linux-kernel - Re: Difference in values of addresses in System.map and /proc/kallsyms

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Tue, 19 May 2020 08:57:04 -0700
From:   Randy Dunlap <rdunlap@...radead.org>
To:     Ajay Garg <ajaygargnsit@...il.com>, linux-kernel@...r.kernel.org
Subject: Re: Difference in values of addresses in System.map and
 /proc/kallsyms

Hi--

On 6/22/19 8:28 AM, Ajay Garg wrote:
> Hi All.
> 
> My system is
> 
> ajay@...itude-3480:~$ uname -a
> Linux latitude-3480 4.13.0-38-generic #43~16.04.1-Ubuntu SMP Wed Mar
> 14 17:48:43 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux
> 
> 
> When I see the address for a symbol, say linux_banner, in
> /boot/System.map-4.13.0-38-generic, it shows
> ffffffff81e00120 R linux_banner

That's a static (build-time) address.

> 
> However, when I see it in /proc/kallsyms, it shows
> ffffffffa7000120 R linux_banner
> 

That's where it actually was loaded to at boot time.

> 
> Also, I note that /proc/kallsyms addresses vary upon reboots, so I am
> a little confused as to what the entries in /proc/kallsyms really
> mean.

You forgot to provide the kernel config file.

Possibly it has this config item:
CONFIG_RANDOMIZE_BASE=y

You can read the help text for that config option in
arch/x86/Kconfig.


> So, will be grateful for some pointers from the experts :)
> 
> 
> Thanks and Regards,
> Ajay

If this doesn't explain what you are seeing, then
I don't know.  Maybe someone else can help.

-- 
~Randy