linux-kernel - Re: [PATCH 2/3] perf tools: Skip MMAP record synthesis for kernel threads

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 1 Feb 2021 21:32:50 +0100
From:   Jiri Olsa <jolsa@...hat.com>
To:     Namhyung Kim <namhyung@...nel.org>
Cc:     Arnaldo Carvalho de Melo <acme@...nel.org>,
        Ingo Molnar <mingo@...nel.org>,
        Peter Zijlstra <peterz@...radead.org>,
        Mark Rutland <mark.rutland@....com>,
        Alexander Shishkin <alexander.shishkin@...ux.intel.com>,
        LKML <linux-kernel@...r.kernel.org>,
        Stephane Eranian <eranian@...gle.com>,
        Andi Kleen <ak@...ux.intel.com>,
        Ian Rogers <irogers@...gle.com>
Subject: Re: [PATCH 2/3] perf tools: Skip MMAP record synthesis for kernel
 threads

On Mon, Feb 01, 2021 at 01:54:32PM +0900, Namhyung Kim wrote:
> On Mon, Feb 1, 2021 at 7:48 AM Jiri Olsa <jolsa@...hat.com> wrote:
> >
> > On Fri, Jan 29, 2021 at 02:49:00PM +0900, Namhyung Kim wrote:
> > > To synthesize information to resolve sample IPs, it needs to scan task
> > > and mmap info from the /proc filesystem.  For each process, it
> > > opens (and reads) status and maps file respectively.  But as kernel
> > > threads don't have memory maps so we can skip the maps file.
> > >
> > > To find kernel threads, check "VmPeak:" line in /proc/<PID>/status
> > > file.  It's about the peak virtual memory usage so only user-level
> > > tasks have that.  Also check "Threads:" line (which follows the VmPeak
> > > line whether or not it exists) to be sure it's read enough data - just
> > > in case of deeply nested pid namespaces or large number of
> > > supplementary groups are involved.
> >
> > I don't understand this Threads: check, could you please
> > show example where it's useful for the check?
> 
> Sure!
> 
> I think there's a chance that the status file actually has the VmPeak line,
> but it didn't read to the line for some reason.  In that case, we should
> not assume the task is a kernel thread.
> 
> So it needs to make sure whether there's no such line in the file
> or it just didn't read enough data.  To check the latter case, it
> searches the "Threads" line which follows the VmPeak always.

ah ok, there's limited buffer for the status file

we could call filename__read_str to read the whole file
and skip these checks.. but perhaps that'd be another
slowdown you trying to prevent

if you put that comment to the code, I'm ok with that

thanks,
jirka