linux-kernel - Re: kprobe: __blkdev

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20200619133240.GA351476@T590>
Date:   Fri, 19 Jun 2020 21:32:40 +0800
From:   Ming Lei <ming.lei@...hat.com>
To:     Steven Rostedt <rostedt@...dmis.org>
Cc:     Masami Hiramatsu <mhiramat@...nel.org>,
        Ming Lei <tom.leiming@...il.com>,
        "Naveen N. Rao" <naveen.n.rao@...ux.ibm.com>,
        Anil S Keshavamurthy <anil.s.keshavamurthy@...el.com>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        "David S. Miller" <davem@...emloft.net>,
        linux-block <linux-block@...r.kernel.org>
Subject: Re: kprobe: __blkdev_put probe is missed

On Fri, Jun 19, 2020 at 08:19:54AM -0400, Steven Rostedt wrote:
> On Fri, 19 Jun 2020 15:28:59 +0800
> Ming Lei <ming.lei@...hat.com> wrote:
> 
> > > 
> > > OK, then let's make events (for sure)
> > > 
> > > root@...note2:/sys/kernel/debug/tracing# echo p __blkdev_put >> kprobe_events 
> > > root@...note2:/sys/kernel/debug/tracing# echo r __blkdev_put >> kprobe_events 
> > > root@...note2:/sys/kernel/debug/tracing# echo p blkdev_put >> kprobe_events 
> 
> Hi Ming,
> 
> Do you have the kprobe_events file?
> 
> > > root@...note2:/sys/kernel/debug/tracing# echo 1 > events/kprobes/enable   
> > 
> > I can't find 'events/kprobes' in my VM with upstream kernel, also not found
> > the dir under fedora31(5.5.15-200) & rhel8(v4.18 based).
> 
> The events/kprobes directly will be created when you create a
> kprobe_event. It wont exist until then.

Hi Steven and Masami,

Got it, thanks for your help, now I can run the test, follows the steps
and results, and there is still one __blkdev_put probed.

And it is observed in my VM reliably with 5.7+ or Fedora kernel reliably,
kernel config is attached.

[root@...st-01 tracing]# uname -a
Linux ktest-01 5.7.0+ #1900 SMP Fri Jun 19 16:26:47 CST 2020 x86_64 x86_64 x86_64 GNU/Linux
[root@...st-01 tracing]#
[root@...st-01 tracing]# cat kprobe_events
[root@...st-01 tracing]#
[root@...st-01 tracing]# echo p blkdev_put >> kprobe_events
[root@...st-01 tracing]# echo p __blkdev_put >> kprobe_events
[root@...st-01 tracing]# echo r __blkdev_put >> kprobe_events
[root@...st-01 tracing]#
[root@...st-01 tracing]# echo 1 > events/kprobes/enable
[root@...st-01 tracing]# blockdev --getbsz /dev/sda1
4096
[root@...st-01 tracing]# echo 0 > events/kprobes/enable
[root@...st-01 tracing]# cat trace
# tracer: nop
#
# entries-in-buffer/entries-written: 3/3   #P:8
#
#                              _-----=> irqs-off
#                             / _----=> need-resched
#                            | / _---=> hardirq/softirq
#                            || / _--=> preempt-depth
#                            ||| /     delay
#           TASK-PID   CPU#  ||||    TIMESTAMP  FUNCTION
#              | |       |   ||||       |         |
        blockdev-970   [005] .... 17603.447236: p_blkdev_put_0: (blkdev_put+0x0/0xb4)
        blockdev-970   [005] .... 17603.447244: p___blkdev_put_0: (__blkdev_put+0x0/0x19d)
        blockdev-970   [005] d... 17603.447251: r___blkdev_put_0: (blkdev_close+0x22/0x25 <- __blkdev_put)


Thanks,
Ming

Download attachment "config.tar.gz" of type "application/gzip" (25982 bytes)