lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date:   Mon, 24 Aug 2020 23:57:38 +0000
From:   Song Liu <>
To:     Daniel Borkmann <>, bpf <>,
        Networking <>
CC:     Andrii Nakryiko <>,
        Alexei Starovoitov <>,
        Kernel Team <>
Subject: Behavior of pinned perf event array

Hi Daniel, 

We are looking at sharing perf events amount multiple processes via 
pinned perf event array. However, we found this doesn't really work 
as the perf event is removed from the map when the struct file is
released from user space (in perf_event_fd_array_release). This 
means, the pinned perf event array can be shared among multiple 
process. But each perf event still has single owner. Once the owner 
process closes the fd (or terminates), the perf event is removed 
from the array. I went thought the history of the code and found 
this behavior is actually expected (commit 3b1efb196eee). 

In our use case, however, we want to share the perf event among 
different processes. I think we have a few options to achieve this:

1. Introduce a new flag for the perf event map, like BPF_F_KEEP_PE_OPEN.
   Once this flag is set, we should not remove the fd on struct file 
   release. Instead, we remove fd in map_release_uref. 

2. Allow a different process to hold reference to the perf_event 
   via pinned perf event array. I guess we can achieve this by 
   enabling for BPF_MAP_UPDATE_ELEM perf event array. 

3. Other ideas?

Could you please let us know your thoughts on this?


Powered by blists - more mailing lists