On Tue, Feb 23, 2021 at 12:05:08AM +0900, Masami Hiramatsu wrote:
quoted
Of course, one could place probes using absolute addresses of the
functions but that would be less convenient.
This also affects many livepatch modules where the kernel code can be
compiled with -ffunction-sections and each function may end up in a
separate section .text.<function_name>. 'perf probe' cannot be used
there, except with the absolute addresses.
Moreover, if FGKASLR patches are merged
(https://lwn.net/Articles/832434/) and the kernel is built with FGKASLR
enabled, -ffunction-sections will be used too. 'perf probe' will be
unable to see the kernel functions then.
Hmm, if the FGKASLAR really randomizes the symbol address, perf-probe
should give up "_text-relative" probe for that kernel, and must fallback
to the "symbol-based" probe. (Are there any way to check the FGKASLR is on?)
The problem of "symbol-based" probe is that local (static) symbols
may share a same name sometimes. In that case, it can not find correct
symbol. (Maybe I can find a candidate from its size.)
Anyway, sometimes the security and usability are trade-off.
We had a similar issue with FGKASLR and live patching. The proposed
solution is a new linker flag which eliminates duplicates: -z
unique-symbol.
https://sourceware.org/bugzilla/show_bug.cgi?id=26391
--
Josh