linux-kernel - Re: ftrace histogram sorting broken on BE architecures

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20191211103557.7bed6928@gandalf.local.home>
Date:   Wed, 11 Dec 2019 10:35:57 -0500
From:   Steven Rostedt <rostedt@...dmis.org>
To:     Sven Schnelle <svens@...ckframe.org>
Cc:     linux-trace-devel@...r.kernel.org,
        LKML <linux-kernel@...r.kernel.org>,
        Tom Zanussi <zanussi@...nel.org>
Subject: Re: ftrace histogram sorting broken on BE architecures

On Wed, 11 Dec 2019 13:33:16 +0100
Sven Schnelle <svens@...ckframe.org> wrote:

> Hi List,

Hi Sven,

> 
> i was looking into a ftracetest failure on s390:
> 
> # ./ftracetest test.d/trigger/trigger-hist.tc
> === Ftrace unit tests ===
> [1] event trigger - test histogram trigger	[FAIL]
> [2] (instance)  event trigger - test histogram trigger	[FAIL]
> 
> from the -vvv log: ++ fail 'sort param on sched_process_fork did not work'
> 
> # cat events/sched/sched_process_fork/hist
> 
> # event histogram
> #
> # trigger info: hist:keys=parent_pid,child_pid:vals=hitcount:sort=child_pid:size=2048 [active]
> #
> 
> { parent_pid:       1406, child_pid:       1428 } hitcount:          1
> { parent_pid:       1406, child_pid:       1430 } hitcount:          1
> { parent_pid:       1406, child_pid:       1427 } hitcount:          1
> { parent_pid:       1406, child_pid:       1432 } hitcount:          1
> { parent_pid:       1406, child_pid:       1431 } hitcount:          1
> { parent_pid:       1406, child_pid:       1429 } hitcount:          1
> 
> So the test is right, the entries are not sorted. After digging into the
> ftrace code i noticed that integer values always get extended to 64 bit
> in event_hist_trigger(), but cmp_entries_key() from tracing_map.c uses the
> type of the field (which is a pid_t, and therefore 4 bytes).
> 
> On Little Endian this doesn't hurt, but on BE s390 this makes the compare
> function compare 4 zero bytes, which is the reason why sorting doesn't
> work. As a test i forced the compare function used in cmp_entries_key() to
> tracing_map_cmp_s64(), which made the ftrace tests pass.
> 
> I also tested this on 64 bit parisc with the same results, so the architecture
> doesn't seem make a difference (besides LE vs. BE)
> 
> Any thoughts on how to fix this? I'm not sure whether i fully understand the
> ftrace maps... ;-)

Your analysis makes sense. I'll take a deeper look at it.

Thanks for reporting it!

-- Steve