linux-kernel - [bug] wrong result of android callchain

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 5 Jan 2016 17:14:37 +0800
From:	He Kuang <hekuang@...wei.com>
To:	<peterz@...radead.org>, "mingo@...hat.com" <mingo@...hat.com>,
	"Arnaldo Carvalho de Melo" <acme@...nel.org>,
	Jiri Olsa <jolsa@...hat.com>, <rabin.vincent@...s.com>,
	<namhyung@...nel.org>, Wang Nan <wangnan0@...wei.com>
CC:	<linux-kernel@...r.kernel.org>
Subject: [bug] wrong result of android callchain

I found a wrong result of aarch64 callchain when using perf script on
a android phone.

Here's the callchain record fragment from the output of perf script:

   init   369 [002]   339.970607: raw_syscalls:sys_enter: NR 22 (b, 7fd9e360a0, 10, ffffffff, 0, 8)
                      ...
                    230ac [unknown] (/system/lib64/libsurfaceflinger.so)
                     11a0 main (/system/bin/surfaceflinger)
                    1c3fc __libc_init (/system/lib64/libc.so)
                      fd0 _start (/system/bin/surfaceflinger)
                     29ec __dl__start (/system/bin/linker64)

The fault occured in the '[unknown]' line, from objdump result of
/system/bin/surfaceflinger, we can see the branch instruction before
0x11a0:

  # objdump /system/bin/surfaceflinger
     1198:       f9400fe0        ldr     x0, [sp,#24]
     119c:       97ffff05        bl      db0 <_ZN7android14SurfaceFlinger3runEv@plt>
     11a0:       f9400be8        ldr     x8, [sp,#16]
     11a4:       b40000c8        cbz     x8, 11bc <main+0x150>

The function '_ZN7android14SurfaceFlinger3runEv' is located at 0x3a094
~ 0x3a0ac in libsurfaceflinger.so, but perf misparsed that value to
0x230ac:

  # objdump libsurfaceflinger.so
   000000000003a094 <_ZN7android14SurfaceFlinger3runEv>:
     3a094:       a9be4ff4        stp     x20, x19, [sp,#-32]!
     3a098:       a9017bfd        stp     x29, x30, [sp,#16]
     3a09c:       910043fd        add     x29, sp, #0x10
     3a0a0:       910c0013        add     x19, x0, #0x300
     3a0a4:       aa1303e0        mov     x0, x19
     3a0a8:       97fff12f        bl      36564 <_ZN7android12MessageQueue11waitMessageEv>
     3a0ac:       17fffffe        b       3a0a4 <_ZN7android14SurfaceFlinger3runEv+0x10>

There's a difference of 0x17000 between those two offsets, it seems
that this value is the VirtAddr of this dynamic library.

  # readelf -a libsurfaceflinger.so
   Program Headers:
     Type           Offset             VirtAddr           PhysAddr
                    FileSiz            MemSiz              Flags  Align
     LOAD           0x0000000000000000 0x0000000000017000 0x0000000000017000
                    0x0000000000057258 0x0000000000057258  R E    1000


                                                    

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/