linux-kernel - Re: [PATCH v2] trace-cmd record: Fix syntax in make_pid

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CADx9qWicRSObEqH+KaE17yUYGBQQkLN1VR2zShNn+JXoFEK-_g@mail.gmail.com>
Date:   Mon, 23 Oct 2017 16:41:22 -0400
From:   Will Hawkins <hawkinsw@...laugic.com>
To:     linux-kernel@...r.kernel.org, Will Hawkins <hawkinsw@...il.com>,
        Steven Rostedt <rostedt@...dmis.org>
Cc:     Will Hawkins <hawkinsw@...laugic.com>
Subject: Re: [PATCH v2] trace-cmd record: Fix syntax in make_pid_filter

Mr. Rostedt,

Just wanted to make sure there was nothing else you thought I should
modify for this patch. If there is, please let me know. I am eager to
fix anything that you think could make it better!

I hope that you had a great weekend!
Will


On Fri, Oct 13, 2017 at 2:40 PM, Will Hawkins <hawkinsw@...laugic.com> wrote:
> In older versions of the kernel, event filtering by
> pid does not use the set_event_pid file. Instead,
> ftrace uses a common filter (created in make_pid_filter)
> to filter events based on PID.
>
> The syntax of the filter generated by this function is
> overly permissive. When filtering by pid, || is used
> where && should be (in certain cases) which means that
> unrelated events are captured.
>
> Signed-off-by: Will Hawkins <hawkinsw@...laugic.com>
> ---
>  trace-record.c | 14 ++++++++------
>  1 file changed, 8 insertions(+), 6 deletions(-)
>
> diff --git a/trace-record.c b/trace-record.c
> index a0b6541..741fe53 100644
> --- a/trace-record.c
> +++ b/trace-record.c
> @@ -935,14 +935,16 @@ static char *make_pid_filter(char *curr_filter, const char *field)
>         str = filter + curr_len;
>
>         for (p = filter_pids; p; p = p->next) {
> -               if (p == filter_pids)
> -                       orit = "";
> -               else
> -                       orit = "||";
> -               if (p->exclude)
> +               if (p->exclude) {
>                         match = "!=";
> -               else
> +                       orit = "&&";
> +               } else {
>                         match = "==";
> +                       orit = "||";
> +               }
> +               if (p == filter_pids)
> +                       orit = "";
> +
>                 len = sprintf(str, "%s(%s%s%d)", orit, field, match, p->pid);
>                 str += len;
>         }
> --
> 2.7.4
>