linux-kernel - Re: [RFC bpf-next 1/4] kallsyms: Add kallsyms_lookup

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 12 Apr 2022 22:28:09 +0200
From:   Jiri Olsa <olsajiri@...il.com>
To:     Andrii Nakryiko <andrii.nakryiko@...il.com>
Cc:     Jiri Olsa <jolsa@...nel.org>, Alexei Starovoitov <ast@...nel.org>,
        Daniel Borkmann <daniel@...earbox.net>,
        Andrii Nakryiko <andrii@...nel.org>,
        Masami Hiramatsu <mhiramat@...nel.org>,
        Networking <netdev@...r.kernel.org>, bpf <bpf@...r.kernel.org>,
        lkml <linux-kernel@...r.kernel.org>,
        Martin KaFai Lau <kafai@...com>,
        Song Liu <songliubraving@...com>, Yonghong Song <yhs@...com>,
        John Fastabend <john.fastabend@...il.com>,
        KP Singh <kpsingh@...omium.org>
Subject: Re: [RFC bpf-next 1/4] kallsyms: Add kallsyms_lookup_names function

On Mon, Apr 11, 2022 at 03:15:23PM -0700, Andrii Nakryiko wrote:

SNIP

> >  static inline int kallsyms_lookup_size_offset(unsigned long addr,
> >                                               unsigned long *symbolsize,
> >                                               unsigned long *offset)
> > diff --git a/kernel/kallsyms.c b/kernel/kallsyms.c
> > index 79f2eb617a62..a3738ddf9e87 100644
> > --- a/kernel/kallsyms.c
> > +++ b/kernel/kallsyms.c
> > @@ -29,6 +29,8 @@
> >  #include <linux/compiler.h>
> >  #include <linux/module.h>
> >  #include <linux/kernel.h>
> > +#include <linux/bsearch.h>
> > +#include <linux/sort.h>
> >
> >  /*
> >   * These will be re-linked against their real values
> > @@ -572,6 +574,52 @@ int sprint_backtrace_build_id(char *buffer, unsigned long address)
> >         return __sprint_symbol(buffer, address, -1, 1, 1);
> >  }
> >
> > +static int symbols_cmp(const void *a, const void *b)
> 
> isn't this literally strcmp? Or compiler will actually complain about
> const void * vs const char *?

yes..

kernel/kallsyms.c: In function ‘kallsyms_callback’:
kernel/kallsyms.c:597:73: error: passing argument 5 of ‘bsearch’ from incompatible pointer type [-Werror=incompatible-pointer-types]
  597 |         if (!bsearch(&name, args->syms, args->cnt, sizeof(*args->syms), strcmp))
      |                                                                         ^~~~~~
      |                                                                         |
      |                                                                         int (*)(const char *, const char *)


> 
> > +{
> > +       const char **str_a = (const char **) a;
> > +       const char **str_b = (const char **) b;
> > +
> > +       return strcmp(*str_a, *str_b);
> > +}
> > +
> > +struct kallsyms_data {
> > +       unsigned long *addrs;
> > +       const char **syms;
> > +       u32 cnt;
> > +       u32 found;
> > +};
> > +
> > +static int kallsyms_callback(void *data, const char *name,
> > +                            struct module *mod, unsigned long addr)
> > +{
> > +       struct kallsyms_data *args = data;
> > +
> > +       if (!bsearch(&name, args->syms, args->cnt, sizeof(*args->syms), symbols_cmp))
> > +               return 0;
> > +
> > +       addr = ftrace_location(addr);
> > +       if (!addr)
> > +               return 0;
> > +
> > +       args->addrs[args->found++] = addr;
> > +       return args->found == args->cnt ? 1 : 0;
> > +}
> > +
> > +int kallsyms_lookup_names(const char **syms, u32 cnt, unsigned long *addrs)
> > +{
> > +       struct kallsyms_data args;
> > +
> > +       sort(syms, cnt, sizeof(*syms), symbols_cmp, NULL);
> > +
> > +       args.addrs = addrs;
> > +       args.syms = syms;
> > +       args.cnt = cnt;
> > +       args.found = 0;
> > +       kallsyms_on_each_symbol(kallsyms_callback, &args);
> > +
> > +       return args.found == args.cnt ? 0 : -EINVAL;
> 
> ESRCH or ENOENT makes a bit more sense as an error?

ok

jirka

> 
> 
> > +}
> > +
> >  /* To avoid using get_symbol_offset for every symbol, we carry prefix along. */
> >  struct kallsym_iter {
> >         loff_t pos;
> > --
> > 2.35.1
> >