linux-kernel - Re: [PATCH 2/3] perf tools: Skip MMAP record synthesis for kernel threads

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 1 Feb 2021 13:54:32 +0900
From:   Namhyung Kim <namhyung@...nel.org>
To:     Jiri Olsa <jolsa@...hat.com>
Cc:     Arnaldo Carvalho de Melo <acme@...nel.org>,
        Ingo Molnar <mingo@...nel.org>,
        Peter Zijlstra <peterz@...radead.org>,
        Mark Rutland <mark.rutland@....com>,
        Alexander Shishkin <alexander.shishkin@...ux.intel.com>,
        LKML <linux-kernel@...r.kernel.org>,
        Stephane Eranian <eranian@...gle.com>,
        Andi Kleen <ak@...ux.intel.com>,
        Ian Rogers <irogers@...gle.com>
Subject: Re: [PATCH 2/3] perf tools: Skip MMAP record synthesis for kernel threads

On Mon, Feb 1, 2021 at 7:48 AM Jiri Olsa <jolsa@...hat.com> wrote:
>
> On Fri, Jan 29, 2021 at 02:49:00PM +0900, Namhyung Kim wrote:
> > To synthesize information to resolve sample IPs, it needs to scan task
> > and mmap info from the /proc filesystem.  For each process, it
> > opens (and reads) status and maps file respectively.  But as kernel
> > threads don't have memory maps so we can skip the maps file.
> >
> > To find kernel threads, check "VmPeak:" line in /proc/<PID>/status
> > file.  It's about the peak virtual memory usage so only user-level
> > tasks have that.  Also check "Threads:" line (which follows the VmPeak
> > line whether or not it exists) to be sure it's read enough data - just
> > in case of deeply nested pid namespaces or large number of
> > supplementary groups are involved.
>
> I don't understand this Threads: check, could you please
> show example where it's useful for the check?

Sure!

I think there's a chance that the status file actually has the VmPeak line,
but it didn't read to the line for some reason.  In that case, we should
not assume the task is a kernel thread.

So it needs to make sure whether there's no such line in the file
or it just didn't read enough data.  To check the latter case, it
searches the "Threads" line which follows the VmPeak always.

Did I make it clear?

Thanks,
Namhyung