linux-kernel - RE: Question: perf dso support for /proc/kallsyms

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 2 Nov 2018 14:12:28 +0000
From:   Al Grant <Al.Grant@....com>
To:     "leo.yan@...aro.org" <leo.yan@...aro.org>
CC:     "acme@...hat.com" <acme@...hat.com>, Jiri Olsa <jolsa@...nel.org>,
        Mathieu Poirier <mathieu.poirier@...aro.org>,
        Coresight ML <coresight@...ts.linaro.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: RE: Question: perf dso support for /proc/kallsyms

> root@...ian:~/coresight_test# perf buildid-list
> 0242d9154c78df1d8fe1d0512c36a236d0861a18 [kernel.kallsyms]
> b8c89e8ba41a2ea486c66a50c29c60d38c34a759 /root/coresight_test/main
> 26b12a9d1a54ed2b0478cb0203435b76aabab3fb /usr/lib/aarch64-linux-gnu/ld-
> 2.27.so
> 8fca7ed524c9469b065af83bc8a529fe72858f53 [vdso]
> 25829a59e21012cfde7850b30a310cd3a58f531c
> /root/coresight_test/libcstest.so
> 70512527439ef76c8802a7a2a546bde6a5a6e967 /usr/lib/aarch64-linux-
> gnu/libc-2.27.so
> root@...ian:~/coresight_test# ls
> ~/.debug/\[kernel.kallsyms\]/0242d9154c78df1d8fe1d0512c36a236d0861a18/
> kallsyms

What's in that last file? I've seen it happen that the copy of kallsyms
in ~/.debug has the symbol addresses as zeroes - possibly because it
was created when you didn't have permissions. That's really a bug
in perf, as cacheing a copy of this file with the addresses zeroed out
is kind of pointless. Again, this happens on Intel too.

Then, you can give yourself permissions - but perf's already cached
the file and won't update it!

If you delete it, and then rerun perf record (either as sudo or now
that you've got kptr_restrict=0) you should see it reappear, with
correct kernel addresses.

Perhaps nobody spotted this on Intel because perf report goes directly
to /proc/kallsyms. But it would be an issue if you ran a perf report
on a perf.data from an older kernel and it had to go to ~/.debug.
At that point the fact that ~/.debug/[kernel.kallsyms] had zeroes would
mean you couldn't symbolicate any addresses.

Al

>
> > Does it all work if you run perf record as sudo? Or if you do
> >
> >    sudo sysctl kernel.kptr_restrict=0
> >
> > before you run perf record?
>
> Yes, tested this on Juno board with Debian rootFS and logined in with 'root' user.
> I suspected the pointer permission issue so checked with below command:
>
> root@...ian:~/coresight_test# cat /proc/sys/kernel/kptr_restrict
> 0
>
> Thanks,
> Leo Yan
IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.