D   M        tramp: ftrace_regs_caller+0x0/0x68 (call_direct_funcs+0x0/0x20)
>         direct-->bpf_trampoline_6442505671+0x0/0x14e

After I submitted the patches, I then remembered that some user space tools
add BPF programs that attach to functions, and those will show up in the
enabled_functions table (that's a feature as it is always good to know what
is modifying your kernel!). And I figured it will break this test.

I decided to wait until someone complains about it before fixing it ;-)

> ...
> 
> I didn't stumble across this before, since I tried a monolithic kernel
> without modules when verifying your series; and then there aren't any
> enabled functions. But with modules there are.
> 
> This could be worked around for example with something like the patch
> below (against linux-next). But no idea what your preferred way to
> handle this would be.

Actually, when I thought about fixing this, your patch is pretty much what
I was thinking of doing.

-- Steve