linux-kernel - Re: [PATCH for-next] tracing/kprobes: Add symbol counting check when module loads

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20231101081509.605080231a2736b91331cb85@kernel.org>
Date:   Wed, 1 Nov 2023 08:15:09 +0900
From:   Masami Hiramatsu (Google) <mhiramat@...nel.org>
To:     Francis Laniel <flaniel@...ux.microsoft.com>
Cc:     LKML <linux-kernel@...r.kernel.org>,
        Linux trace kernel <linux-trace-kernel@...r.kernel.org>,
        Steven Rostedt <rostedt@...dmis.org>,
        Andrii Nakryiko <andrii@...nel.org>
Subject: Re: [PATCH for-next] tracing/kprobes: Add symbol counting check
 when module loads

Hi,

On Tue, 31 Oct 2023 23:24:43 +0200
Francis Laniel <flaniel@...ux.microsoft.com> wrote:

> > @@ -729,17 +744,55 @@ static int count_mod_symbols(void *data, const char
> > *name, unsigned long unused) return 0;
> >  }
> > 
> > -static unsigned int number_of_same_symbols(char *func_name)
> > +static unsigned int number_of_same_symbols(const char *mod, const char
> > *func_name) {
> >  	struct sym_count_ctx ctx = { .count = 0, .name = func_name };
> > 
> > -	kallsyms_on_each_match_symbol(count_symbols, func_name, &ctx.count);
> > +	if (!mod)
> > +		kallsyms_on_each_match_symbol(count_symbols, func_name, 
> &ctx.count);
> > 
> > -	module_kallsyms_on_each_symbol(NULL, count_mod_symbols, &ctx);
> > +	module_kallsyms_on_each_symbol(mod, count_mod_symbols, &ctx);
> 
> I may be missing something here or reviewing too quickly.
> Wouldn't this function return count to be 0 if func_name is only part of the 
> module named mod?

No, please read below.

> Indeed, if the function is not in kernel symbol, 
> kallsyms_on_each_match_symbol() will not loop.
> And, by giving mod to module_kallsyms_on_each_symbol(), the corresponding 
> module will be skipped, so count_mob_symbols() would not be called.
> Hence, we would have 0 as count, which would lead to ENOENT later.

Would you mean the case func_name is on the specific module?
If 'mod' is specified, module_kallsyms_on_each_symbol() only loops on
symbols in the module names 'mod'.

int module_kallsyms_on_each_symbol(const char *modname,
                                   int (*fn)(void *, const char *, unsigned long),
                                   void *data)
{
        struct module *mod;
        unsigned int i;
        int ret = 0;

        mutex_lock(&module_mutex);
        list_for_each_entry(mod, &modules, list) {
                struct mod_kallsyms *kallsyms;

                if (mod->state == MODULE_STATE_UNFORMED)
                        continue;

                if (modname && strcmp(modname, mod->name))
                        continue;
...

So with above change, 'if mod is not specified, search the symbols in kernel 
and all modules. If mod is sepecified, search the symbol on the specific
module'.

Thus, "if func_name is only part of the module named mod", the
module_kallsyms_on_each_symbol() will count the 'func_name' in 'mod' module
correctly.

Thank you,


Thank you,

-- 
Masami Hiramatsu (Google) <mhiramat@...nel.org>