linux-kernel - Re: [PATCH v2 2/2] tracing: Allow execnames to be passed as args for synthetic events

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 23 Jul 2021 10:11:33 +0900
From:   Masami Hiramatsu <mhiramat@...nel.org>
To:     Steven Rostedt <rostedt@...dmis.org>
Cc:     linux-kernel@...r.kernel.org, Ingo Molnar <mingo@...nel.org>,
        Andrew Morton <akpm@...ux-foundation.org>,
        Tom Zanussi <zanussi@...nel.org>,
        Namhyung Kim <namhyung@...nel.org>
Subject: Re: [PATCH v2 2/2] tracing: Allow execnames to be passed as args
 for synthetic events

On Thu, 22 Jul 2021 12:32:34 -0400
Steven Rostedt <rostedt@...dmis.org> wrote:

> On Fri, 23 Jul 2021 01:19:35 +0900
> Masami Hiramatsu <mhiramat@...nel.org> wrote:
> 
> > > +/* Convert a var that points to common_pid.execname to a string */
> > > +static void update_var_execname(struct hist_field *hist_field)
> > > +{
> > > +	hist_field->flags = HIST_FIELD_FL_STRING | HIST_FIELD_FL_VAR |
> > > +		HIST_FIELD_FL_EXECNAME;
> > > +	hist_field->size = MAX_FILTER_STR_VAL;
> > > +	hist_field->is_signed = 0;
> > > +
> > > +	kfree_const(hist_field->type);
> > > +	hist_field->type = "char[]";
> > > +
> > > +	hist_field->fn = hist_field_execname;
> > > +}  
> > 
> > Hmm, this is a bit ad-hoc.
> > 
> > Can't this be done in the create_hist_field()? If you check 'var_name' and
> > flags & HIST_FIELD_FL_EXECNAME, you can do the same thing I think.
> 
> Hi Masami,
> 
> I originally tried that, but then found that it converted the pid over
> to it as well. So this must be done only for vars, and not only that, it
> needs to be done in a single place, because I was spending hours
> debugging it.

I understand. As far as I can see the code, it looks a bit complicated.
To simplify it, I need to understand the spec for "hist_field"
for keys and for vars. And maybe need to split both case.

> I found this to be the least intrusive solution.
> 
> Maybe Tom has a better idea, but I don't have any more time to work on
> it, and I really want this feature for the next merge window.
> 
> If you can make it work, and have time to play with it, I'm happy to
> take an alternative :-)

Me neither at least this moment, need more investigation. Let me try.

Thank you,

-- 
Masami Hiramatsu <mhiramat@...nel.org>