linux-kernel - Re: [PATCH for-next] tracing/kprobes: Add symbol counting check when module loads

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <5987802.lOV4Wx5bFT@pwmachine>
Date:   Thu, 02 Nov 2023 14:57:12 +0200
From:   Francis Laniel <flaniel@...ux.microsoft.com>
To:     Masami Hiramatsu <mhiramat@...nel.org>
Cc:     LKML <linux-kernel@...r.kernel.org>,
        Linux trace kernel <linux-trace-kernel@...r.kernel.org>,
        Steven Rostedt <rostedt@...dmis.org>,
        Andrii Nakryiko <andrii@...nel.org>
Subject: Re: [PATCH for-next] tracing/kprobes: Add symbol counting check when module loads

Hi!

Le mercredi 1 novembre 2023, 01:15:09 EET Masami Hiramatsu a écrit :
> Hi,
> 
> On Tue, 31 Oct 2023 23:24:43 +0200
> 
> Francis Laniel <flaniel@...ux.microsoft.com> wrote:
> > > @@ -729,17 +744,55 @@ static int count_mod_symbols(void *data, const
> > > char
> > > *name, unsigned long unused) return 0;
> > > 
> > >  }
> > > 
> > > -static unsigned int number_of_same_symbols(char *func_name)
> > > +static unsigned int number_of_same_symbols(const char *mod, const char
> > > *func_name) {
> > > 
> > >  	struct sym_count_ctx ctx = { .count = 0, .name = func_name };
> > > 
> > > -	kallsyms_on_each_match_symbol(count_symbols, func_name, &ctx.count);
> > > +	if (!mod)
> > > +		kallsyms_on_each_match_symbol(count_symbols, func_name,
> > 
> > &ctx.count);
> > 
> > > -	module_kallsyms_on_each_symbol(NULL, count_mod_symbols, &ctx);
> > > +	module_kallsyms_on_each_symbol(mod, count_mod_symbols, &ctx);
> > 
> > I may be missing something here or reviewing too quickly.
> > Wouldn't this function return count to be 0 if func_name is only part of
> > the module named mod?
> 
> No, please read below.
> 
> > Indeed, if the function is not in kernel symbol,
> > kallsyms_on_each_match_symbol() will not loop.
> > And, by giving mod to module_kallsyms_on_each_symbol(), the corresponding
> > module will be skipped, so count_mob_symbols() would not be called.
> > Hence, we would have 0 as count, which would lead to ENOENT later.
> 
> Would you mean the case func_name is on the specific module?
> If 'mod' is specified, module_kallsyms_on_each_symbol() only loops on
> symbols in the module names 'mod'.
> 
> int module_kallsyms_on_each_symbol(const char *modname,
>                                    int (*fn)(void *, const char *, unsigned
> long), void *data)
> {
>         struct module *mod;
>         unsigned int i;
>         int ret = 0;
> 
>         mutex_lock(&module_mutex);
>         list_for_each_entry(mod, &modules, list) {
>                 struct mod_kallsyms *kallsyms;
> 
>                 if (mod->state == MODULE_STATE_UNFORMED)
>                         continue;
> 
>                 if (modname && strcmp(modname, mod->name))
>                         continue;
> ...
> 
> So with above change, 'if mod is not specified, search the symbols in kernel
> and all modules. If mod is sepecified, search the symbol on the specific
> module'.
> 
> Thus, "if func_name is only part of the module named mod", the
> module_kallsyms_on_each_symbol() will count the 'func_name' in 'mod' module
> correctly.

Sorry, I looked to quickly and forgot about the return value of strcmp()...

From the code, everything seems OK!
If I have some time, I will test it and potentially come back with a "Tested-
by" tag but without any warranty.

> Thank you,
> 
> 
> Thank you,

Best regards.