linux-kernel - Re: [PATCH] tools lib traceevent: Mask higher bits of str addresses for 32-bit traces

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 18 Sep 2015 00:26:51 +0900
From:	Namhyung Kim <namhyung@...nel.org>
To:	Kapileshwar Singh <kapileshwar.singh@....com>
Cc:	Steven Rostedt <rostedt@...dmis.org>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	Arnaldo Carvalho de Melo <acme@...hat.com>,
	Javi Merino <Javi.Merino@....com>,
	David Ahern <dsahern@...il.com>, Jiri Olsa <jolsa@...nel.org>
Subject: Re: [PATCH] tools lib traceevent: Mask higher bits of str addresses
 for 32-bit traces

Hi,

On Thu, Sep 17, 2015 at 11:58 PM, Kapileshwar Singh
<kapileshwar.singh@....com> wrote:
> Hi Steve,
>
> Thanks for looking into this!
>
> On 17/09/15 14:11, Steven Rostedt wrote:
>> On Thu, 17 Sep 2015 12:14:36 +0100
>> Kapileshwar Singh <kapileshwar.singh@....com> wrote:
>>
>>> When a trace recorded on a 32-bit device is processed with a 64-bit
>>> binary, the higher 32-bits of the address need to be masked.
>>>
>>> The lack of this results in the output of the 64-bit pointer
>>> value to the trace as the 32-bit address lookup fails in find_printk.
>>>
>>> Before:
>>> burn-1778  [003]   548.600305: bputs:   0xc0046db2s: 2cec5c058d98c
>>>
>>> After:
>>> burn-1778  [003]   548.600305: bputs:        0xc0046db2s: RT throttling activated
>>>
>>> The problem occurs in PRINT_FEILD when the field is recognized as a pointer
>>> to a string (of the type const char *)
>>
>> Actually, there's two bugs here. You only fixed one of them.
>>
>>>
>>> Cc: Steven Rostedt <rostedt@...dmis.org>
>>> Cc: Arnaldo Carvalho de Melo <acme@...hat.com>
>>> Cc: Namhyung Kim <namhyung@...nel.org>
>>> Cc: Javi Merino <javi.merino@....com>
>>> Cc: David Ahern <dsahern@...il.com>
>>> Cc: Jiri Olsa <jolsa@...nel.org>
>>> Reported-by: Juri-Lelli <juri.lelli@....com>
>>> Signed-off-by: Kapileshwar Singh <kapileshwar.singh@....com>
>>> ---
>>>  tools/lib/traceevent/event-parse.c | 11 +++++++++++
>>>  1 file changed, 11 insertions(+)
>>>
>>> diff --git a/tools/lib/traceevent/event-parse.c b/tools/lib/traceevent/event-parse.c
>>> index 4d885934b919..39163ea4a048 100644
>>> --- a/tools/lib/traceevent/event-parse.c
>>> +++ b/tools/lib/traceevent/event-parse.c
>>> @@ -3829,6 +3829,17 @@ static void print_str_arg(struct trace_seq *s, void *data, int size,
>>>              if (!(field->flags & FIELD_IS_ARRAY) &&
>>>                  field->size == pevent->long_size) {
>>>                      addr = *(unsigned long *)(data + field->offset);
>>
>> addr is of type unsigned long. That means if we read a 64 bit record on
>> a 32 bit machine (which is supported), this will be truncated.
>>
>> Perhaps we need to make addr into a unsigned long long, and then add:
>>
>>       addr = (pevent->long_size == 8) ?
>>               *(unsigned long long *)(data + field->offset) :
>>               (unsigned long long )*(unsigned int *)(data + field->offset);

What about this? (untested)

    addr = *(uint64_t *)(data + field->offset) &
                        ((1ULL << pevent->long_size * 8) - 1);

Do we also need to consider byte endians?  Maybe it'd be better adding
a helper to dereference pointers then..

Thanks,
Namhyung
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/