linux-kernel - [OT] Pseudo module name in kallsyms (Re: [PATCH V3 03/13] kprobes: Add symbols for kprobe insn pages)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 3 Mar 2020 19:47:00 +0900
From:   Masami Hiramatsu <mhiramat@...nel.org>
To:     Jiri Olsa <jolsa@...hat.com>
Cc:     Steven Rostedt <rostedt@...dmis.org>,
        Masami Hiramatsu <mhiramat@...nel.org>,
        Adrian Hunter <adrian.hunter@...el.com>,
        Peter Zijlstra <peterz@...radead.org>,
        Ingo Molnar <mingo@...hat.com>, Borislav Petkov <bp@...en8.de>,
        "H . Peter Anvin" <hpa@...or.com>, x86@...nel.org,
        Mark Rutland <mark.rutland@....com>,
        Alexander Shishkin <alexander.shishkin@...ux.intel.com>,
        Mathieu Poirier <mathieu.poirier@...aro.org>,
        Leo Yan <leo.yan@...aro.org>,
        Arnaldo Carvalho de Melo <acme@...nel.org>,
        linux-kernel@...r.kernel.org
Subject: [OT] Pseudo module name in kallsyms (Re: [PATCH V3 03/13] kprobes:
 Add symbols for kprobe insn pages)

Hi,

On Mon, 2 Mar 2020 15:43:07 +0100
Jiri Olsa <jolsa@...hat.com> wrote:

> On Sat, Feb 29, 2020 at 06:49:13PM -0500, Steven Rostedt wrote:
> > On Sat, 29 Feb 2020 13:49:47 +0900
> > Masami Hiramatsu <mhiramat@...nel.org> wrote:
> > 
> > > On Fri, 28 Feb 2020 18:20:04 +0100
> > > Jiri Olsa <jolsa@...hat.com> wrote:
> > > 
> > > > > BTW, it seems to pretend to be a module, but is there no concern of
> > > > > confusing users? Shouldn't it be [*kprobes] so that it is non-exist
> > > > > module name?  
> > > > 
> > > > note we already have bpf symbols as [bpf] module  
> > > 
> > > Yeah, and this series adds [kprobe(s)] and [ftrace] too.
> > > I simply concern that the those module names implicitly become
> > > special word (rule) and embedded in the code. If such module names
> > > are not exposed to users, it is OK (but I hope to have some comments).
> > > However, it is under /proc, which means users can notice it.
> > 
> > I share Masami's concerns. It would be good to have something
> > differentiate local functions that are not modules. That's one way I
> > look to see if something is a module or built in, is to see if kallsyms
> > has it as a [].
> > 
> > Perhaps prepend with: '&' ?

Yeah, '*' may not good from the filename point of view.

> 
> that would break some of the perf code.. IMO Arnaldo's explanation
> makes sense and we could keep it as it is

 From the in-kernel API/coding point of view,

+static int get_ksymbol_kprobe(struct kallsym_iter *iter)
+{
+	strlcpy(iter->module_name, "kprobe", MODULE_NAME_LEN);
+	iter->exported = 0;
+	return kprobe_get_kallsym(iter->pos - iter->pos_bpf_end,
+				  &iter->value, &iter->type,
+				  iter->name) < 0 ? 0 : 1;
 }

This clearly shows that is a iter->module_name.

And also, if someone make a module names "kprobes.ko", it will also
have [kprobes] in kallsyms. That is also confusing.


Thank you,

-- 
Masami Hiramatsu <mhiramat@...nel.org>