linux-kernel - Re: [PATCH] tools lib traceevent: Mask higher bits of str addresses for 32-bit traces

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 18 Sep 2015 11:55:47 +0100
From:	Kapileshwar Singh <kapileshwar.singh@....com>
To:	Namhyung Kim <namhyung@...nel.org>
CC:	Steven Rostedt <rostedt@...dmis.org>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	Arnaldo Carvalho de Melo <acme@...hat.com>,
	Javi Merino <Javi.Merino@....com>,
	David Ahern <dsahern@...il.com>, Jiri Olsa <jolsa@...nel.org>
Subject: Re: [PATCH] tools lib traceevent: Mask higher bits of str addresses
 for 32-bit traces

Hi Namhyung, 

Thanks for looking into this!

On 17/09/15 16:26, Namhyung Kim wrote:
> Hi,
> 
> On Thu, Sep 17, 2015 at 11:58 PM, Kapileshwar Singh
> <kapileshwar.singh@....com> wrote:
>> Hi Steve,
>>
>> Thanks for looking into this!
>>
>> On 17/09/15 14:11, Steven Rostedt wrote:
>>> On Thu, 17 Sep 2015 12:14:36 +0100
>>> Kapileshwar Singh <kapileshwar.singh@....com> wrote:
>>>
>>>> When a trace recorded on a 32-bit device is processed with a 64-bit
>>>> binary, the higher 32-bits of the address need to be masked.
>>>>
>>>> The lack of this results in the output of the 64-bit pointer
>>>> value to the trace as the 32-bit address lookup fails in find_printk.
>>>>
>>>> Before:
>>>> burn-1778  [003]   548.600305: bputs:   0xc0046db2s: 2cec5c058d98c
>>>>
>>>> After:
>>>> burn-1778  [003]   548.600305: bputs:        0xc0046db2s: RT throttling activated
>>>>
>>>> The problem occurs in PRINT_FEILD when the field is recognized as a pointer
>>>> to a string (of the type const char *)
>>>
>>> Actually, there's two bugs here. You only fixed one of them.
>>>
>>>>
>>>> Cc: Steven Rostedt <rostedt@...dmis.org>
>>>> Cc: Arnaldo Carvalho de Melo <acme@...hat.com>
>>>> Cc: Namhyung Kim <namhyung@...nel.org>
>>>> Cc: Javi Merino <javi.merino@....com>
>>>> Cc: David Ahern <dsahern@...il.com>
>>>> Cc: Jiri Olsa <jolsa@...nel.org>
>>>> Reported-by: Juri-Lelli <juri.lelli@....com>
>>>> Signed-off-by: Kapileshwar Singh <kapileshwar.singh@....com>
>>>> ---
>>>>  tools/lib/traceevent/event-parse.c | 11 +++++++++++
>>>>  1 file changed, 11 insertions(+)
>>>>
>>>> diff --git a/tools/lib/traceevent/event-parse.c b/tools/lib/traceevent/event-parse.c
>>>> index 4d885934b919..39163ea4a048 100644
>>>> --- a/tools/lib/traceevent/event-parse.c
>>>> +++ b/tools/lib/traceevent/event-parse.c
>>>> @@ -3829,6 +3829,17 @@ static void print_str_arg(struct trace_seq *s, void *data, int size,
>>>>              if (!(field->flags & FIELD_IS_ARRAY) &&
>>>>                  field->size == pevent->long_size) {
>>>>                      addr = *(unsigned long *)(data + field->offset);
>>>
>>> addr is of type unsigned long. That means if we read a 64 bit record on
>>> a 32 bit machine (which is supported), this will be truncated.
>>>
>>> Perhaps we need to make addr into a unsigned long long, and then add:
>>>
>>>       addr = (pevent->long_size == 8) ?
>>>               *(unsigned long long *)(data + field->offset) :
>>>               (unsigned long long )*(unsigned int *)(data + field->offset);
> 
> What about this? (untested)
> 
>     addr = *(uint64_t *)(data + field->offset) &
>                         ((1ULL << pevent->long_size * 8) - 1);

I tested this and it works fine.

> 
> Do we also need to consider byte endians?  Maybe it'd be better adding
> a helper to dereference pointers then..

In this particular case, since the address is just a key for a lookup into the 
printk_map, which seems like a (addr -> const char *) mapping for string 
literals in the trace file, the endian-ness should not matter (I could be wrong though).

Regards, 
KP
> 
> Thanks,
> Namhyung
> 

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/