Re: [PATCH v2 1/1] perf/core: Restrict function predicates in trace event filters

[sashiko-bot@kernel.org]

> Count-only perf tracepoint events can be opened without tracepoint
> permission because they do not expose raw sample data. Their
> PERF_EVENT_IOC_SET_FILTER ioctl can still pass filter expressions to the
> tracing parser.
> 
> A .function operand makes the parser resolve either a numeric kernel
> address or a kernel symbol. The ioctl return value can therefore be used
> as an oracle to recover the randomized kernel text base.
> 
> Trace events marked TRACE_EVENT_FL_CAP_ANY are different: task-local
> events may expose their raw fields to unprivileged users. Syscall
> tracepoints and uprobes deliberately use this exception, so denying every
> filter without tracepoint permission would break their ordinary filters.
> 
> Check perf_allow_tracepoint() in perf. If permission is denied, continue
> only for a task-attached TRACE_EVENT_FL_CAP_ANY event whose filter does
> not contain an unquoted .function postfix. This rejects the predicate
> before the tracing parser can resolve either form of operand. The scan
> uses the parser's quote rules, so .function inside a string operand
> remains an ordinary filter value.
> 
> This preserves ordinary filters on task-local events whose fields are
> already available to the caller, while non-CAP_ANY filters and kernel
> address resolution remain unavailable without tracepoint permission.
> 
> Fixes: e6745a4da964 ("tracing: Add a way to filter function addresses to function names")
> Cc: stable@vger.kernel.org
> Assisted-by: LLM
> Signed-off-by: Zhengchuan Liang <zcliangcn@gmail.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/cover.1790891867.git.zcliangcn@gmail.com?part=1