linux-kernel - Re: [PATCH] tools lib traceevent: Mask higher bits of str addresses for 32-bit traces

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 17 Sep 2015 09:11:54 -0400
From:	Steven Rostedt <rostedt@...dmis.org>
To:	Kapileshwar Singh <kapileshwar.singh@....com>
Cc:	linux-kernel@...r.kernel.org,
	Arnaldo Carvalho de Melo <acme@...hat.com>,
	Namhyung Kim <namhyung@...nel.org>,
	Javi Merino <javi.merino@....com>,
	David Ahern <dsahern@...il.com>, Jiri Olsa <jolsa@...nel.org>
Subject: Re: [PATCH] tools lib traceevent: Mask higher bits of str addresses
 for 32-bit traces

On Thu, 17 Sep 2015 12:14:36 +0100
Kapileshwar Singh <kapileshwar.singh@....com> wrote:

> When a trace recorded on a 32-bit device is processed with a 64-bit
> binary, the higher 32-bits of the address need to be masked.
> 
> The lack of this results in the output of the 64-bit pointer
> value to the trace as the 32-bit address lookup fails in find_printk.
> 
> Before:
> burn-1778  [003]   548.600305: bputs:   0xc0046db2s: 2cec5c058d98c
> 
> After:
> burn-1778  [003]   548.600305: bputs:	0xc0046db2s: RT throttling activated
> 
> The problem occurs in PRINT_FEILD when the field is recognized as a pointer
> to a string (of the type const char *)

Actually, there's two bugs here. You only fixed one of them.

> 
> Cc: Steven Rostedt <rostedt@...dmis.org>
> Cc: Arnaldo Carvalho de Melo <acme@...hat.com>
> Cc: Namhyung Kim <namhyung@...nel.org>
> Cc: Javi Merino <javi.merino@....com>
> Cc: David Ahern <dsahern@...il.com>
> Cc: Jiri Olsa <jolsa@...nel.org>
> Reported-by: Juri-Lelli <juri.lelli@....com>
> Signed-off-by: Kapileshwar Singh <kapileshwar.singh@....com>
> ---
>  tools/lib/traceevent/event-parse.c | 11 +++++++++++
>  1 file changed, 11 insertions(+)
> 
> diff --git a/tools/lib/traceevent/event-parse.c b/tools/lib/traceevent/event-parse.c
> index 4d885934b919..39163ea4a048 100644
> --- a/tools/lib/traceevent/event-parse.c
> +++ b/tools/lib/traceevent/event-parse.c
> @@ -3829,6 +3829,17 @@ static void print_str_arg(struct trace_seq *s, void *data, int size,
>  		if (!(field->flags & FIELD_IS_ARRAY) &&
>  		    field->size == pevent->long_size) {
>  			addr = *(unsigned long *)(data + field->offset);

addr is of type unsigned long. That means if we read a 64 bit record on
a 32 bit machine (which is supported), this will be truncated.

Perhaps we need to make addr into a unsigned long long, and then add:

	addr = (pevent->long_size == 8) ?
		*(unsigned long long *)(data + field->offset) :
		(unsigned long long )*(unsigned int *)(data + field->offset);



-- Steve


> +
> +			/* In case the long_size is 4. The higher 32bits
> +			 * need to be masked for a successful lookup in
> +			 * in the printk table. As the pointers are 32-bit
> +			 * long. This could happen if a trace recorded on
> +			 * 32-bit platform is processed using a 64-bit
> +			 * binary
> +			 */
> +			if (pevent->long_size == 4)
> +				addr = addr & 0xffffffff;
> +
>  			/* Check if it matches a print format */
>  			printk = find_printk(pevent, addr);
>  			if (printk)

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/