linux-kernel - Re: [PATCH 1/4] kprobes: delay blacklist symbol lookup until we actually need it

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 4 Apr 2013 09:57:18 +0200
From:	Oskar Andero <oskar.andero@...ymobile.com>
To:	Masami Hiramatsu <masami.hiramatsu.pt@...achi.com>
CC:	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	"davem@...emloft.net" <davem@...emloft.net>,
	"anil.s.keshavamurthy@...el.com" <anil.s.keshavamurthy@...el.com>,
	"ananth@...ibm.com" <ananth@...ibm.com>,
	"Lekanovic, Radovan" <Radovan.Lekanovic@...ymobile.com>,
	Davidsson, Björn 
	<Bjorn.Davidsson@...ymobile.com>,
	"Collett, Toby" <Toby.Collett@...ymobile.com>,
	"yrl.pp-manager.tt@...achi.com" <yrl.pp-manager.tt@...achi.com>
Subject: Re: [PATCH 1/4] kprobes: delay blacklist symbol lookup until we
 actually need it

On 08:44 Thu 04 Apr     , Masami Hiramatsu wrote:
> (2013/04/03 17:28), oskar.andero@...ymobile.com wrote:
> >  
> > +/* it can take some time ( > 100ms ) to initialise the
> > + * blacklist so we delay this until we actually need it
> > + */
> > +static void init_kprobe_blacklist(void)
> > +{
> > +	int i;
> > +	unsigned long offset = 0, size = 0;
> > +	char *modname, namebuf[128];
> > +	const char *symbol_name;
> > +	void *addr;
> > +	struct kprobe_blackpoint *kb;
> > +
> > +	/*
> > +	 * Lookup and populate the kprobe_blacklist.
> > +	 *
> > +	 * Unlike the kretprobe blacklist, we'll need to determine
> > +	 * the range of addresses that belong to the said functions,
> > +	 * since a kprobe need not necessarily be at the beginning
> > +	 * of a function.
> > +	 */
> > +	for (kb = kprobe_blacklist; kb->name != NULL; kb++) {
> > +		kprobe_lookup_name(kb->name, addr);
> > +		if (!addr)
> > +			continue;
> > +
> > +		kb->start_addr = (unsigned long)addr;
> > +		symbol_name = kallsyms_lookup(kb->start_addr,
> > +				&size, &offset, &modname, namebuf);
> > +		if (!symbol_name)
> > +			kb->range = 0;
> > +		else
> > +			kb->range = size;
> > +	}
> > +
> > +	if (kretprobe_blacklist_size) {
> > +		/* lookup the function address from its name */
> > +		for (i = 0; kretprobe_blacklist[i].name != NULL; i++) {
> > +			kprobe_lookup_name(kretprobe_blacklist[i].name,
> > +					   kretprobe_blacklist[i].addr);
> > +			if (!kretprobe_blacklist[i].addr)
> > +				printk("kretprobe: lookup failed: %s\n",
> > +				       kretprobe_blacklist[i].name);
> > +		}
> > +	}
> > +	kprobe_blacklist_initialized = 1;
> > +}
> > +
> >  #ifdef __ARCH_WANT_KPROBES_INSN_SLOT
> >  /*
> >   * kprobe->ainsn.insn points to the copy of the instruction to be
> > @@ -1331,6 +1379,9 @@ static int __kprobes in_kprobes_functions(unsigned long addr)
> >  	if (addr >= (unsigned long)__kprobes_text_start &&
> >  	    addr < (unsigned long)__kprobes_text_end)
> >  		return -EINVAL;
> > +
> > +	if (!kprobe_blacklist_initialized)
> > +		init_kprobe_blacklist();
> >  	/*
> >  	 * If there exists a kprobe_blacklist, verify and
> >  	 * fail any probe registration in the prohibited area
> > @@ -1816,6 +1867,8 @@ int __kprobes register_kretprobe(struct kretprobe *rp)
> >  	void *addr;
> >  
> >  	if (kretprobe_blacklist_size) {
> > +		if (!kprobe_blacklist_initialized)
> > +			init_kprobe_blacklist();
> 
> Joonsoo reminds me that these calling points are not protected by kprobe_mutex,
> thus we have to do something for avoiding concurrent initialization.
> 
> Perhaps, the easiest way is to protect init_kprobe_blacklist() by kprobe_mutex
> and check kprobe_blacklist_initialized again in the top of that.

Yes, you are right. I had a second look at Joonsoo's patch and I will
add a similar mutex for v2.

-Oskar
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/