netdev - Re: [PATCH v3 bpf-next] bpf: make verifier log more relevant by default

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Sun, 26 Apr 2020 09:57:53 -0700
From:   Alexei Starovoitov <alexei.starovoitov@...il.com>
To:     Andrii Nakryiko <andriin@...com>
Cc:     bpf <bpf@...r.kernel.org>,
        Network Development <netdev@...r.kernel.org>,
        Alexei Starovoitov <ast@...com>,
        Daniel Borkmann <daniel@...earbox.net>,
        Andrii Nakryiko <andrii.nakryiko@...il.com>,
        Kernel Team <kernel-team@...com>
Subject: Re: [PATCH v3 bpf-next] bpf: make verifier log more relevant by default

On Thu, Apr 23, 2020 at 1:04 PM Andrii Nakryiko <andriin@...com> wrote:
>
> To make BPF verifier verbose log more releavant and easier to use to debug
> verification failures, "pop" parts of log that were successfully verified.
> This has effect of leaving only verifier logs that correspond to code branches
> that lead to verification failure, which in practice should result in much
> shorter and more relevant verifier log dumps. This behavior is made the
> default behavior and can be overriden to do exhaustive logging by specifying
> BPF_LOG_LEVEL2 log level.
...
> On success, verbose log will only have a summary of number of processed
> instructions, etc, but no branch tracing log. Having just a last succesful
> branch tracing seemed weird and confusing. Having small and clean summary log
> in success case seems quite logical and nice, though.
>
> Signed-off-by: Andrii Nakryiko <andriin@...com>

I think the behavior described in the last paragraph could be
surprising to some folks who expected to see the verifier log for
successfully loaded progs.
May be worth mentioning this in Documentation/networking/filter.txt ?
That doc needs some cleanup too.

Applied. Thanks