netdev - Re: [PATCH] tracepoint: Add tracepoint_probe_register_may

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 7 Jul 2021 16:49:26 -0700
From:   Andrii Nakryiko <andrii.nakryiko@...il.com>
To:     Steven Rostedt <rostedt@...dmis.org>
Cc:     LKML <linux-kernel@...r.kernel.org>,
        syzbot+721aa903751db87aa244@...kaller.appspotmail.com,
        Tetsuo Handa <penguin-kernel@...ove.sakura.ne.jp>,
        Mathieu Desnoyers <mathieu.desnoyers@...icios.com>,
        Ingo Molnar <mingo@...nel.org>,
        Alexei Starovoitov <ast@...nel.org>,
        Daniel Borkmann <daniel@...earbox.net>,
        Andrii Nakryiko <andrii@...nel.org>,
        netdev <netdev@...r.kernel.org>, bpf <bpf@...r.kernel.org>
Subject: Re: [PATCH] tracepoint: Add tracepoint_probe_register_may_exist() for
 BPF tracing

On Wed, Jul 7, 2021 at 3:45 PM Steven Rostedt <rostedt@...dmis.org> wrote:
>
> On Wed, 7 Jul 2021 15:12:28 -0700
> Andrii Nakryiko <andrii.nakryiko@...il.com> wrote:
>
> > There doesn't seem to be anything conceptually wrong with attaching
> > the same BPF program twice to the same tracepoint. Is it a hard
> > requirement to have a unique tp+callback combination, or was it done
> > mostly to detect an API misuse? How hard is it to support such use
> > cases?
> >
> > I was surprised to discover this is not supported (though I never had
> > a use for this, had to construct a test to see the warning).
>
> The callback is identified by the function and its data combination. If
> there's two callbacks calling the same function with the same data on
> the same tracepoint, one question is, why? And the second is how do you
> differentiate the two?

For places where multiple BPF programs can be attached (kprobes,
cgroup programs, etc), we don't put a restriction that all programs
have to be unique. It's totally legal to have the same program
attached multiple times. So having this for tracepoints will be a
one-off behavior.

As for why the user might need that, it's up to the user and I don't
want to speculate because it will always sound contrived without a
specific production use case. But people are very creative and we try
not to dictate how and what can be done if it doesn't break any
fundamental assumption and safety.

>
> -- Steve