linux-kernel - Re: [PATCH v2 5/6] tracing/probes: Have kprobes and uprobes use $COMM too

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 22 Aug 2022 00:19:02 +0900
From:   Masami Hiramatsu (Google) <mhiramat@...nel.org>
To:     Steven Rostedt <rostedt@...dmis.org>
Cc:     linux-kernel@...r.kernel.org, Ingo Molnar <mingo@...nel.org>,
        Andrew Morton <akpm@...ux-foundation.org>,
        Masami Hiramatsu <mhiramat@...nel.org>,
        Tzvetomir Stoyanov <tz.stoyanov@...il.com>,
        Tom Zanussi <zanussi@...nel.org>, stable@...r.kernel.org
Subject: Re: [PATCH v2 5/6] tracing/probes: Have kprobes and uprobes use
 $COMM too

On Sat, 20 Aug 2022 09:43:21 -0400
Steven Rostedt <rostedt@...dmis.org> wrote:

> From: "Steven Rostedt (Google)" <rostedt@...dmis.org>
> 
> Both $comm and $COMM can be used to get current->comm in eprobes and the
> filtering and histogram logic. Make kprobes and uprobes consistent in this
> regard and allow both $comm and $COMM as well. Currently kprobes and
> uprobes only handle $comm, which is inconsistent with the other utilities,
> and can be confusing to users.
> 
> Link: https://lore.kernel.org/all/20220820220442.776e1ddaf8836e82edb34d01@kernel.org/
> 

This looks good to me.

Acked-by: Masami Hiramatsu (Google) <mhiramat@...nel.org>

(Note that kprobes/uprobes doesn't need to record cpu/pid, because those
 are a part of common field and can be accessed from filter or histogram.
 Only comm must be recorded as string.)

Thank you,

> Cc: stable@...r.kernel.org
> Fixes: 533059281ee5 ("tracing: probeevent: Introduce new argument fetching code")
> Suggested-by: Masami Hiramatsu (Google) <mhiramat@...nel.org>
> Signed-off-by: Steven Rostedt (Google) <rostedt@...dmis.org>
> ---
>  kernel/trace/trace_probe.c | 5 +++--
>  1 file changed, 3 insertions(+), 2 deletions(-)
> 
> diff --git a/kernel/trace/trace_probe.c b/kernel/trace/trace_probe.c
> index 4daabbb8b772..36dff277de46 100644
> --- a/kernel/trace/trace_probe.c
> +++ b/kernel/trace/trace_probe.c
> @@ -314,7 +314,7 @@ static int parse_probe_vars(char *arg, const struct fetch_type *t,
>  			}
>  		} else
>  			goto inval_var;
> -	} else if (strcmp(arg, "comm") == 0) {
> +	} else if (strcmp(arg, "comm") == 0 || strcmp(arg, "COMM") == 0) {
>  		code->op = FETCH_OP_COMM;
>  #ifdef CONFIG_HAVE_FUNCTION_ARG_ACCESS_API
>  	} else if (((flags & TPARG_FL_MASK) ==
> @@ -625,7 +625,8 @@ static int traceprobe_parse_probe_arg_body(const char *argv, ssize_t *size,
>  	 * we can find those by strcmp. But ignore for eprobes.
>  	 */
>  	if (!(flags & TPARG_FL_TPOINT) &&
> -	    (strcmp(arg, "$comm") == 0 || strncmp(arg, "\\\"", 2) == 0)) {
> +	    (strcmp(arg, "$comm") == 0 || strcmp(arg, "$COMM") == 0 ||
> +	     strncmp(arg, "\\\"", 2) == 0)) {
>  		/* The type of $comm must be "string", and not an array. */
>  		if (parg->count || (t && strcmp(t, "string")))
>  			goto out;
> -- 
> 2.35.1


-- 
Masami Hiramatsu (Google) <mhiramat@...nel.org>