linux-kernel - Re: [PATCH] module interface improvement for kprobes

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20060807050517.GA18437@in.ibm.com>
Date:	Mon, 7 Aug 2006 10:35:17 +0530
From:	Ananth N Mavinakayanahalli <ananth@...ibm.com>
To:	Christoph Hellwig <hch@...radead.org>,
	David Smith <dsmith@...hat.com>, linux-kernel@...r.kernel.org,
	rusty@...tcorp.com.au, prasanna@...ibm.com,
	anil.s.keshavamurthy@...el.com, davem@...emloft.net
Subject: Re: [PATCH] module interface improvement for kprobes

On Mon, Aug 07, 2006 at 10:22:13AM +0530, Ananth N Mavinakayanahalli wrote:
> On Fri, Aug 04, 2006 at 04:57:11PM +0100, Christoph Hellwig wrote:
> > > {
> > > 	/* grab the module, making sure it won't get unloaded until
> > > 	 * we're done */
> > > 	const char *mod_name = "joydev";
> > > 	if (module_get_byname(mod_name, &mod) != 0)
> > > 		return 1;
> > > 
> > > 	/* Specify the address/offset where you want to insert
> > > 	 * probe.  If this were a real kprobe module, we'd "relocate"
> > > 	 * our probe address based on the load address of the module
> > > 	 * we're interested in. */
> > > 	kp.addr = (kprobe_opcode_t *) mod->module_core + 0;
> > > 
> > > 	/* All set to register with Kprobes */
> > >         register_kprobe(&kp);
> > > 	return 0;
> > > }
> > 
> > This interface is horrible.  You actual patch looks good to me, but it
> > I can't see why you would need it.  kallsyms_lookup_name deals with modules
> > transparently and you shouldn't put a probe at a relative offset into a
> > module but only at a symbol you could find with kallsys.
> > 
> > That beeing said we should probably change the kprobes interface to
> > automatically do the kallsysms name lookup for the caller.  It would simplify
> > the kprobes interface and allow us to get rid of the kallsyms_lookup_name
> > export that doesn't have a valid use except for kprobes.  With
> > that change the example kprobe would look like:
> 
> This sounds like a good idea. How about we still allow .addr atleast for
> users who know what they are doing and would want to just specify a text
> addr?
> 
> > static struct kprobe kp = {
> 	.addr		= <addr>
> 
> > 	.pre_handler	= handler_pre,
> > 	.post_handler	= handler_post,
> > 	.fault_handler	= handler_fault,
> > 	.symbol_name	= "do_fork",
> > };
> 
> The symbol_name lookup can then be done when only when .addr is non-NULL.

Duh! I meant to say lookup when .addr is NULL.

Ananth
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/