linux-kernel - Re: [PATCH v2] tracing: Fix event probe removal from dynamic events

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20211013125322.49098953@gandalf.local.home>
Date:   Wed, 13 Oct 2021 12:53:22 -0400
From:   Steven Rostedt <rostedt@...dmis.org>
To:     Masami Hiramatsu <mhiramat@...nel.org>
Cc:     LKML <linux-kernel@...r.kernel.org>,
        Ingo Molnar <mingo@...nel.org>,
        Andrew Morton <akpm@...ux-foundation.org>,
        Tom Zanussi <zanussi@...nel.org>,
        Tzvetomir Stoyanov <tz.stoyanov@...il.com>,
        Yordan Karadzhov <y.karadz@...il.com>
Subject: Re: [PATCH v2] tracing: Fix event probe removal from dynamic events

On Wed, 13 Oct 2021 23:42:06 +0900
Masami Hiramatsu <mhiramat@...nel.org> wrote:

> > > Actually, the dynamic_events delete command is something like wildcard
> > > unless you specify the options.  
> > 
> > OK, so we need to update this a little bit more. But currently, it fails if
> > you do:
> > 
> >  # echo 'e:hrstate timer/hrtimer_cancel state=+0x38($hrtimer):u8' >> dynamic_events
> >  # cat dynamic_events
> > eprobes/hrstate timer.hrtimer_cancel state=+0x38($hrtimer):u8  
> 
> BTW, Isn't there 'e:' prefix like below?
> e:eprobes/hrstate timer.hrtimer_cancel state=+0x38($hrtimer):u8

Yes, that works too, but you can leave off the GROUP/ when creating the
event, which it will default to "eprobes/".

> 
> >  # echo '-:eprobes/hrstate timer.hrtimer_cancel state=+0x38($hrtimer):u8' >> dynamic_events
> > 
> > It will error out with "-EBUSY".  
> 
> That may be another reason. (Did you enable the eprobes/hrstate?)
> If the event doesn't match, it will return -ENOENT.

Hmm, now trying to reproduce it, I'm getting:

  -bash: echo: write error: No such file or directory

Which would be -ENOENT. Before I was getting -EBUSY when attaching eprobes
to kprobes with your $$args patch. But that's not applied right now, so I
can't try to reproduce it at the moment. I probably hit something else at
the time anyway.

But still, it's broken, and I need to fix it. I'll make the updates to
allow the above. Perhaps I'll include a test that tests the above too.

-- Steve