linux-kernel - Re: [PATCH 1/2] perf-probe: Ensure debuginfo's build-id is correct

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 11 Jan 2018 12:06:31 -0300
From:   Arnaldo Carvalho de Melo <acme@...nel.org>
To:     Masami Hiramatsu <mhiramat@...nel.org>
Cc:     Ravi Bangoria <ravi.bangoria@...ux.vnet.ibm.com>,
        linux-kernel@...r.kernel.org, linux-perf-users@...r.kernel.org
Subject: Re: [PATCH 1/2] perf-probe: Ensure debuginfo's build-id is correct

Em Thu, Jan 11, 2018 at 11:59:32AM -0300, Arnaldo Carvalho de Melo escreveu:
> Em Thu, Jan 11, 2018 at 09:31:19PM +0900, Masami Hiramatsu escreveu:
> > On Thu, 4 Jan 2018 13:17:28 -0300
> > Arnaldo Carvalho de Melo <acme@...nel.org> wrote:
> > > Em Mon, Dec 18, 2017 at 04:29:03PM +0900, Masami Hiramatsu escreveu:
> > > > Ensure that the build-id of debuginfo is correctly matched to
> > > > target build-id, if not, it warns user to check the system
> > > > debuginfo package is correctly installed.

> > > So we look at a variety of files looking for one that has a matching
> > > build-id, I think the warning message should state that the file with
> > > the unmatched build-id is simply being skipped, no?

> > Actually, this patch series came from your request that you faced
> > buildid mismatch between running binary and debuginfo binary, and
> > you asked me to show the message to tell user what he needs to
> > check.

> > > And why do this at 'perf probe -l' time? I.e. at that point whatever
> > > probes that are in place already have all the needed debug info?

> > As I pointed, this is not only for perf-probe -l but also perf-probe -a
> 
> yeah, I recently noticed this while doind a gdb session, where it warned
> about buildid mismatches.

> I'll apply your patch, thanks for working on it!

Trying to test it, got no warning for the vmlinux case, need to
investigate, but have not time right now, so, just for documenting it
here and letting you know:

[root@...et ~]# perf probe $verbose "vfs_getname=getname_flags:72 pathname=result->name:string"
Added new event:
  probe:vfs_getname    (on getname_flags:72 with pathname=result->name:string)

You can now use it in all perf tools, such as:

	perf record -e probe:vfs_getname -aR sleep 1

[root@...et ~]# perf probe -l
  probe:vfs_getname    (on getname_flags:72@...e/git/linux/fs/namei.c with pathname)
[root@...et ~]# 
[root@...et ~]# uname -a
Linux jouet 4.15.0-rc7+ #6 SMP Thu Jan 11 11:39:11 -03 2018 x86_64 x86_64 x86_64 GNU/Linux
[root@...et ~]# mv /lib/modules/4.15.0-rc7+/build/vmlinux /lib/modules/4.15.0-rc7+/build/vmlinux.OFF
[root@...et ~]# cp /lib/modules/4.14.0+/build/vmlinux /lib/modules/4.15.0-rc7+/build/vmlinux
[root@...et ~]# perf probe -l
  probe:vfs_getname    (on getname_flags+147 with pathname)
[root@...et ~]# perf probe -v -l
Opening /sys/kernel/debug/tracing//kprobe_events write=0
Opening /sys/kernel/debug/tracing//uprobe_events write=0
Parsing probe_events: p:probe/vfs_getname _text+2601267 pathname=+0(+0(%bx)):string
Group:probe Event:vfs_getname probe:p
Looking at the vmlinux_path (8 entries long)
symsrc__init: build id mismatch for /lib/modules/4.15.0-rc7+/build/vmlinux.
symsrc__init: cannot get elf header.
Using /proc/kcore for kernel object code
Using /proc/kallsyms for symbols
try to find information at 27b133 in kernel
Looking at the vmlinux_path (8 entries long)
symsrc__init: build id mismatch for /lib/modules/4.15.0-rc7+/build/vmlinux.
Failed to find the path for kernel: No such file or directory
Failed to find corresponding probes from debuginfo.
  probe:vfs_getname    (on getname_flags+147 with pathname)
[root@...et ~]#

- Arnaldo