linux-kernel - Re: [PATCH v2] ftrace: Hide a extra entry in stack trace

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20241001094742.1282d2ad@gandalf.local.home>
Date: Tue, 1 Oct 2024 09:47:42 -0400
From: Steven Rostedt <rostedt@...dmis.org>
To: ts <tatsuya.s2862@...il.com>
Cc: "Masami Hiramatsu (Google)" <mhiramat@...nel.org>, Mathieu Desnoyers
 <mathieu.desnoyers@...icios.com>, linux-kernel@...r.kernel.org,
 linux-trace-kernel@...r.kernel.org
Subject: Re: [PATCH v2] ftrace: Hide a extra entry in stack trace

On Tue, 1 Oct 2024 22:27:03 +0900
ts <tatsuya.s2862@...il.com> wrote:

> > ...
> >                sh-140     [001] ...1.    18.352601: myevent: (vfs_write+0x4/0x560)
> >                sh-140     [001] ...1.    18.352602: <stack trace>  
> >   => ksys_write
> >   => do_syscall_64
> >   => entry_SYSCALL_64_after_hwframe  
> >                sh-140     [001] ...1.    18.352602: vfs_write <-ksys_write
> >                sh-140     [001] ...1.    18.352604: <stack trace>  
> >   => ftrace_regs_call
> >   => vfs_write
> >   => ksys_write
> >   => do_syscall_64
> >   => entry_SYSCALL_64_after_hwframe  
> > ------
> > As you can see, myevent skips "vfs_write".
> > (and function tracer still have ftrace_regs_call() )  
> 
> Thanks for the other tests. This issue may be function_trace_call() 
> specific problem.
> 
> So I will change the place to increment skip number.

My fear is that we are going to just break it elsewhere. The problem with
the "skip" is that there's so many configurations when we get here, we may
not really know what to skip. If the compiler inlines something, then we
may skip something we do not want to.

I rather have extra information than not enough.

-- Steve