Re: [PATCH 3/3] kprobes: Allow probing on any address belonging to ftrace
From: Masami Hiramatsu <mhiramat@kernel.org>
Date: 2022-02-21 00:16:02
Also in:
bpf, lkml
On Thu, 17 Feb 2022 17:06:25 +0530 "Naveen N. Rao" [off-list ref] wrote:
quoted hunk ↗ jump to hunk
On certain architectures, ftrace can reserve multiple instructions at function entry. Rather than rejecting kprobe on addresses other than the exact ftrace call instruction, use the address returned by ftrace to probe at the correct address when CONFIG_KPROBES_ON_FTRACE is enabled. Signed-off-by: Naveen N. Rao <redacted> --- kernel/kprobes.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)diff --git a/kernel/kprobes.c b/kernel/kprobes.c index 94cab8c9ce56cc..0a797ede3fdf37 100644 --- a/kernel/kprobes.c +++ b/kernel/kprobes.c@@ -1497,6 +1497,10 @@ bool within_kprobe_blacklist(unsigned long addr) static kprobe_opcode_t *_kprobe_addr(kprobe_opcode_t *addr, const char *symbol_name, unsigned int offset) { +#ifdef CONFIG_KPROBES_ON_FTRACE + unsigned long ftrace_addr = 0; +#endif + if ((symbol_name && addr) || (!symbol_name && !addr)) goto invalid;@@ -1507,6 +1511,14 @@ static kprobe_opcode_t *_kprobe_addr(kprobe_opcode_t *addr, } addr = (kprobe_opcode_t *)(((char *)addr) + offset); + +#ifdef CONFIG_KPROBES_ON_FTRACE + if (addr) + ftrace_addr = ftrace_location((unsigned long)addr); + if (ftrace_addr) + return (kprobe_opcode_t *)ftrace_addr;
As I said, this must be if (ftrace_addr != addr) return -EILSEQ; This will prevent users from being confused by the results of probing that 'func' and 'func+4' are the same. (now only 'func' is allowed to be probed.) Thank you,
+#endif + if (addr) return addr; -- 2.35.1
-- Masami Hiramatsu [off-list ref]