On Wed, Nov 27, 2024 at 12:10:00PM +0100, Marco Elver wrote:
> The warning message for bpf_probe_write_user() was introduced in
> 96ae52279594 ("bpf: Add bpf_probe_write_user BPF helper to be called in
> tracers"), with the following in the commit message:
>
> Given this feature is meant for experiments, and it has a risk of
> crashing the system, and running programs, we print a warning on
> when a proglet that attempts to use this helper is installed,
> along with the pid and process name.
>
> After 8 years since 96ae52279594, bpf_probe_write_user() has found
> successful applications beyond experiments [1, 2], with no other good
> alternatives. Despite its intended purpose for "experiments", that
> doesn't stop Hyrum's law, and there are likely many more users depending
> on this helper: "[..] it does not matter what you promise [..] all
> observable behaviors of your system will be depended on by somebody."
>
> The ominous "helper that may corrupt user memory!" has offered no real
> benefit, and has been found to lead to confusion where the system
> administrator is loading programs with valid use cases.
>
> As such, remove the warning message.
>
> Link: https://lore.kernel.org/lkml/[email protected]/
> [1]
> Link:
> https://lore.kernel.org/r/lkml/caan3qoumd81-vxllfep0h6rrd74ho2vaekdl4hjkq+y1t9k...@mail.gmail.com/
> [2]
> Link:
> https://lore.kernel.org/all/CAEf4Bzb4D_=zujrg3pawmow3kqf8jvjm9swf81_xhr2+u5h...@mail.gmail.com/
> Signed-off-by: Marco Elver <[email protected]>
Acked-by: Jiri Olsa <[email protected]>
jirka
> ---
> v2:
> * Just delete the message entirely (suggested by Andrii Nakryiko)
> ---
> kernel/trace/bpf_trace.c | 3 ---
> 1 file changed, 3 deletions(-)
>
> diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
> index 630b763e5240..0ab56af2e298 100644
> --- a/kernel/trace/bpf_trace.c
> +++ b/kernel/trace/bpf_trace.c
> @@ -362,9 +362,6 @@ static const struct bpf_func_proto
> *bpf_get_probe_write_proto(void)
> if (!capable(CAP_SYS_ADMIN))
> return NULL;
>
> - pr_warn_ratelimited("%s[%d] is installing a program with
> bpf_probe_write_user helper that may corrupt user memory!",
> - current->comm, task_pid_nr(current));
> -
> return &bpf_probe_write_user_proto;
> }
>
> --
> 2.47.0.338.g60cca15819-goog
>
