linux-kernel - Re: [RFC] improve_stack: make stack dump output useful again

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 14 Mar 2014 12:31:58 -0700
From:	Kees Cook <keescook@...omium.org>
To:	Dave Jones <davej@...hat.com>, Kees Cook <keescook@...omium.org>,
	Linus Torvalds <torvalds@...ux-foundation.org>,
	Sasha Levin <sasha.levin@...cle.com>,
	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Subject: Re: [RFC] improve_stack: make stack dump output useful again

On Fri, Mar 14, 2014 at 12:08 PM, Dave Jones <davej@...hat.com> wrote:
> On Fri, Mar 14, 2014 at 11:31:11AM -0700, Kees Cook wrote:
>  > On Thu, Mar 13, 2014 at 4:12 PM, Dave Jones <davej@...hat.com> wrote:
>  > > On Thu, Mar 13, 2014 at 03:03:41PM -0700, Linus Torvalds wrote:
>  > >
>  > >  > You need to look at the *symbol* number. In this output:
>  > >  >
>  > >  >      [<ffffffff810020c2>] do_one_initcall+0xc2/0x1e0
>  > >  >
>  > >  > that "ffffffff810020c2" is crap, and is going away. The address that
>  > >  > is meaningful and valid is the "do_one_initcall+0xc2" part.
>  > >  >
>  > >  > *That* is the part you'd use to parse in user space.
>  > >  >
>  > >  > Try it today with the CONFIG_RANDOMIZE_BASE option to see. Using the
>  > >  > hex number doesn't *work*.
>  > >
>  > > That reminds me, perf top is still busted when this option is enabled.
>  >
>  > Hrm, works for me. I'm not very familiar with what to expect, but
>  > comparing output between kaslr boot and nokaslr boot, it looks the
>  > same to me.
>
> ok, nokalsr makes it work too.
> Booting with that and using the perf binary from 3.14rc6 , I just see..
>
>   9.30%  [kernel]                      [k] 0xffffffffaf18e887
>   7.98%  [kernel]                      [k] 0xffffffffaf3276c7
>   6.10%  [kernel]                      [k] 0xffffffffaf18dd3a
>   4.39%  [kernel]                      [k] 0xffffffffaf327717
>   1.71%  [kernel]                      [k] 0xffffffffaf18e89c
>   1.52%  [kernel]                      [k] 0xffffffffaf3276cc
>
> Curiously, if I use the perf binary from 3.13, I see everything lumped together as..
>
>  95.89%  [kernel].exit.text            [k] 0x000000002e586c26
>
> (When kaslr is disabled both binaries work fine)
>
> Also maybe related: The rc6 binary claims it can't read symbols from vmlinux
> when kaslr is enabled.

Very odd. The perf I built from Linus's tree seems to resolve
everything fine for me. I wonder what we're doing differently. I
literally just did "cd tools/perf; make; scp perf
root@...t-machine:/root; ssh root@...t-machine 'perf top'" and
everything looks fine.

-Kees

-- 
Kees Cook
Chrome OS Security
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/