linux-kernel - Re: [PATCH v8 7/9] livepatch: Improve the search performance of module_kallsyms_on_each

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 14 Nov 2022 19:30:16 +0800
From:   "Leizhen (ThunderTown)" <thunder.leizhen@...wei.com>
To:     Jiri Olsa <olsajiri@...il.com>
CC:     Josh Poimboeuf <jpoimboe@...nel.org>,
        Jiri Kosina <jikos@...nel.org>,
        Miroslav Benes <mbenes@...e.cz>,
        Petr Mladek <pmladek@...e.com>,
        Joe Lawrence <joe.lawrence@...hat.com>,
        <live-patching@...r.kernel.org>, <linux-kernel@...r.kernel.org>,
        Masahiro Yamada <masahiroy@...nel.org>,
        Alexei Starovoitov <ast@...nel.org>,
        Kees Cook <keescook@...omium.org>,
        Andrew Morton <akpm@...ux-foundation.org>,
        Luis Chamberlain <mcgrof@...nel.org>,
        <linux-modules@...r.kernel.org>,
        Steven Rostedt <rostedt@...dmis.org>,
        Ingo Molnar <mingo@...hat.com>,
        David Laight <David.Laight@...lab.com>,
        Stephen Rothwell <sfr@...b.auug.org.au>
Subject: Re: [PATCH v8 7/9] livepatch: Improve the search performance of
 module_kallsyms_on_each_symbol()



On 2022/11/14 18:31, Jiri Olsa wrote:
> On Mon, Nov 14, 2022 at 06:00:38PM +0800, Leizhen (ThunderTown) wrote:
>>
>>
>> On 2022/11/14 17:27, Jiri Olsa wrote:
>>> On Mon, Nov 14, 2022 at 04:50:25PM +0800, Leizhen (ThunderTown) wrote:
>>>>
>>>> On 2022/11/14 15:47, Jiri Olsa wrote:
>>>>> On Wed, Nov 02, 2022 at 04:49:19PM +0800, Zhen Lei wrote:
>>>>>> Currently we traverse all symbols of all modules to find the specified
>>>>>> function for the specified module. But in reality, we just need to find
>>>>>> the given module and then traverse all the symbols in it.
>>>>> hi,
>>>>> sorry for delayed answer, I did not notice this until Stephen's email
>>>>> about merge issue with recent bpf change [1]
>>>>>
>>>>>> Let's add a new parameter 'const char *modname' to function
>>>>>> module_kallsyms_on_each_symbol(), then we can compare the module names
>>>>> we have use case for iterating all modules and their symbols when we
>>>>> want to resolve passed addresses for tracing
>>>>>
>>>>> we don't have 'modname' that we could pass, we need to iterate all modules
>>>>>
>>>>> so perhaps this could be made optional like with passing NULL for modname?
>>>> The deletion of modname was suggested by Petr Mladek. The reason is that
>>>> everyone passes modname as NULL, there was no actual demand at the time.
>>>> https://lkml.org/lkml/2022/9/20/682
>>>>
>>>>>> directly in this function and call hook 'fn' after matching. And the
>>>>>> parameter 'struct module *' in the hook 'fn' can also be deleted.
>>>>> we need 'struct module *' argument in the callback as well because we are
>>>>> taking the module reference if we trace function in it, so it wont get
>>>>> unloaded
>>>>>
>>>>> please let me know if I should do the change or can help in any way
>>>> It seems that we should take the module reference before invoking callback
>>>> and put it after it is called, without passing modname.
>>> we take the module ref only if we (callback) find the traced address in
>>> the module, we don't have the module object before
>>>
>>> jirka
>>>
>>
>> Do it in function module_kallsyms_on_each_symbol()?
>>
>> But I just saw that mutex_lock(&module_mutex) protection is already
>> provided in this function. So reference counting protection may not
>> be required.
> 
> we take the module ref so it won't unload even outside of the
> module_kallsyms_on_each_symbol function

There's another way to do it, but it's more time consuming.

struct module *__module_text_address(unsigned long addr);
struct module *__module_address(unsigned long addr);

Which way do you think is more appropriate?


> 
> jirka
> .
> 

-- 
Regards,
  Zhen Lei