linux-kernel - Re: [PATCH v11 perf, bpf-next 7/9] perf tools: synthesize PERF_RECORD

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 22 Jan 2019 20:15:55 +0100
From:   Jiri Olsa <jolsa@...hat.com>
To:     Song Liu <songliubraving@...com>
Cc:     Arnaldo Carvalho de Melo <acme@...nel.org>,
        Jiri Olsa <jolsa@...nel.org>,
        Namhyung Kim <namhyung@...nel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "netdev@...r.kernel.org" <netdev@...r.kernel.org>,
        "peterz@...radead.org" <peterz@...radead.org>,
        "ast@...nel.org" <ast@...nel.org>,
        "daniel@...earbox.net" <daniel@...earbox.net>,
        Kernel Team <Kernel-team@...com>
Subject: Re: [PATCH v11 perf, bpf-next 7/9] perf tools: synthesize
 PERF_RECORD_* for loaded BPF programs

On Tue, Jan 22, 2019 at 06:38:56PM +0000, Song Liu wrote:

SNIP

> >> in perf_session__process_event, this happens right when processing
> >> buildids in 'perf record', and also in 'perf report', so that is
> >> something badly synthesized that hits perf.data for PERF_RECORD_KSYMBOL.
> > 
> > it's reproducible with simple:
> >  perf record -e cycles,instructions ls
> > 
> > as you said on irc, it's the machine->id_hdr_size size missing
> > there's one more glitch, attached patch fixes that for me
> > you can't use sizeof(struct ksymbol_event), because it includes
> > the name as well.. which screws the size
> > 
> > but I don't know that code that much.. might be still something
> > missing
> > 
> > jirka
> 
> Hi Arnaldo and Jiri,
> 
> Thanks for catching and fixing the bug. 
> 
> I guess the following is OK?
> 
>         *bpf_event = (struct bpf_event){
>                 .header = {
>                         .type = PERF_RECORD_BPF_EVENT,
>                         .size = sizeof(struct bpf_event),
>                 },
>                 .type = PERF_BPF_EVENT_PROG_LOAD,
>                 .flags = 0,
>                 .id = info.id,
>         };
> 
> as struct bpf_event doesn't have variable length name:
> 
>         struct bpf_event {
>                 struct perf_event_header header;
>                 u16 type;
>                 u16 flags;
>                 u32 id;
> 
>                 /* for bpf_prog types */
>                 u8 tag[BPF_TAG_SIZE];  // prog tag
>         };
> 
> Or we need similar fix? 

yep, looks good.. also don't forget to add the 'machine->id_hdr_size'

jirka