linux-kernel - Re: [RFC][PATCH 5/5] tracing/filters: Provide support for char * pointers

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 6 Aug 2009 01:02:59 +0200
From:	Frederic Weisbecker <fweisbec@...il.com>
To:	Li Zefan <lizf@...fujitsu.com>
Cc:	Ingo Molnar <mingo@...e.hu>, LKML <linux-kernel@...r.kernel.org>,
	Steven Rostedt <rostedt@...dmis.org>,
	Lai Jiangshan <laijs@...fujitsu.com>,
	Tom Zanussi <tzanussi@...il.com>,
	Thomas Gleixner <tglx@...utronix.de>,
	Peter Zijlstra <peterz@...radead.org>
Subject: Re: [RFC][PATCH 5/5] tracing/filters: Provide support for char *
	pointers

On Mon, Aug 03, 2009 at 02:58:15PM +0800, Li Zefan wrote:
> Frederic Weisbecker wrote:
> > Provide support for char * pointers in the filtering framework.
> > Usually, char * entries are dangerous in traces because the string
> > can be released whereas a pointer to it can still wait to be read from
> > the ring buffer. But sometimes we can assume it's safe, like in case
> > of RO data (eg: __file__ or __line__, used in bkl trace event). If
> > these RO data are in a module and so is the call to the trace event,
> > then it's safe, because the ring buffer will be flushed once this
> > module get unloaded.
> > 
> 
> The problem is we don't distinguish dangerous char * from
> safe char *... They are both defined as:
> 	__field(char *, str)
> 
> So for those dangerous ones, a string filter still can be applied,
> which will dereference those pointers.


Yeah, but only reviewing can distinguish them. It depends on the
context.
IMO, a __builtin_constant check would be wrong. I don't remember who
posted recently tracepoints with char * types that were safe although he
didn't use string constants.



> > Now the bkl events becomes more useful. Say that you want to trace
> > only the bkl use in reiserfs:
> > 
> > cd /debug/tracing/events/bkl/lock_kernel
> > echo "file == fs/reiserfs*" > filter_regex
> > cat /debug/tracing/trace
> > 
> > syslogd-3658  [001]  1874.661878: lock_kernel: depth: 1, fs/reiserfs/super.c:563 reiserfs_dirty_inode()
> > syslogd-3658  [001]  1874.662266: lock_kernel: depth: 0, fs/reiserfs/inode.c:2695 reiserfs_write_end()
> > syslogd-3658  [001]  1874.662268: lock_kernel: depth: 1, fs/reiserfs/super.c:563 reiserfs_dirty_inode()
> > syslogd-3658  [001]  1874.662291: lock_kernel: depth: 0, fs/reiserfs/inode.c:2695 reiserfs_write_end()

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/