linux-kernel - Re: [PATCH] ftrace: Fix function name for trampoline

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <c180285c-c79a-4a32-b899-553345ad46ab@gmail.com>
Date: Fri, 11 Oct 2024 16:34:22 +0900
From: Tatsuya S <tatsuya.s2862@...il.com>
To: Steven Rostedt <rostedt@...dmis.org>
Cc: Masami Hiramatsu <mhiramat@...nel.org>,
 Mathieu Desnoyers <mathieu.desnoyers@...icios.com>,
 linux-kernel@...r.kernel.org, linux-trace-kernel@...r.kernel.org
Subject: Re: [PATCH] ftrace: Fix function name for trampoline



On 10/11/24 12:02 AM, Steven Rostedt wrote:
> On Thu, 10 Oct 2024 22:02:59 +0900
> Tatsuya S <tatsuya.s2862@...il.com> wrote:
> 
>> The issue that unrelated function name is shown on stack trace like
>> following even though it should be trampoline code address is caused by
>> the creation of trampoline code in the area where .init.text section
>> of module was freed after module is loaded.
>>
>> bash-1344    [002] .....    43.644608: <stack trace>
>>    => (MODULE INIT FUNCTION)
>>    => vfs_write
>>    => ksys_write
>>    => do_syscall_64
>>    => entry_SYSCALL_64_after_hwframe
>>
>> To resolve this, when function address of stack trace entry is in
>> trampoline, output without looking up symbol name.
>>
>> Signed-off-by: Tatsuya S <tatsuya.s2862@...il.com>
>> ---
>>   kernel/trace/trace_output.c | 5 +++++
>>   1 file changed, 5 insertions(+)
>>
>> diff --git a/kernel/trace/trace_output.c b/kernel/trace/trace_output.c
>> index 868f2f912f28..32a0858373e2 100644
>> --- a/kernel/trace/trace_output.c
>> +++ b/kernel/trace/trace_output.c
>> @@ -1246,6 +1246,11 @@ static enum print_line_t trace_stack_print(struct trace_iterator *iter,
>>   			break;
>>   
>>   		trace_seq_puts(s, " => ");
>> +		if (is_ftrace_trampoline((*p) + delta)) {

Thank you for review.

> 
> This is not reliable. The output is called when the user reads the trace
> file and the ops may no longer exist.
> 
> The only way to test this is if you call it during the trace. Yes it may
> slow things down a little, but it will be accurate.

OK, I will do it.

> 
> -- Steve
> 
> 
>> +			trace_seq_printf(s, "0x%08lx", (*p) + delta);
>> +			trace_seq_putc(s, '\n');
>> +			continue;
>> +		}
>>   		seq_print_ip_sym(s, (*p) + delta, flags);
>>   		trace_seq_putc(s, '\n');
>>   	}
> 

Thanks