netdev - Re: [PATCH bpf-next] selftests/bpf: Fix stat probe in d

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 17 Sep 2020 14:14:38 -0700
From:   Alexei Starovoitov <alexei.starovoitov@...il.com>
To:     Jiri Olsa <jolsa@...hat.com>
Cc:     Jiri Olsa <jolsa@...nel.org>, Alexei Starovoitov <ast@...nel.org>,
        Daniel Borkmann <daniel@...earbox.net>,
        Andrii Nakryiko <andriin@...com>,
        Network Development <netdev@...r.kernel.org>,
        bpf <bpf@...r.kernel.org>, Martin KaFai Lau <kafai@...com>,
        Song Liu <songliubraving@...com>, Yonghong Song <yhs@...com>,
        John Fastabend <john.fastabend@...il.com>,
        KP Singh <kpsingh@...omium.org>
Subject: Re: [PATCH bpf-next] selftests/bpf: Fix stat probe in d_path test

On Thu, Sep 17, 2020 at 1:25 AM Jiri Olsa <jolsa@...hat.com> wrote:
>
> > Ideally resolve_btfids would parse dwarf info and check
> > whether any of the funcs in allowlist were inlined.
> > That would be more reliable, but not pretty to drag libdw
> > dependency into resolve_btfids.
>
> hm, we could add some check to perf|bpftrace that would
> show you all the places where function is called from and
> if it was inlined or is a regular call.. so user is aware
> what probe calls to expect

The check like this belongs in some library,
but making libbpf depend on dwarf is not great.
I think we're at the point where we need to break libbpf
into many libraries. This one could be called libbpftrace.
It would potentially include symbolizer and other dwarf
related operations.
Such inlining check would be good to do not only for d_path
allowlist, but for any kprobe/fentry function.