netdev - Re: bpf: bpf_probe_read helper restriction on s390x

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <20200706085456.48306-1-sumanthk@linux.ibm.com>
Date:   Mon,  6 Jul 2020 10:54:56 +0200
From:   Sumanth Korikkar <sumanthk@...ux.ibm.com>
To:     jolsa@...hat.com
Cc:     Sumanth.Korikkar@....com, sumanthk@...ux.ibm.com,
        agordeev@...ux.ibm.com, ast@...nel.org, bas@...lab.org,
        bpf@...r.kernel.org, brendan.d.gregg@...il.com,
        daniel@...earbox.net, dxu@...uu.xyz, linux-s390@...r.kernel.org,
        mat@...rchini.me, netdev@...r.kernel.org,
        yauheni.kaliuta@...hat.com
Subject: Re: bpf: bpf_probe_read helper restriction on s390x

Hi Jiri,

Sorry about the noise. My email seems to be rejected to the list. Resending
with plain text.

s390 has overlapping address space. As suggested by the commit,
ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE should not be enabled for s390 kernel.
This should be changed in bpftrace application.

Even if we enable ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE, bpf_probe_read will
only work in certain cases like kernel pointer deferences (kprobes).  User
pointer deferences in uprobes/kprobes/etc will fail or have some invalid data

I am looking forward to this fix: https://github.com/iovisor/bpftrace/pull/1141
OR probe split in bpftrace.

Thank you

Best Regards
Sumanth