netdev - Re: [PATCH bpf-next 2/3] bpf: Allow using bpf_sk_storage in FENTRY/FEXIT/RAW

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Sat, 7 Nov 2020 00:20:38 +0000
From:   Song Liu <songliubraving@...com>
To:     Martin Lau <kafai@...com>
CC:     "bpf@...r.kernel.org" <bpf@...r.kernel.org>,
        Alexei Starovoitov <ast@...nel.org>,
        Daniel Borkmann <daniel@...earbox.net>,
        Kernel Team <Kernel-team@...com>,
        "netdev@...r.kernel.org" <netdev@...r.kernel.org>
Subject: Re: [PATCH bpf-next 2/3] bpf: Allow using bpf_sk_storage in
 FENTRY/FEXIT/RAW_TP



> On Nov 6, 2020, at 3:18 PM, Martin Lau <kafai@...com> wrote:
> 
> On Fri, Nov 06, 2020 at 02:59:14PM -0800, Song Liu wrote:
>> 
>> 
>>> On Nov 6, 2020, at 2:08 PM, Martin KaFai Lau <kafai@...com> wrote:
>>> 

[...]

>>> +static bool bpf_sk_storage_tracing_allowed(const struct bpf_prog *prog)
>>> +{
>>> +	const struct btf *btf_vmlinux;
>>> +	const struct btf_type *t;
>>> +	const char *tname;
>>> +	u32 btf_id;
>>> +
>>> +	if (prog->aux->dst_prog)
>>> +		return false;
>>> +
>>> +	/* Ensure the tracing program is not tracing
>>> +	 * any *sk_storage*() function and also
>>> +	 * use the bpf_sk_storage_(get|delete) helper.
>>> +	 */
>>> +	switch (prog->expected_attach_type) {
>>> +	case BPF_TRACE_RAW_TP:
>>> +		/* bpf_sk_storage has no trace point */
>>> +		return true;
>>> +	case BPF_TRACE_FENTRY:
>>> +	case BPF_TRACE_FEXIT:
>>> +		btf_vmlinux = bpf_get_btf_vmlinux();
>>> +		btf_id = prog->aux->attach_btf_id;
>>> +		t = btf_type_by_id(btf_vmlinux, btf_id);
>> 
>> What happens to fentry/fexit attach to other BPF programs? I guess
>> we should check for t == NULL?
> It does not support tracing BPF program and using bpf_sk_storage
> at the same time for now, so there is a "if (prog->aux->dst_prog)" test earlier.
> It could be extended to do it later as a follow up.
> I missed to mention that in the commit message.  
> 
> "t" should not be NULL here when tracing a kernel function.
> The verifier should have already checked it and ensured "t" is a FUNC.

Ah, I missed the dst_prog check. Thanks for the explanation. 

Acked-by: Song Liu <songliubraving@...com>