Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
From:   Song Liu <songliubraving@fb.com>
To:     Ingo Molnar <mingo@kernel.org>
CC:     Vince Weaver <vincent.weaver@maine.edu>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
        Peter Zijlstra <peterz@infradead.org>
Subject: Re: perf: fuzzer leads to trace_kprobe: Could not insert message
 flood
Thread-Topic: perf: fuzzer leads to trace_kprobe: Could not insert message
 flood
Thread-Index: AQHT0NsKF6lgcxb36UeZZJCEysMOEaP6arGAgAEOK4CAAGP5AA==
Date:   Wed, 11 Apr 2018 18:02:37 +0000
Message-ID: <C0B2EFB5-C403-4BDB-9046-C14B3EE66999@fb.com>
References: <alpine.DEB.2.21.1804101043490.6068@macbook-air>
 <A3B3905F-3364-462A-BE02-B01D52482791@fb.com>
 <20180411120447.2gzrwijrtayjv3eg@gmail.com>
In-Reply-To: <20180411120447.2gzrwijrtayjv3eg@gmail.com>
Accept-Language: en-US
Content-Language: en-US
received-spf: None (protection.outlook.com: fb.com does not designate
 permitted sender hosts)
spamdiagnosticoutput: 1:99
spamdiagnosticmetadata: NSPM
Content-Type: text/plain; charset="us-ascii"
Content-ID: <763552D62E7F8B4BB68471725BDF2B8F@namprd15.prod.outlook.com>
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-Network-Message-Id: 869babe2-bbc3-4f4b-aa52-08d59fd66909
X-MS-Exchange-CrossTenant-originalarrivaltime: 11 Apr 2018 18:02:37.5758
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 8ae927fe-1255-47a7-a2af-5f3a069daaa2
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM5PR15MB1562
X-OriginatorOrg: fb.com
X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:,, definitions=2018-04-11_08:,,
 signatures=0
X-Proofpoint-Spam-Reason: safe
X-FB-Internal: Safe
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org


> On Apr 11, 2018, at 5:04 AM, Ingo Molnar <mingo@kernel.org> wrote:
>=20
>=20
> * Song Liu <songliubraving@fb.com> wrote:
>=20
>>=20
>>=20
>>> On Apr 10, 2018, at 7:48 AM, Vince Weaver <vincent.weaver@maine.edu> wr=
ote:
>>>=20
>>> Author: Song Liu <songliubraving@fb.com>
>>> Date:   Wed Dec 6 14:45:15 2017 -0800
>>>=20
>>> When running the perf_fuzzer on a current git checkout my logs are floo=
ded=20
>>> with messages such as this:
>>> [71487.869077] trace_kprobe: Could not insert probe at unknown+0: -22
>>> [71488.174479] trace_kprobe: Could not insert probe at unknown+0: -22
>>>=20
>>> Presumably this is due to the introduction of the perf_kprobe PMU in
>>> 	commit e12f03d7031a977356e3d7b75a68c2185ff8d155
>>> 	Author: Song Liu <songliubraving@fb.com>
>>> 	Date:   Wed Dec 6 14:45:15 2017 -0800
>>>=20
>>> Is there a way to get this error disabled, or else rate-limited?
>>>=20
>>> Vince
>>=20
>> Hi Vince,=20
>>=20
>> Thanks for the report.=20
>>=20
>> This is a new API that creates probe together with perf_event_open(). Ba=
sed on=20
>> my limited understanding of perf_fuzzer, it doesn't understand this API,=
 and uses=20
>> it in an abnormal way. [...]
>=20
> Vince's point is valid: the kernel log should not be flooded with pointle=
ss=20
> messages as a response to user-space ABI uses ...
>=20
> Why is there a kernel log message at all, isn't an error returned?
>=20
>> [...] I would recommend perf_fuzzer to understand this new API and test =
it.=20
>> [...]
>=20
> This bug needs to be fixed: a new API must not effectively DoS fuzzing ef=
forts by=20
> spamming the kernel log ...

Yeah, the new API allows non-root user to trigger this message. We should o=
nly=20
allow root to create kprobe with perf_event_open().=20

On the other hand, do we need to fix this for root? In fact, a simple bash =
loop=20
can create something similar through the text interface (with root):

root@virt-test:~# for x in {0..5} ; do echo p:xx xx+$x >> /sys/kernel/debug=
/tracing/kprobe_events ; done
-bash: echo: write error: No such file or directory
-bash: echo: write error: No such file or directory
-bash: echo: write error: No such file or directory
-bash: echo: write error: No such file or directory
-bash: echo: write error: No such file or directory
-bash: echo: write error: No such file or directory
root@virt-test:~# dmesg | tail -n 5
[  664.208374] trace_kprobe: Could not insert probe at xx+1: -2
[  664.237882] trace_kprobe: Could not insert probe at xx+2: -2
[  664.268067] trace_kprobe: Could not insert probe at xx+3: -2
[  664.297395] trace_kprobe: Could not insert probe at xx+4: -2
[  664.327614] trace_kprobe: Could not insert probe at xx+5: -2

This happens before the new API is introduced.=20

The following patch does capable(CAP_SYS_ADMIN) for perf_kprobe and=20
perf_uprobe at an earlier stage, so non-root user cannot trigger=20
this error message. Please let me know whether we need to fix this=20
for root.=20

Thanks,
Song


From c6708e9e3cd5ba7afb5a7f693b04abf64fec031e Mon Sep 17 00:00:00 2001
From: Song Liu <songliubraving@fb.com>
Date: Wed, 11 Apr 2018 10:37:00 -0700
Subject: [PATCH] perf: need CAP_SYS_ADMIN to create k/uprobe with
 perf_event_open()

Non-root user cannot create kprobe or uprobe through the text-based
interface (kprobe_events, uprobe_events). So they cannot create the
probes with perf_event_open(). To ensure this, we check
capable(CAP_SYS_ADMIN) at perf_[k,u]probe_event_init().

Fixes: e12f03d7031a ("perf/core: Implement the 'perf_kprobe' PMU")
Fixes: 33ea4b24277b ("perf/core: Implement the 'perf_uprobe' PMU")

Signed-off-by: Song Liu <songliubraving@fb.com>
Reported-by: Vince Weaver <vincent.weaver@maine.edu>
Cc: Ingo Molnar <mingo@kernel.org>
---
 kernel/events/core.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/kernel/events/core.c b/kernel/events/core.c
index d7af828..2d5fe26 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -8400,6 +8400,10 @@ static int perf_kprobe_event_init(struct perf_event =
*event)

        if (event->attr.type !=3D perf_kprobe.type)
                return -ENOENT;
+
+       if (!capable(CAP_SYS_ADMIN))
+               return -EACCES;
+
        /*
         * no branch sampling for probe events
         */
@@ -8437,6 +8441,10 @@ static int perf_uprobe_event_init(struct perf_event =
*event)

        if (event->attr.type !=3D perf_uprobe.type)
                return -ENOENT;
+
+       if (!capable(CAP_SYS_ADMIN))
+               return -EACCES;
+
        /*
         * no branch sampling for probe events
         */
--
2.9.5