netdev - Re: bpf: bpf_probe_read helper restriction on s390x

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20200706101534.GA3401866@krava>
Date:   Mon, 6 Jul 2020 12:15:34 +0200
From:   Jiri Olsa <jolsa@...hat.com>
To:     Sumanth Korikkar <sumanthk@...ux.ibm.com>
Cc:     agordeev@...ux.ibm.com, ast@...nel.org, bas@...lab.org,
        bpf@...r.kernel.org, brendan.d.gregg@...il.com,
        daniel@...earbox.net, dxu@...uu.xyz, linux-s390@...r.kernel.org,
        mat@...rchini.me, netdev@...r.kernel.org,
        yauheni.kaliuta@...hat.com, Sumanth.Korikkar@....com
Subject: Re: bpf: bpf_probe_read helper restriction on s390x

On Mon, Jul 06, 2020 at 08:33:15AM +0200, Sumanth Korikkar wrote:
> Hi Jiri,
> 
> s390 has overlapping address space. As suggested by the commit,
> ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE should not be enabled for s390
> kernel.
> 
> This should be changed in bpftrace application.
> 
> Even if we enable ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE, bpf_probe_read
> will only work in certain cases like kernel pointer deferences (kprobes). 
> User pointer deferences in uprobes/kprobes/etc will fail or have some
> invalid data
> 
> I am looking forward to this fix:
> https://github.com/iovisor/bpftrace/pull/1141 OR probe split in bpftrace.

did not see this, will review ;-) thanks a lot!

jirka

> 
> (Resending as some cc from my email client failed.)
> 
> Thank you
> 
> Best Regards
> Sumanth Korikkar
> > Jiri Olsa <jolsa@...hat.com> wrote on 07/05/2020 09:42:25 PM:
> > 
> > > Subject: [EXTERNAL] bpf: bpf_probe_read helper restriction on s390x
> > >
> > > hi,
> > > with following commit:
> > >   0ebeea8ca8a4 bpf: Restrict bpf_probe_read{, str}() only to archs
> > > where they work
> > >
> > > the bpf_probe_read BPF helper is restricted on architectures that
> > > have 'non overlapping address space' and select following config:
> > >
> > >    select ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE
> > >
> > > there's also nice explanation in this commit's changelog:
> > >   6ae08ae3dea2 bpf: Add probe_read_{user, kernel} and probe_read_
> > > {user, kernel}_str helpers
> > >
> > >
> > > We have a problem with bpftrace not working properly on s390x because
> > > bpf_probe_read is no longer available, and bpftrace does not use
> > > bpf_probe_read_(user/kernel) variants yet.
> > >
> > > My question is if s390x is 'arch with overlapping address space' and we
> > > could fix this by adding ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE for
> > s390x
> > > or we need to fix bpftrace to detect this, which we probably need to do
> > > in any case ;-)
> > >
> > > thanks,
> > > jirka
> > >
> > 
> -- 
> Sumanth Korikkar
>