Bug 2639

Summary:	Probes on "__kprobes" functions should not be allowed
Product:	systemtap	Reporter:	Josh Stone <jistone>
Component:	translator	Assignee:	Unassigned <systemtap>
Status:	RESOLVED FIXED
Severity:	normal
Priority:	P2
Version:	unspecified
Target Milestone:	---
Host:		Target:
Build:		Last reconfirmed:
Attachments:	Proposed patch Improved patch

Description Josh Stone 2006-05-04 00:16:29 UTC

Similar to bug #2506, probes should be disallowed at compile time for addresses
within __kprobes functions.

On the surface it seems like we could just examine the section-name of the probe
address and make sure it's not .kprobes.text.  It's not that straightforward
though, because the kernel folds .kprobes.text into the main .text section in
"arch/*/kernel/vmlinux.lds.S".

Comment 1 Josh Stone 2006-05-04 00:23:26 UTC

Just to clarify - the kprobes runtime correctly blocks probes within the
.kprobes.text section, so this isn't a stability issue.  The user will see this
get all the way to pass-5, and then it will fail to register the probe.  It
would be nicer if we could catch this earlier, probably in the blacklist check
like we do with __init and __exit.

Comment 2 Josh Stone 2006-05-27 00:33:16 UTC

For now, I've manually added all __kprobes functions to the translator
blacklist.  This won't prevent statement() probes from being requested within
these functions, but it's better than nothing.  The kprobes infrastructure will
still reject such probes at runtime if any slip through.

(tapsets.cxx r1.131)

Comment 3 David Smith 2006-10-09 17:08:08 UTC

Created attachment 1361 [details]
Proposed patch

This proposed patches mimics the kernel function "in_kprobes_functions" by
looking up the value of the symbols "__kprobes_text_start" and
"__kprobes_text_end" and makes sure a probe point address isn't between those
two values.

Comment 4 David Smith 2006-10-09 22:56:20 UTC

Created attachment 1364 [details]
Improved patch

This improved patch moves the static '__kprobes_text_start' and
'__kprobes_text_end' variables into the session object.

Comment 5 David Smith 2006-10-11 14:58:00 UTC

Patch should allow us to reject all addresses within functions marked as
'__kprobes'.