linux-kernel - Re: [PATCH 0/3][RFC] tracing/kprobes: prevent jprobes from crashing function graph tracer

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <4AEA382C.5080307@redhat.com>
Date:	Thu, 29 Oct 2009 20:49:48 -0400
From:	Masami Hiramatsu <mhiramat@...hat.com>
To:	rostedt@...dmis.org
CC:	linux-kernel@...r.kernel.org, Ingo Molnar <mingo@...e.hu>,
	Andrew Morton <akpm@...ux-foundation.org>,
	Frederic Weisbecker <fweisbec@...il.com>,
	Peter Zijlstra <peterz@...radead.org>,
	Thomas Gleixner <tglx@...utronix.de>,
	Arnaldo Carvalho de Melo <acme@...hat.com>,
	"H. Peter Anvin" <hpa@...or.com>, Li Zefan <lizf@...fujitsu.com>,
	Lai Jiangshan <laijs@...fujitsu.com>,
	"David S. Miller" <davem@...emloft.net>,
	Stephen Hemminger <shemminger@...ux-foundation.org>
Subject: Re: [PATCH 0/3][RFC] tracing/kprobes: prevent jprobes from crashing
 function graph tracer



Steven Rostedt wrote:
> On Thu, 2009-10-29 at 19:22 -0400, Masami Hiramatsu wrote:
>> Steven Rostedt wrote:
> 
>>>> I think we can skip those user handlers, because those are irregular
>>>> functions and user can control (enable/disable) it.
>>>
>>> True, but it may be nice to still trace them.
>>
>> Hm, in that case, I think we can change jprobe_return() to call
>> f-g-tracer's return handler if needed as below;
>> ---
>> static inline jprobe_return(void)
>> {
>> 	implicit_function_return();	/* This executes f-g-tracer prologue */
>> 	__jprobe_return();	/* This should be notraced */
>> }
> 
> Hmm, That looks like it can be quite a hack. We don't know at that
> moment if the handler has been traced or not. We can't always do the
> function graph logic.

Ah, right. Perhaps, jprobe might be able to save the address of top
of the stack and check if it has been modified to return_to_handler
at jprobe_return().

But anyway, I think your patch can fix that too. :-)

Thank you,

-- 
Masami Hiramatsu

Software Engineer
Hitachi Computer Products (America), Inc.
Software Solutions Division

e-mail: mhiramat@...hat.com

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/