skip kprobe functions outside normal text section #1647
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
Makes sense I think, but with this patch we are parsing kallsyms twice
line-by-line. I don’t know if that’s a big deal but maybe we can parse it
only once and then filter out in memory.
On Fri, Mar 23, 2018 at 09:27 yonghong-song ***@***.***> wrote:
@yonghong-song <https://github.com/yonghong-song> requested your review
on: iovisor/bcc#1647 <#1647> skip
kprobe functions outside normal text section as a code owner.
—
You are receiving this because your review was requested.
Reply to this email directly, view it on GitHub
<#1647 (comment)>, or mute the
thread
<https://github.com/notifications/unsubscribe-auth/ABm3vYYver4NwxOqohvvXAzuUHmTt75yks5thJXkgaJpZM4S4O9c>
.
--
*Sasha Goldshtein* | CTO, Sela Group | Microsoft C# MVP | blog.sashag.net |
@goldshtn <http://twitter.com/goldshtn>
|
Fix issue #1634. When kernel is about to attach a kprobe, the following functions are called: register_kprobe check_kprobe_address_safe kernel_text_address core_kernel_text In core_kernel_text, we have: if (addr >= (unsigned long)_stext && addr < (unsigned long)_etext) return 1; Basically, any address outside of [_stext, _etext] will be rejected. The functions marked as __init are outside [_stext, _etext]. That is why vfs_caches_init_early and vfs_caches_init are rejected by trace_kprobe. Given a regex, this patch avoided attaching these functions if their func addresses are outside [_stext, _etext] range. Signed-off-by: Yonghong Song <[email protected]>
|
Make sense, let me do one pass by the fact that syymbols in kallsyms are sorted based on address. |
yonghong-song
added a commit
that referenced
this pull request
May 10, 2018
Fix issue #1747. In commit #1647, we excluded all symbols outside [_stext, _etext]. This is incorrect as it excluded module symbols as well. This patch changed the algorithm to only skip symbols in init sections [__init_begin, __init_end]. Signed-off-by: Yonghong Song <[email protected]>
banh-gao
pushed a commit
to banh-gao/bcc
that referenced
this pull request
Jun 21, 2018
Fix issue iovisor#1747. In commit iovisor#1647, we excluded all symbols outside [_stext, _etext]. This is incorrect as it excluded module symbols as well. This patch changed the algorithm to only skip symbols in init sections [__init_begin, __init_end]. Signed-off-by: Yonghong Song <[email protected]>
CrackerCat
pushed a commit
to CrackerCat/bcc
that referenced
this pull request
Jul 31, 2024
Fix issue iovisor#1747. In commit iovisor#1647, we excluded all symbols outside [_stext, _etext]. This is incorrect as it excluded module symbols as well. This patch changed the algorithm to only skip symbols in init sections [__init_begin, __init_end]. Signed-off-by: Yonghong Song <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Fix issue #1634.
When kernel is about to attach a kprobe, the following functions
are called:
In core_kernel_text, we have:
Basically, any address outside of
[_stext, _etext]willbe rejected.
The functions marked as
__initare outside[_stext, _etext].That is why
vfs_caches_init_earlyandvfs_caches_initare rejected by
trace_kprobe.Given a regex, this patch avoided attaching these functions
if their func addresses are outside
[_stext, _etext]range.Signed-off-by: Yonghong Song [email protected]