linux-kernel - Re: [PATCH 1/2] tracing: Remove "__attribute_

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20250714231412.73e511c5c9524cde5d475770@kernel.org>
Date: Mon, 14 Jul 2025 23:14:12 +0900
From: Masami Hiramatsu (Google) <mhiramat@...nel.org>
To: Steven Rostedt <rostedt@...dmis.org>
Cc: Mathieu Desnoyers <mathieu.desnoyers@...icios.com>,
 linux-kernel@...r.kernel.org, linux-trace-kernel@...r.kernel.org
Subject: Re: [PATCH 1/2] tracing: Remove "__attribute__()" from the type
 field of event format

On Sat, 12 Jul 2025 10:37:32 -0400
Steven Rostedt <rostedt@...dmis.org> wrote:

> On Sat, 12 Jul 2025 20:45:24 +0900
> Masami Hiramatsu (Google) <mhiramat@...nel.org> wrote:
> 
> > Hmm, Ok. But when I sanitized the field->type in
> > update_event_fields(), it did not work. So something
> > we missed.
> 
> Ah, it's because we test to see if the event has enums or not before
> calling update_event_fields. We need something like this:
> 
> 
> diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c
> index 120531268abf..52829b950022 100644
> --- a/kernel/trace/trace_events.c
> +++ b/kernel/trace/trace_events.c
> @@ -3349,6 +3349,8 @@ void trace_event_eval_update(struct trace_eval_map **map, int len)
>  				}
>  				update_event_printk(call, map[i]);
>  				update_event_fields(call, map[i]);
> +			} else if (need_sanitize_field_type(__type)) {
> +				sanitize_fields(call);
>  			}
>  		}
>  		cond_resched();
> 
> 
> And have the attribute fixed in both update_event_fields() and have
> your own sanitize_fields() that just does the attribute update.

Hmm, is this called unless loading modules? It seems that the
function is only kicked from trace_module_notify() -> trace_module_add_evals() -> trace_insert_eval_map() (but if mod has any trace_evals)

This sanitizing must be done with/without the module loading even if it
had no trace_evals. Thus I think it is hard to be done in
trace_event_eval_update().

Thank you,

> 
> -- Steve


-- 
Masami Hiramatsu (Google) <mhiramat@...nel.org>