linux-kernel - Re: [PATCH] tracing/x86: fix trace event registration for syscalls without arguments

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1727d83e-5a3d-952e-d7e8-0e3d52bbafa2@yandex-team.ru>
Date:   Mon, 27 Apr 2020 17:55:50 +0300
From:   Konstantin Khlebnikov <khlebnikov@...dex-team.ru>
To:     Thomas Gleixner <tglx@...utronix.de>,
        Brian Gerst <brgerst@...il.com>, linux-kernel@...r.kernel.org
Cc:     Dominik Brodowski <linux@...inikbrodowski.net>,
        Andy Lutomirski <luto@...nel.org>
Subject: Re: [PATCH] tracing/x86: fix trace event registration for syscalls
 without arguments


On 27/04/2020 17.44, Thomas Gleixner wrote:
> Konstantin Khlebnikov <khlebnikov@...dex-team.ru> writes:
> 
>> Syscalls without arguments now has no ABI subs, instead of that macro
> 
> What is 'ABI subs'?

typo. ABI stubs

That commmit d2b5de495ee9 ("x86/entry: Refactor SYSCALL_DEFINE0 macros")

replaced usual wrapper

long __x64_syscall()
{	
	return __do_sys_syscall();
}

with alias

long __x64_syscall() __alias__(__do_sys_syscall);

And now symbol lookup for entry point return "__do_sys_syscall"
rather than "__x64_syscall" and ftrace magic cannot determine
syscall number for entry point and vise versa.

> 
>> SYSCALL_DEFINE0() defines __abi_sys_name as aliase to __do_sys_name.
>>
>> As a result in find_syscall_meta() kallsyms_lookup() returns
>> "__do_sys_name" which does not match with declared trace event.
>>
>> Also see commit 1c758a2202a6 ("tracing/x86: Update syscall trace events
>> to handle new prefixed syscall func names")
>>
>> Fixes: d2b5de495ee9 ("x86/entry: Refactor SYSCALL_DEFINE0 macros")
>> Signed-off-by: Konstantin Khlebnikov <khlebnikov@...dex-team.ru>
>> ---
>>   arch/x86/include/asm/ftrace.h |    5 +++--
>>   1 file changed, 3 insertions(+), 2 deletions(-)
>>
>> diff --git a/arch/x86/include/asm/ftrace.h b/arch/x86/include/asm/ftrace.h
>> index 85be2f506272..70b96cae5b42 100644
>> --- a/arch/x86/include/asm/ftrace.h
>> +++ b/arch/x86/include/asm/ftrace.h
>> @@ -61,11 +61,12 @@ static inline bool arch_syscall_match_sym_name(const char *sym, const char *name
>>   {
>>   	/*
>>   	 * Compare the symbol name with the system call name. Skip the
>> -	 * "__x64_sys", "__ia32_sys" or simple "sys" prefix.
>> +	 * "__x64_sys", "__ia32_sys", "__do_sys" or simple "sys" prefix.
>>   	 */
>>   	return !strcmp(sym + 3, name + 3) ||
>>   		(!strncmp(sym, "__x64_", 6) && !strcmp(sym + 9, name + 3)) ||
>> -		(!strncmp(sym, "__ia32_", 7) && !strcmp(sym + 10, name + 3));
>> +		(!strncmp(sym, "__ia32_", 7) && !strcmp(sym + 10, name + 3)) ||
>> +		(!strncmp(sym, "__do_sys", 8) && !strcmp(sym + 8, name + 3));
>>   }
>>   
>>   #ifndef COMPILE_OFFSETS