netdev - Behavior of pinned perf event array

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <6CAD359B-F446-4C5D-9C71-3902762ED8D6@fb.com>
Date:   Mon, 24 Aug 2020 23:57:38 +0000
From:   Song Liu <songliubraving@...com>
To:     Daniel Borkmann <daniel@...earbox.net>, bpf <bpf@...r.kernel.org>,
        Networking <netdev@...r.kernel.org>
CC:     Andrii Nakryiko <andrii.nakryiko@...il.com>,
        Alexei Starovoitov <ast@...nel.org>,
        Kernel Team <Kernel-team@...com>
Subject: Behavior of pinned perf event array

Hi Daniel, 

We are looking at sharing perf events amount multiple processes via 
pinned perf event array. However, we found this doesn't really work 
as the perf event is removed from the map when the struct file is
released from user space (in perf_event_fd_array_release). This 
means, the pinned perf event array can be shared among multiple 
process. But each perf event still has single owner. Once the owner 
process closes the fd (or terminates), the perf event is removed 
from the array. I went thought the history of the code and found 
this behavior is actually expected (commit 3b1efb196eee). 

In our use case, however, we want to share the perf event among 
different processes. I think we have a few options to achieve this:

1. Introduce a new flag for the perf event map, like BPF_F_KEEP_PE_OPEN.
   Once this flag is set, we should not remove the fd on struct file 
   release. Instead, we remove fd in map_release_uref. 

2. Allow a different process to hold reference to the perf_event 
   via pinned perf event array. I guess we can achieve this by 
   enabling for BPF_MAP_UPDATE_ELEM perf event array. 

3. Other ideas?

Could you please let us know your thoughts on this?

Thanks,
Song