[Crash-utility] Using crash with structure layout randomized kernel

[Cao jin]

On 01/23/2018 11:19 PM, Dave Anderson wrote:
> 
> 
> ----- Original Message -----
>> Hi Dave,
>>
>>     Recently I was trying crash tool with kdump dumpfile & structure
>> layout randomized kernel[*](), and it fails without any surprise. After
>> looking into the different errors crash reports, I can confirm it is a
>> result from randomized structure layout.
>>
>> So my questions is, do you ever consider supporting this feature[*] in
>> crash?
>>   If yes, do you have any plan & technique evaluation about it?
>>   If no, what's the reason?
>>
>> [*]https://lwn.net/Articles/722293/
>> --
>> Sincerely,
>> Cao jin
> 
> I was under the impression that the structure layout was done at 
> compile-time, and that the vmlinux file's debuginfo data would 
> represent the randomized layout.  And that being the case, the
> inconvenience would be that the crash session would show the 
> randomized layout, while the associated source code would show
> the original layout. 
> 

BTW, I don't have any compiler knowledge before, just from these two
days learning, I feel you are right at "vmlinux file's debuginfo data
would represent the randomized layout".

But when I debug, it seem not like what it should be. I have two file
pairs, randomized and non-randomized one. I print some member offset of
structure tagged with __randomize_layout after MEMBER_OFFSET_INIT, like
this one:

(gdb) p offset_table->task_struct_state
$1 = 8
(gdb) p offset_table->task_struct_exit_state
$2 = 2164
(gdb) p offset_table->task_struct_pid
$3 = 2264
(gdb) p offset_table->task_struct_comm
$4 = 2744
(gdb) p offset_table->task_struct_next_task
$5 = -1
(gdb) p offset_table->task_struct_processor
$6 = -1
(gdb) p offset_table->task_struct_p_pptr
$7 = -1
(gdb) p offset_table->task_struct_parent
$8 = 2288

Under both file pairs, these offset value are the same, so, I think that
is why I have the impression that debuginfo has the original structure
layout. I guess this is one kind of "MEMBER_OFFSET() no longer work"?

-- 
Sincerely,
Cao jin
> You didn't give any examples of how/what fails.  Is it a major problem
> where fundamental facilities like MEMBER_OFFSET() no longer work?
> Or are there places where assumptions are made w/regard to structure
> layout without checking the debuginfo data?
> 
> Anyway, the answer to your question is no, currently I have no plans.
> 
> Dave
> 
> 
>