linux-kernel - Re: [PATCH 3/5] perf tools: Fallback to initial kernel map properly

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAP-5=fVUKmFmrdBAV+CEx_TJQtLOzB7hisgXKOajvfAJPvqdqw@mail.gmail.com>
Date: Tue, 2 Dec 2025 12:55:06 -0800
From: Ian Rogers <irogers@...gle.com>
To: Namhyung Kim <namhyung@...nel.org>
Cc: Arnaldo Carvalho de Melo <acme@...nel.org>, James Clark <james.clark@...aro.org>, 
	Jiri Olsa <jolsa@...nel.org>, Adrian Hunter <adrian.hunter@...el.com>, 
	Peter Zijlstra <peterz@...radead.org>, Ingo Molnar <mingo@...nel.org>, 
	LKML <linux-kernel@...r.kernel.org>, linux-perf-users@...r.kernel.org
Subject: Re: [PATCH 3/5] perf tools: Fallback to initial kernel map properly

On Tue, Dec 2, 2025 at 12:16 AM Namhyung Kim <namhyung@...nel.org> wrote:
>
> In maps__split_kallsyms(), it assumes new kernel map when it finds a
> symbol without module after any module and the initial kernel map has
> some symbols.  Because it expects modules are out of the kernel map so
> modules should not have symbols in the kernel map.
>
> For example, the following memory map shows symbols and maps.  Any
> symbols in the module 1 area will go to the module 1.  The main kernel
> map starts at 0xffffffffbc200000.  But if any symbol has a module
> between the symbols in that area, next symbols after 0xffffffffbd008000
> will generate new kernel maps like [kernel].1.
>
>    kernel address   |                     |
>                     |                     |
>  0xffffffffc0000000 |---------------------|
>                     |     (symbols)       |
>                     |        ...          |   <---  [kernel].N
>  0xffffffffbc400000 |---------------------|
>                     |     (symbols)       |
>                     |      module 2       |   <---  bad?
>  0xffffffffbc380000 |---------------------|
>                     |        ...          |
>                     |     (symbols)       |
>                     |  [kernel.kallsyms]  |   <---  initial map
>  0xffffffffbc200000 |---------------------|
>                     |                     |
>                     |                     |
>  0xffffffffabcde000 |---------------------|
>                     |     (symbols)       |
>                     |      module 1       |
>  0xffffffffabcd0000 |---------------------|
>
> This is very fragile when the module has a symbol that falls into the
> main kernel map for some reason.  My system has a livepatch module with
> such symbols.  And it created a lot of new kernel maps after those
> symbols.  But the symbol may have broken addresses and the later symbols
> can still be found in the initial kernel map.
>
> Let's check the symbol address in the initial map and use it if found.
>
> Signed-off-by: Namhyung Kim <namhyung@...nel.org>
> ---
>  tools/perf/util/symbol.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/tools/perf/util/symbol.c b/tools/perf/util/symbol.c
> index 8eea49c50453d13a..b533fbf17a8b19a3 100644
> --- a/tools/perf/util/symbol.c
> +++ b/tools/perf/util/symbol.c
> @@ -951,7 +951,8 @@ static int maps__split_kallsyms(struct maps *kmaps, struct dso *dso, u64 delta,
>                                 pos->end -= delta;
>                         }
>
> -                       if (count == 0) {
> +                       if (map__start(initial_map) <= (pos->start + delta) &&
> +                           (pos->start + delta) < map__end(initial_map)) {

Reviewed-by: Ian Rogers <irogers@...gle.com>
nit: it looks a little clunky to subtract off delta above, but then
add it on again here.

Thanks,
Ian

>                                 map__zput(curr_map);
>                                 curr_map = map__get(initial_map);
>                                 goto add_symbol;
> --
> 2.52.0.158.g65b55ccf14-goog
>