linux-kernel - Re: [PATCH] perf trace: Fix SIGSEGV when processing augmented args

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <1647523376.wy1m43rn4r.naveen@linux.ibm.com>
Date:   Thu, 17 Mar 2022 18:54:08 +0530
From:   "Naveen N. Rao" <naveen.n.rao@...ux.vnet.ibm.com>
To:     Arnaldo Carvalho de Melo <acme@...nel.org>
Cc:     cclaudio@...ux.ibm.com, Jiri Olsa <jolsa@...nel.org>,
        Linux Kernel
 Mailing List 
        <linux-kernel@...r.kernel.org>, Namhyung Kim <namhyung@...nel.org>
Subject: Re: [PATCH] perf trace: Fix SIGSEGV when processing augmented args

Arnaldo Carvalho de Melo wrote:
> Em Tue, Mar 15, 2022 at 02:52:05PM -0300, Arnaldo Carvalho de Melo escreveu:
>> Em Tue, Mar 15, 2022 at 10:57:57PM +0530, Naveen N. Rao escreveu:
>> > Yes, it looks like the current check in 'perf' isn't working. The below
>> > patch also resolves the crash we are seeing:
>>  
>> > diff --git a/tools/perf/builtin-trace.c b/tools/perf/builtin-trace.c
>> > index 2f1d20553a0aa3..86b459f4ebdd61 100644
>> > --- a/tools/perf/builtin-trace.c
>> > +++ b/tools/perf/builtin-trace.c
>> > @@ -2326,7 +2326,7 @@ static int trace__sys_enter(struct trace *trace, struct evsel *evsel,
>> >         * thinking that the extra 2 u64 args are the augmented filename, so just check
>> >         * here and avoid using augmented syscalls when the evsel is the raw_syscalls one.
>> >         */
>> > -       if (evsel != trace->syscalls.events.sys_enter)
>> > +       if (strcmp(evsel__name(evsel), "raw_syscalls:sys_enter"))
>> >                augmented_args = syscall__augmented_args(sc, sample, &augmented_args_size, trace->raw_augmented_syscalls_args_size);
>> >        ttrace->entry_time = sample->time;
>> >        msg = ttrace->entry_str;
>> 
>> Interesting, that should be equivalent :-\ humm, not really, understood,
>> when processing perf.data files we don't setup
>> trace->syscalls.events.sys_enter...
>> 
>> switching from strcmp() to something cheaper but equivalent should be
>> the fix for now.
> 
> I'll add a trace->use_augmented_args boolean that will do this test
> once, and then use it in this case and will audit to check if this
> should be used in other places.

Thanks! That sounds better.


- Naveen