linux-kernel - Re: [PATCH 2/3] perf callchain: Stop resolving callchains after invalid address

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20151126074335.GA18742@gmail.com>
Date:	Thu, 26 Nov 2015 08:43:35 +0100
From:	Ingo Molnar <mingo@...nel.org>
To:	Namhyung Kim <namhyung@...nel.org>
Cc:	Arnaldo Carvalho de Melo <acme@...nel.org>,
	Peter Zijlstra <a.p.zijlstra@...llo.nl>,
	Jiri Olsa <jolsa@...hat.com>,
	LKML <linux-kernel@...r.kernel.org>,
	David Ahern <dsahern@...il.com>,
	Kan Liang <kan.liang@...el.com>,
	Frederic Weisbecker <fweisbec@...il.com>,
	Andi Kleen <andi@...stfloor.org>,
	Wang Nan <wangnan0@...wei.com>
Subject: Re: [PATCH 2/3] perf callchain: Stop resolving callchains after
 invalid address


* Namhyung Kim <namhyung@...nel.org> wrote:

> Unwinding optimized binaries using frame pointer gives garbage.  Check
> callchain address and stop if it's under vm.mmap_min_addr sysctl value.
> 
> Before:
>   $ perf report --stdio --no-children -g callee
>   ...
> 
>    1.37%  perf    [kernel.vmlinux]    [k] smp_call_function_single
>                |
>                ---smp_call_function_single
>                   _perf_event_enable
>                   perf_event_for_each_child
>                   perf_ioctl
>                   do_vfs_ioctl
>                   sys_ioctl
>                   entry_SYSCALL_64_fastpath
>                   __GI___ioctl
>                   0
>                   0
>                   0x1c5aa70
>                   0x1c5b910
>                   0x1c5aa70
>                   0x1c5b910
>                   0x1c5aa70
>                   0x1c5b910
>                   0x1c5aa70
>                   0x1c5b910
>                   0x1c5aa70
>                   0x1c5b910
> 		  ...
> 
> After:
>   $ perf report --stdio --no-children -g callee
>   ...
> 
>    1.37%  perf    [kernel.vmlinux]    [k] smp_call_function_single
>                |
>                ---smp_call_function_single
>                   _perf_event_enable
>                   perf_event_for_each_child
>                   perf_ioctl
>                   do_vfs_ioctl
>                   sys_ioctl
>                   entry_SYSCALL_64_fastpath
>                   __GI___ioctl

In addition to that, would it make sense to terminate the callchain with an 
indicator that we found something anomalous? Such an extra line:

                    ...

would not be intrusive, but would tell the informed reader that it's not a normal 
ending of the call chain.

This assumes that we can tell apart 'normal end of call chain' from 'seems to end 
with garbage poiner' cases - can do we that?

Thanks,

	Ingo
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/