lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Mon, 7 Aug 2006 10:35:17 +0530 From: Ananth N Mavinakayanahalli <ananth@...ibm.com> To: Christoph Hellwig <hch@...radead.org>, David Smith <dsmith@...hat.com>, linux-kernel@...r.kernel.org, rusty@...tcorp.com.au, prasanna@...ibm.com, anil.s.keshavamurthy@...el.com, davem@...emloft.net Subject: Re: [PATCH] module interface improvement for kprobes On Mon, Aug 07, 2006 at 10:22:13AM +0530, Ananth N Mavinakayanahalli wrote: > On Fri, Aug 04, 2006 at 04:57:11PM +0100, Christoph Hellwig wrote: > > > { > > > /* grab the module, making sure it won't get unloaded until > > > * we're done */ > > > const char *mod_name = "joydev"; > > > if (module_get_byname(mod_name, &mod) != 0) > > > return 1; > > > > > > /* Specify the address/offset where you want to insert > > > * probe. If this were a real kprobe module, we'd "relocate" > > > * our probe address based on the load address of the module > > > * we're interested in. */ > > > kp.addr = (kprobe_opcode_t *) mod->module_core + 0; > > > > > > /* All set to register with Kprobes */ > > > register_kprobe(&kp); > > > return 0; > > > } > > > > This interface is horrible. You actual patch looks good to me, but it > > I can't see why you would need it. kallsyms_lookup_name deals with modules > > transparently and you shouldn't put a probe at a relative offset into a > > module but only at a symbol you could find with kallsys. > > > > That beeing said we should probably change the kprobes interface to > > automatically do the kallsysms name lookup for the caller. It would simplify > > the kprobes interface and allow us to get rid of the kallsyms_lookup_name > > export that doesn't have a valid use except for kprobes. With > > that change the example kprobe would look like: > > This sounds like a good idea. How about we still allow .addr atleast for > users who know what they are doing and would want to just specify a text > addr? > > > static struct kprobe kp = { > .addr = <addr> > > > .pre_handler = handler_pre, > > .post_handler = handler_post, > > .fault_handler = handler_fault, > > .symbol_name = "do_fork", > > }; > > The symbol_name lookup can then be done when only when .addr is non-NULL. Duh! I meant to say lookup when .addr is NULL. Ananth - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists