linux-kernel - [BUG] perf: older perf.data files may not be readable

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <BANLkTikcXcfH2OxD9+tTnS6S2svafWq74w@mail.gmail.com>
Date:	Thu, 9 Jun 2011 16:18:37 +0200
From:	Stephane Eranian <eranian@...gle.com>
To:	LKML <linux-kernel@...r.kernel.org>
Cc:	Arnaldo Carvalho de Melo <acme@...hat.com>,
	Peter Zijlstra <peterz@...radead.org>,
	"mingo@...e.hu" <mingo@...e.hu>,
	Frédéric Weisbecker <fweisbec@...il.com>
Subject: [BUG] perf: older perf.data files may not be readable

Arnaldo,

I was looking at util/session.c:

int perf_file_header__read(struct perf_file_header *header,
                           struct perf_header *ph, int fd)
{
        lseek(fd, 0, SEEK_SET);

        if (readn(fd, header, sizeof(*header)) <= 0 ||
            memcmp(&header->magic, __perf_magic, sizeof(header->magic)))
                return -1;

        if (header->attr_size != sizeof(struct perf_file_attr)) {
                u64 attr_size = bswap_64(header->attr_size);

                if (attr_size != sizeof(struct perf_file_attr))
                        return -1;

                mem_bswap_64(header, offsetof(struct perf_file_header,
                                            adds_features));
                ph->needs_swap = true;
        }
        ...
}

struct perf_file_attr {
   struct perf_event_attr attr;
   struct perf_file_section ids;
};

The way you detect endianess leads me to believe that perf will not be
able to cope with growth of perf_event_attr struct AND maintain backward
compatibility with perf.data files saved with smaller perf_event_attr struct.

It should be possible to read perf.data files written with a smaller
perf_event_attr struct. You simply ignore leave the extended fields at zero.

Conversely, you can ignore the fields if the perf.data struct is larger
than that of the tool. But this is the more unlikely scenario, so it's
not that important.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/