From 3a35170a249b6ead856b574f86e2afcf41ec496b Mon Sep 17 00:00:00 2001 From: Daniel Borkmann Date: Mon, 11 Jun 2018 12:19:05 +0200 Subject: bpf: disable hardening in favor of unwinding I had missed that once hardening is enabled, it automatically disables any exposure of JITed addresses, therefore when crashes or warnings are thrown we don't unwind beyond a helper function. For now disable hardening. After merge window I'll see if it's possible to detangle the case where kernel queries kallsyms internally to find function names whenever a WARN or BUG is thrown. If that's not possible easily, we can potentially add a harden mode 3 which does hardening but does not disable kallsyms exposure and then set this here for tools like syzkaller. Fixes: ac9b19d2e435 ("bpf: enable hardening mode 1 for jited images") Signed-off-by: Daniel Borkmann [dvyukov: also updated dashboard/config/upstream.sysctl] --- tools/create-image.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'tools/create-image.sh') diff --git a/tools/create-image.sh b/tools/create-image.sh index 93b067721..a0ad610c8 100755 --- a/tools/create-image.sh +++ b/tools/create-image.sh @@ -24,7 +24,7 @@ echo "kernel.printk = 7 4 1 3" | sudo tee -a $DIR/etc/sysctl.conf echo 'debug.exception-trace = 0' | sudo tee -a $DIR/etc/sysctl.conf echo "net.core.bpf_jit_enable = 1" | sudo tee -a $DIR/etc/sysctl.conf echo "net.core.bpf_jit_kallsyms = 1" | sudo tee -a $DIR/etc/sysctl.conf -echo "net.core.bpf_jit_harden = 1" | sudo tee -a $DIR/etc/sysctl.conf +echo "net.core.bpf_jit_harden = 0" | sudo tee -a $DIR/etc/sysctl.conf echo "kernel.softlockup_all_cpu_backtrace = 1" | sudo tee -a $DIR/etc/sysctl.conf echo "kernel.kptr_restrict = 0" | sudo tee -a $DIR/etc/sysctl.conf echo "kernel.watchdog_thresh = 60" | sudo tee -a $DIR/etc/sysctl.conf -- cgit mrf-deployment