linux-kernel - Re: [PATCH for-next] tracing/kprobes: Add symbol counting check when module loads

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 3 Nov 2023 12:27:19 +0900
From:   Masami Hiramatsu (Google) <mhiramat@...nel.org>
To:     Francis Laniel <flaniel@...ux.microsoft.com>
Cc:     LKML <linux-kernel@...r.kernel.org>,
        Linux trace kernel <linux-trace-kernel@...r.kernel.org>,
        Steven Rostedt <rostedt@...dmis.org>,
        Andrii Nakryiko <andrii@...nel.org>
Subject: Re: [PATCH for-next] tracing/kprobes: Add symbol counting check
 when module loads

On Thu, 02 Nov 2023 14:57:12 +0200
Francis Laniel <flaniel@...ux.microsoft.com> wrote:

> Hi!
> 
> Le mercredi 1 novembre 2023, 01:15:09 EET Masami Hiramatsu a écrit :
> > Hi,
> > 
> > On Tue, 31 Oct 2023 23:24:43 +0200
> > 
> > Francis Laniel <flaniel@...ux.microsoft.com> wrote:
> > > > @@ -729,17 +744,55 @@ static int count_mod_symbols(void *data, const
> > > > char
> > > > *name, unsigned long unused) return 0;
> > > > 
> > > >  }
> > > > 
> > > > -static unsigned int number_of_same_symbols(char *func_name)
> > > > +static unsigned int number_of_same_symbols(const char *mod, const char
> > > > *func_name) {
> > > > 
> > > >  	struct sym_count_ctx ctx = { .count = 0, .name = func_name };
> > > > 
> > > > -	kallsyms_on_each_match_symbol(count_symbols, func_name, &ctx.count);
> > > > +	if (!mod)
> > > > +		kallsyms_on_each_match_symbol(count_symbols, func_name,
> > > 
> > > &ctx.count);
> > > 
> > > > -	module_kallsyms_on_each_symbol(NULL, count_mod_symbols, &ctx);
> > > > +	module_kallsyms_on_each_symbol(mod, count_mod_symbols, &ctx);
> > > 
> > > I may be missing something here or reviewing too quickly.
> > > Wouldn't this function return count to be 0 if func_name is only part of
> > > the module named mod?
> > 
> > No, please read below.
> > 
> > > Indeed, if the function is not in kernel symbol,
> > > kallsyms_on_each_match_symbol() will not loop.
> > > And, by giving mod to module_kallsyms_on_each_symbol(), the corresponding
> > > module will be skipped, so count_mob_symbols() would not be called.
> > > Hence, we would have 0 as count, which would lead to ENOENT later.
> > 
> > Would you mean the case func_name is on the specific module?
> > If 'mod' is specified, module_kallsyms_on_each_symbol() only loops on
> > symbols in the module names 'mod'.
> > 
> > int module_kallsyms_on_each_symbol(const char *modname,
> >                                    int (*fn)(void *, const char *, unsigned
> > long), void *data)
> > {
> >         struct module *mod;
> >         unsigned int i;
> >         int ret = 0;
> > 
> >         mutex_lock(&module_mutex);
> >         list_for_each_entry(mod, &modules, list) {
> >                 struct mod_kallsyms *kallsyms;
> > 
> >                 if (mod->state == MODULE_STATE_UNFORMED)
> >                         continue;
> > 
> >                 if (modname && strcmp(modname, mod->name))
> >                         continue;
> > ...
> > 
> > So with above change, 'if mod is not specified, search the symbols in kernel
> > and all modules. If mod is sepecified, search the symbol on the specific
> > module'.
> > 
> > Thus, "if func_name is only part of the module named mod", the
> > module_kallsyms_on_each_symbol() will count the 'func_name' in 'mod' module
> > correctly.
> 
> Sorry, I looked to quickly and forgot about the return value of strcmp()...

No problem, strcmp() always traps us :)

> 
> From the code, everything seems OK!
> If I have some time, I will test it and potentially come back with a "Tested-
> by" tag but without any warranty.


Thank you!



> 
> > Thank you,
> > 
> > 
> > Thank you,
> 
> Best regards.
> 
> 


-- 
Masami Hiramatsu (Google) <mhiramat@...nel.org>