linux-kernel - [PATCH 4.18 089/168] perf annotate: Properly interpret indirect call

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon,  8 Oct 2018 20:31:09 +0200
From:   Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To:     linux-kernel@...r.kernel.org
Cc:     Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        stable@...r.kernel.org,
        Martin Liška <mliska@...e.cz>,
        Arnaldo Carvalho de Melo <acme@...hat.com>,
        Kim Phillips <kim.phillips@....com>,
        Jiri Olsa <jolsa@...hat.com>,
        Sasha Levin <alexander.levin@...rosoft.com>
Subject: [PATCH 4.18 089/168] perf annotate: Properly interpret indirect call

4.18-stable review patch.  If anyone has any objections, please let me know.

------------------

From: "Martin Liška" <mliska@...e.cz>

[ Upstream commit 1dc27f63303db58ce1b1a6932d1825305f86d574 ]

The patch changes the parsing of:

	callq  *0x8(%rbx)

from:

  0.26 │     → callq  *8

to:

  0.26 │     → callq  *0x8(%rbx)

in this case an address is followed by a register, thus one can't parse
only the address.

Committer testing:

1) run 'perf record sleep 10'
2) before applying the patch, run:

     perf annotate --stdio2 > /tmp/before

3) after applying the patch, run:

     perf annotate --stdio2 > /tmp/after

4) diff /tmp/before /tmp/after:
#  --- /tmp/before 2018-08-28 11:16:03.238384143 -0300
#  +++ /tmp/after  2018-08-28 11:15:39.335341042 -0300
#  @@ -13274,7 +13274,7 @@
#                ↓ jle    128
#                  hash_value = hash_table->hash_func (key);
#                  mov    0x8(%rsp),%rdi
#  -  0.91       → callq  *30
#  +  0.91       → callq  *0x30(%r12)
#                  mov    $0x2,%r8d
#                  cmp    $0x2,%eax
#                  node_hash = hash_table->hashes[node_index];
#  @@ -13848,7 +13848,7 @@
#                   mov    %r14,%rdi
#                   sub    %rbx,%r13
#                   mov    %r13,%rdx
#  -              → callq  *38
#  +              → callq  *0x38(%r15)
#                   cmp    %rax,%r13
#     1.91        ↓ je     240
#            1b4:   mov    $0xffffffff,%r13d
#  @@ -14026,7 +14026,7 @@
#                   mov    %rcx,-0x500(%rbp)
#                   mov    %r15,%rsi
#                   mov    %r14,%rdi
#  -              → callq  *38
#  +              → callq  *0x38(%rax)
#                   mov    -0x500(%rbp),%rcx
#                   cmp    %rax,%rcx
#                 ↓ jne    9b0
<SNIP tons of other such cases>

Signed-off-by: Martin Liška <mliska@...e.cz>
Tested-by: Arnaldo Carvalho de Melo <acme@...hat.com>
Tested-by: Kim Phillips <kim.phillips@....com>
Cc: Jiri Olsa <jolsa@...hat.com>
Link: http://lkml.kernel.org/r/bd1f3932-be2b-85f9-7582-111ee0a43b07@suse.cz
Signed-off-by: Arnaldo Carvalho de Melo <acme@...hat.com>
Signed-off-by: Sasha Levin <alexander.levin@...rosoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
---
 tools/perf/util/annotate.c |   10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

--- a/tools/perf/util/annotate.c
+++ b/tools/perf/util/annotate.c
@@ -245,8 +245,14 @@ find_target:
 
 indirect_call:
 	tok = strchr(endptr, '*');
-	if (tok != NULL)
-		ops->target.addr = strtoull(tok + 1, NULL, 16);
+	if (tok != NULL) {
+		endptr++;
+
+		/* Indirect call can use a non-rip register and offset: callq  *0x8(%rbx).
+		 * Do not parse such instruction.  */
+		if (strstr(endptr, "(%r") == NULL)
+			ops->target.addr = strtoull(endptr, NULL, 16);
+	}
 	goto find_target;
 }