linux-kernel - [PATCH] eventfs: Give files a default of PAGE

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20240126131837.36dbecc8@gandalf.local.home>
Date: Fri, 26 Jan 2024 13:18:37 -0500
From: Steven Rostedt <rostedt@...dmis.org>
To: LKML <linux-kernel@...r.kernel.org>, Linux Trace Kernel
 <linux-trace-kernel@...r.kernel.org>
Cc: Masami Hiramatsu <mhiramat@...nel.org>, Mathieu Desnoyers
 <mathieu.desnoyers@...icios.com>, Christian Brauner <brauner@...nel.org>,
 Ajay Kaher <ajay.kaher@...adcom.com>, Geert Uytterhoeven
 <geert@...ux-m68k.org>, linux-fsdevel <linux-fsdevel@...r.kernel.org>,
 Linus Torvalds <torvalds@...ux-foundation.org>
Subject: [PATCH] eventfs: Give files a default of PAGE_SIZE size

From: "Steven Rostedt (Google)" <rostedt@...dmis.org>

The sqlhist utility[1] (or the new trace-cmd sqlhist command[2]) creates
the commands of a synthetic event based on the files in the tracefs/events
directory. When creating these commands for an embedded system, it is
asked to copy the files to the temp directory, tar them up and send them
to the main machine. Ideally, tar could be used directly without copying
them to the /tmp directory. But because the sizes presented by the inodes
are of size '0' the tar just copies zero bytes of the file making it
useless.

By following what sysfs does, and give files a default size of PAGE_SIZE,
it allows the tar to work. No event file is greater than PAGE_SIZE.

Although tar will give an error of:

 tar: events/raw_syscalls/filter: File shrank by 3904 bytes; padding with zeros

Which is consistent to the error it gives to sysfs as well:

~# (cd /sys/ && tar cf - firmware) | tar xf -
 [..]
 tar: firmware/acpi/interrupts/ff_slp_btn: File shrank by 4057 bytes; padding with zeros

But only add size if the file can be open for read. It doesn't make sense
for files that are write-only.

[1] https://trace-cmd.org/Documentation/libtracefs/libtracefs-sqlhist.html
[2] https://trace-cmd.org/Documentation/trace-cmd/trace-cmd-sqlhist.1.html

Link: https://lore.kernel.org/all/CAMuHMdU-+RmngWJwpHYPjVcaOe3NO37Cu8msLvqePdbyk8qmZA@mail.gmail.com/

Signed-off-by: Steven Rostedt (Google) <rostedt@...dmis.org>
---
 fs/tracefs/event_inode.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/fs/tracefs/event_inode.c b/fs/tracefs/event_inode.c
index 7be7a694b106..013b8af40a4f 100644
--- a/fs/tracefs/event_inode.c
+++ b/fs/tracefs/event_inode.c
@@ -363,6 +363,8 @@ static struct dentry *create_file(const char *name, umode_t mode,
 	inode->i_fop = fop;
 	inode->i_private = data;
 	inode->i_ino = ino;
+	if (mode & (S_IRUSR | S_IRGRP | S_IROTH))
+		inode->i_size = PAGE_SIZE;

 	ti = get_tracefs(inode);
 	ti->flags |= TRACEFS_EVENT_INODE;
-- 
2.43.0