linux-kernel - Re: [RFC PATCH 1/1] tracing: support dynamic string field types for synthetic events

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 25 Sep 2020 14:53:14 -0500
From:   Tom Zanussi <zanussi@...nel.org>
To:     Axel Rasmussen <axelrasmussen@...gle.com>,
        Steven Rostedt <rostedt@...dmis.org>
Cc:     linux-kernel@...r.kernel.org
Subject: Re: [RFC PATCH 1/1] tracing: support dynamic string field types for
 synthetic events

Hi Axel,

On Fri, 2020-09-25 at 12:08 -0700, Axel Rasmussen wrote:
> It's typical [1] to define tracepoint string fields as "const char *",
> using the __string, __assign_str, and __get_str helpers. For synthetic
> event definitions, the only available mechanism to define a string type
> is a fixed-size char array ("char[]") [2].
> 
> Without this patch, since the type strings aren't identical, and the
> sizes don't match (since one is an array, and the other is a "dynamic
> string" integer), they are considered incompatible [3].
> 
> This patch modifies that check, so as to let us setup synthetic events,
> and plumb through string values from typical tracepoints. It turns out
> this is already handled correctly, as long as the check during
> definition parsing doesn't prevent it.
> 
> [1] grep -r "__string" include/trace/events/
> [2] See synth_field_is_string in kernel/trace/trace_events_synth.c
> [3] See check_synth_field in kernel/trace/trace_events_hist.c
> 
> Signed-off-by: Axel Rasmussen <axelrasmussen@...gle.com>
> ---
>  kernel/trace/trace_events_hist.c | 15 ++++++++++++---
>  1 file changed, 12 insertions(+), 3 deletions(-)
> 
> diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c
> index 0b933546142e..e064feb3cc65 100644
> --- a/kernel/trace/trace_events_hist.c
> +++ b/kernel/trace/trace_events_hist.c
> @@ -3280,9 +3280,18 @@ static int check_synth_field(struct synth_event *event,
>  	field = event->fields[field_pos];
>  
>  	if (strcmp(field->type, hist_field->type) != 0) {
> -		if (field->size != hist_field->size ||
> -		    field->is_signed != hist_field->is_signed)
> -			return -EINVAL;

One thing is that this check doesn't just apply to strings, so dropping
this will skip those other cases.  In any case, the patch I'm working
on will handle this properly along with the other changes.

Thanks,

Tom

> +		/*
> +		 * If both are kinds of strings, they match. We can't use
> +		 * is_string_field for the hist_field, as it's only sort of
> +		 * partially initialized at this point.
> +		 */
> +		if (strstr(field->type, "char[") == NULL ||
> +		    strstr(hist_field->type, "char[") == NULL) {
> +			/* They still match if size and signedness match. */
> +			if (field->size != hist_field->size ||
> +			    field->is_signed != hist_field->is_signed)
> +				return -EINVAL;
> +		}
>  	}
>  
>  	return 0;