linux-kernel - Re: kprobe on local function

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20250129063916.07WPgeQD@linutronix.de>
Date: Wed, 29 Jan 2025 13:41:25 +0700
From: Nam Cao <namcao@...utronix.de>
To: Masami Hiramatsu <mhiramat@...nel.org>
Cc: Steven Rostedt <rostedt@...dmis.org>, naveen@...nel.org,
	anil.s.keshavamurthy@...el.com, davem@...emloft.net,
	linux-kernel@...r.kernel.org, linux-trace-kernel@...r.kernel.org,
	john.ogness@...utronix.de
Subject: Re: kprobe on local function

On Sat, Jan 25, 2025 at 01:16:55AM +0900, Masami Hiramatsu wrote:
> Now what you could know is that the kernel does not call the
> "rt_mutex_slowunlock" symbol and it may call another copied symbol. That's
> a good to know right?
> 
> Note that this in-kernel kretprobe API is a low-layer API, so that user is
> responsible for controlling it carefully. This kretprobe API itself does NOT
> know which copy of the optimized symbols are used.
> (there could be inlined instance too)
> 
> If you need to know how many copies are generated or inlined, you need to
> use the debuginfo as "perf probe" tool does, which can not handled by the
> kernel itself because it is too big to be loaded. That is why I made the
> "perf probe" as an external tool.

Got it, thanks so much for the information!

Best regards,
Nam