linux-kernel - Re: [PATCH] tools lib traceevent: Mask higher bits of str addresses for 32-bit traces

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 17 Sep 2015 15:58:26 +0100
From:	Kapileshwar Singh <kapileshwar.singh@....com>
To:	Steven Rostedt <rostedt@...dmis.org>
CC:	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	Arnaldo Carvalho de Melo <acme@...hat.com>,
	Namhyung Kim <namhyung@...nel.org>,
	Javi Merino <Javi.Merino@....com>,
	David Ahern <dsahern@...il.com>, Jiri Olsa <jolsa@...nel.org>
Subject: Re: [PATCH] tools lib traceevent: Mask higher bits of str addresses
 for 32-bit traces

Hi Steve,

Thanks for looking into this!

On 17/09/15 14:11, Steven Rostedt wrote:
> On Thu, 17 Sep 2015 12:14:36 +0100
> Kapileshwar Singh <kapileshwar.singh@....com> wrote:
> 
>> When a trace recorded on a 32-bit device is processed with a 64-bit
>> binary, the higher 32-bits of the address need to be masked.
>>
>> The lack of this results in the output of the 64-bit pointer
>> value to the trace as the 32-bit address lookup fails in find_printk.
>>
>> Before:
>> burn-1778  [003]   548.600305: bputs:   0xc0046db2s: 2cec5c058d98c
>>
>> After:
>> burn-1778  [003]   548.600305: bputs:	0xc0046db2s: RT throttling activated
>>
>> The problem occurs in PRINT_FEILD when the field is recognized as a pointer
>> to a string (of the type const char *)
> 
> Actually, there's two bugs here. You only fixed one of them.
> 
>>
>> Cc: Steven Rostedt <rostedt@...dmis.org>
>> Cc: Arnaldo Carvalho de Melo <acme@...hat.com>
>> Cc: Namhyung Kim <namhyung@...nel.org>
>> Cc: Javi Merino <javi.merino@....com>
>> Cc: David Ahern <dsahern@...il.com>
>> Cc: Jiri Olsa <jolsa@...nel.org>
>> Reported-by: Juri-Lelli <juri.lelli@....com>
>> Signed-off-by: Kapileshwar Singh <kapileshwar.singh@....com>
>> ---
>>  tools/lib/traceevent/event-parse.c | 11 +++++++++++
>>  1 file changed, 11 insertions(+)
>>
>> diff --git a/tools/lib/traceevent/event-parse.c b/tools/lib/traceevent/event-parse.c
>> index 4d885934b919..39163ea4a048 100644
>> --- a/tools/lib/traceevent/event-parse.c
>> +++ b/tools/lib/traceevent/event-parse.c
>> @@ -3829,6 +3829,17 @@ static void print_str_arg(struct trace_seq *s, void *data, int size,
>>  		if (!(field->flags & FIELD_IS_ARRAY) &&
>>  		    field->size == pevent->long_size) {
>>  			addr = *(unsigned long *)(data + field->offset);
> 
> addr is of type unsigned long. That means if we read a 64 bit record on
> a 32 bit machine (which is supported), this will be truncated.
> 
> Perhaps we need to make addr into a unsigned long long, and then add:
> 
> 	addr = (pevent->long_size == 8) ?
> 		*(unsigned long long *)(data + field->offset) :
> 		(unsigned long long )*(unsigned int *)(data + field->offset);

I agree, we need to handle both cases:

* Traces recorded using 32-bit addresses processed on a 64-bit machine
* Traces recorded using 64-bit addresses processed on a 32-bit machine

The change you suggested fixes both these cases. 

Will send a v2 of the patch with the changes.

Regards, 
KP

> 
> 
> 
> -- Steve
> 
> 
>> +
>> +			/* In case the long_size is 4. The higher 32bits
>> +			 * need to be masked for a successful lookup in
>> +			 * in the printk table. As the pointers are 32-bit
>> +			 * long. This could happen if a trace recorded on
>> +			 * 32-bit platform is processed using a 64-bit
>> +			 * binary
>> +			 */
>> +			if (pevent->long_size == 4)
>> +				addr = addr & 0xffffffff;
>> +
>>  			/* Check if it matches a print format */
>>  			printk = find_printk(pevent, addr);
>>  			if (printk)
> 

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/