From 3a35170a249b6ead856b574f86e2afcf41ec496b Mon Sep 17 00:00:00 2001 From: Daniel Borkmann Date: Mon, 11 Jun 2018 12:19:05 +0200 Subject: bpf: disable hardening in favor of unwinding I had missed that once hardening is enabled, it automatically disables any exposure of JITed addresses, therefore when crashes or warnings are thrown we don't unwind beyond a helper function. For now disable hardening. After merge window I'll see if it's possible to detangle the case where kernel queries kallsyms internally to find function names whenever a WARN or BUG is thrown. If that's not possible easily, we can potentially add a harden mode 3 which does hardening but does not disable kallsyms exposure and then set this here for tools like syzkaller. Fixes: ac9b19d2e435 ("bpf: enable hardening mode 1 for jited images") Signed-off-by: Daniel Borkmann [dvyukov: also updated dashboard/config/upstream.sysctl] --- dashboard/config/upstream.sysctl | 2 +- tools/create-image.sh | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/dashboard/config/upstream.sysctl b/dashboard/config/upstream.sysctl index 9b6bee039..27e809504 100644 --- a/dashboard/config/upstream.sysctl +++ b/dashboard/config/upstream.sysctl @@ -1,6 +1,6 @@ kernel.watchdog_thresh = 60 net.core.bpf_jit_enable = 1 net.core.bpf_jit_kallsyms = 1 -net.core.bpf_jit_harden = 1 +net.core.bpf_jit_harden = 0 kernel.kptr_restrict = 0 kernel.softlockup_all_cpu_backtrace = 1 diff --git a/tools/create-image.sh b/tools/create-image.sh index 93b067721..a0ad610c8 100755 --- a/tools/create-image.sh +++ b/tools/create-image.sh @@ -24,7 +24,7 @@ echo "kernel.printk = 7 4 1 3" | sudo tee -a $DIR/etc/sysctl.conf echo 'debug.exception-trace = 0' | sudo tee -a $DIR/etc/sysctl.conf echo "net.core.bpf_jit_enable = 1" | sudo tee -a $DIR/etc/sysctl.conf echo "net.core.bpf_jit_kallsyms = 1" | sudo tee -a $DIR/etc/sysctl.conf -echo "net.core.bpf_jit_harden = 1" | sudo tee -a $DIR/etc/sysctl.conf +echo "net.core.bpf_jit_harden = 0" | sudo tee -a $DIR/etc/sysctl.conf echo "kernel.softlockup_all_cpu_backtrace = 1" | sudo tee -a $DIR/etc/sysctl.conf echo "kernel.kptr_restrict = 0" | sudo tee -a $DIR/etc/sysctl.conf echo "kernel.watchdog_thresh = 60" | sudo tee -a $DIR/etc/sysctl.conf -- cgit mrf-deployment