Re: tracepoints and %p [was: Re: [Patch net-next resend v2] net: use %px to print skb address in trace_netif_receive_skb]

On Wed, 28 Jul 2021 11:48:11 -0700
Kees Cook [off-list ref] wrote:

quoted

That is exactly what is happening. I wrote the following to the replied
text up at the top, then noticed you basically stated the same thing
here ;-)  

Where is the %px being formatted then? If it's the kernel itself (which
is the only thing that does %px), then it doesn't need to be %px, since
the raw data is separate. i.e. leave it %p for whatever logs will get
spilled out to who knows where.

The trace events shown by tracefs/trace are formatted via the kernel
sprintf() and friends, which will hash "%p".

But the raw data read to trace-cmd (and other tools), uses
libtraceevent, that parses the printf-fmt of a trace event just like
the kernel does. But since we are already in user space, it is pretty
pointless to implement "%p" with hashing. But it does understand what
"%px" is.

How does ftrace interact with lockdown's confidentiality mode?

as Jann replied. If you enable "LOCKDOWN_TRACEFS" you lose all access
to the tracing interface.

-- Steve