linux-kernel - Re: [PATCH 1/2] Add trace points to mmap, munmap, and brk

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 2 Sep 2010 14:48:27 +0100
From:	Eric B Munson <emunson@...bm.net>
To:	KOSAKI Motohiro <kosaki.motohiro@...fujitsu.com>
Cc:	akpm@...ux-foundation.org, mingo@...hat.com,
	hugh.dickins@...cali.co.uk, riel@...hat.com, peterz@...radead.org,
	anton@...ba.org, hch@...radead.org, linux-kernel@...r.kernel.org,
	linux-mm@...ck.org
Subject: Re: [PATCH 1/2] Add trace points to mmap, munmap, and brk

On Tue, 27 Jul 2010, KOSAKI Motohiro wrote:

> > On Wed, 21 Jul 2010, KOSAKI Motohiro wrote:
> > 
> > > > This patch adds trace points to mmap, munmap, and brk that will report
> > > > relevant addresses and sizes before each function exits successfully.
> > > > 
> > > > Signed-off-by: Eric B Munson <emunson@...bm.net>
> > > 
> > > I don't think this is good idea. if you need syscall result, you should 
> > > use syscall tracer. IOW, This tracepoint bring zero information.
> > > 
> > > Please see perf_event_mmap() usage. Our kernel manage adress space by
> > > vm_area_struct. we need to trace it if we need to know what kernel does.
> > > 
> > > Thanks.
> > 
> > The syscall tracer does not give you the address and size of the mmaped areas
> > so this does provide information above simply tracing the enter/exit points
> > for each call.
> 
> Why don't you fix this?
> 
> 

Sorry for the long delay, the enter/exit routines are not compatible with the
information that these new trace points provides.  When tracing mmap, for
instance, the addr and len arguments can be altered by the function.  If you
use the enter/exit trace points you would not see this as the arguments are
sampled at function entrance and not given again on exit.  Also, the new
trace points are only hit on function success, the exit trace point happens
any time you leave the system call.

I will send out a new series after a rebase.

Thanks,
Eric

Download attachment "signature.asc" of type "application/pgp-signature" (491 bytes)