linux-kernel - Re: [PATCH] module interface improvement for kprobes

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20060807045213.GA12898@in.ibm.com>
Date:	Mon, 7 Aug 2006 10:22:13 +0530
From:	Ananth N Mavinakayanahalli <ananth@...ibm.com>
To:	Christoph Hellwig <hch@...radead.org>,
	David Smith <dsmith@...hat.com>, linux-kernel@...r.kernel.org,
	rusty@...tcorp.com.au, prasanna@...ibm.com,
	anil.s.keshavamurthy@...el.com, davem@...emloft.net
Subject: Re: [PATCH] module interface improvement for kprobes

On Fri, Aug 04, 2006 at 04:57:11PM +0100, Christoph Hellwig wrote:
> > {
> > 	/* grab the module, making sure it won't get unloaded until
> > 	 * we're done */
> > 	const char *mod_name = "joydev";
> > 	if (module_get_byname(mod_name, &mod) != 0)
> > 		return 1;
> > 
> > 	/* Specify the address/offset where you want to insert
> > 	 * probe.  If this were a real kprobe module, we'd "relocate"
> > 	 * our probe address based on the load address of the module
> > 	 * we're interested in. */
> > 	kp.addr = (kprobe_opcode_t *) mod->module_core + 0;
> > 
> > 	/* All set to register with Kprobes */
> >         register_kprobe(&kp);
> > 	return 0;
> > }
> 
> This interface is horrible.  You actual patch looks good to me, but it
> I can't see why you would need it.  kallsyms_lookup_name deals with modules
> transparently and you shouldn't put a probe at a relative offset into a
> module but only at a symbol you could find with kallsys.
> 
> That beeing said we should probably change the kprobes interface to
> automatically do the kallsysms name lookup for the caller.  It would simplify
> the kprobes interface and allow us to get rid of the kallsyms_lookup_name
> export that doesn't have a valid use except for kprobes.  With
> that change the example kprobe would look like:

This sounds like a good idea. How about we still allow .addr atleast for
users who know what they are doing and would want to just specify a text
addr?

> static struct kprobe kp = {
	.addr		= <addr>

> 	.pre_handler	= handler_pre,
> 	.post_handler	= handler_post,
> 	.fault_handler	= handler_fault,
> 	.symbol_name	= "do_fork",
> };

The symbol_name lookup can then be done when only when .addr is non-NULL.

That said, I have a working patch I was planning to post today that
introduces the KPROBE_ADDR macro that abstracts out the architecture-specific
artefacts of getting the actual text address to probe, so kprobe modules
can be made more portable. I was envisaging this to be used by the module
writer, but with your idea, this could live in-kernel itself.

I'll cook up a patch for this in a short while.

Ananth

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/