linux-kernel - Re: Re: [PATCH tip/master 1/3] kprobes: Support blacklist functions in module

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <55AE1CA7.7010200@hitachi.com>
Date:	Tue, 21 Jul 2015 19:19:19 +0900
From:	Masami Hiramatsu <masami.hiramatsu.pt@...achi.com>
To:	Ingo Molnar <mingo@...nel.org>
CC:	Pratyush Anand <panand@...hat.com>,
	Ananth N Mavinakayanahalli <ananth@...ibm.com>,
	Rusty Russell <rusty@...tcorp.com.au>,
	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
	Ingo Molnar <mingo@...hat.com>, Rob Landley <rob@...dley.net>,
	"H. Peter Anvin" <hpa@...or.com>,
	Thomas Gleixner <tglx@...utronix.de>,
	"David S. Miller" <davem@...emloft.net>
Subject: Re: Re: [PATCH tip/master 1/3] kprobes: Support blacklist functions
 in module

On 2015/07/21 16:48, Ingo Molnar wrote:
> * Masami Hiramatsu <masami.hiramatsu.pt@...achi.com> wrote:
> 
>> For some symbols we can do that. But it can conflict with other __section
>> attributes e.g. __sched, since a function must be placed in only one
>> section. [...]
> 
> The the scheduler is not modular, so __sched should not be a problem in itself.

No, I meant why I chose this macro, itself should not be a section.
Or would we better use __nokprobe in module and NOKPROBE_SYMBOL in kernel? :(

>> [...] So, IMHO, using section for expressing its attribute is not a good idea, 
>> but I couldn't find another option in common function attribute.
>>
>> https://gcc.gnu.org/onlinedocs/gcc/Common-Function-Attributes.html#Common-Function-Attributes
>>
>> Thus I've introduced NOKPROBE_SYMBOL macro which stores the target function
>> addresses (not the function itself) in the _kprobe_blacklist section.
> 
> So the question is, in which cases do modules need this?

The main reason for this is to put the kprobes handlers (and the functions called
from the kprobe handlers) on the blacklist. And also, there may be some cases which
NMI handlers can be in modules (as setting kconfig "m").

Thank you,

-- 
Masami HIRAMATSU
Linux Technology Research Center, System Productivity Research Dept.
Center for Technology Innovation - Systems Engineering
Hitachi, Ltd., Research & Development Group
E-mail: masami.hiramatsu.pt@...achi.com
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/