linux-kernel - Re: [RFC patch 5/7] crash: Add VMCOREINFO_FIELD_AND

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 23 Nov 2017 13:46:48 +0100
From:   Petr Mladek <pmladek@...e.com>
To:     Thomas Gleixner <tglx@...utronix.de>
Cc:     LKML <linux-kernel@...r.kernel.org>,
        Linus Torvalds <torvalds@...uxfoundation.org>,
        Prarit Bhargava <prarit@...hat.com>,
        Mark Salyzyn <salyzyn@...roid.com>,
        Ingo Molnar <mingo@...nel.org>,
        "H. Peter Anvin" <hpa@...or.com>,
        Peter Zijlstra <peterz@...radead.org>,
        Andrew Morton <akpm@...ux-foundation.org>,
        Sergey Senozhatsky <sergey.senozhatsky@...il.com>,
        Steven Rostedt <rostedt@...dmis.org>,
        Joe Perches <joe@...ches.com>,
        Linus Torvalds <torvalds@...ux-foundation.org>
Subject: Re: [RFC patch 5/7] crash: Add VMCOREINFO_FIELD_AND_OFFSET()

On Wed 2017-11-15 19:15:36, Thomas Gleixner wrote:
> Changing the time stamp storage in the printk ringbuffer entries would
> break existing tools which rely on the availability of the 'ts_nsec' field
> in vmcore info.
> 
> Provide a new macro which allows to store the offset of a member of struct
> printk_log with a different name. This allows to change the underlying
> storage and without breaking tools.

It seems that this cheating is not enough. I tried to use it in printk
(6th patch in this patch set) and the "crash" tool complained:

===== cut =====
WARNING: log buf data structure(s) have changed

log: invalid structure member offset: log_ts_nsec
     FILE: kernel.c  LINE: 5055  FUNCTION: dump_log_entry()
===== cut =====


The crash tool get this value using the following code:

  MEMBER_OFFSET_INIT(log_ts_nsec, "printk_log", "ts_nsec");
  + MEMBER_OFFSET()
    + datatype_info((X), (Y), NULL)

, where the last function does something like:

long
datatype_info(char *name, char *member, struct datatype_member *dm)
{
	struct gnu_request *req;

	req->command = GNU_GET_DATATYPE;
	req->name = name;
	req->member = member;

	gdb_interface(req);

I am not completely sure what it does. I guess that gdb
is able to get information about the real types either
from vmlinux binary or vmcore. It is not able to
find "ts_nsec" in the struct "printk_log" and fails.


I am afraid that we would need to fix crash for
the modified struct printk_log. Then this hack
will not be needed.

Best Regards,
Petr