On Tue, 26 Jan 2021 22:17:23 +0100
Oleg Nesterov <o...@redhat.com> wrote:
> On 01/26, Steven Rostedt wrote:
> >
> > On Tue, 26 Jan 2021 21:20:59 +0100
> > Oleg Nesterov <o...@redhat.com> wrote:
> >
> > > > No, not wrong. Even offset != 0, if the symbol exists in the kernel,
> > > > kprobe_on_func_entry() will check it.
> > >
> > > Yes, but unless I am totally confused... if kprobe_on_func_entry()
> > > returns false,
> > > then trace_kprobe_create() should fail with BAD_RETPROBE even if offset
> > > == 0 ?
> >
> > From what I understand. kprobe_on_func_entry() can return false if you pass
> > in: "MOD:not_yet_loaded_module_func", but this is OK, because when the
> > module is loaded, and the "not_yet_loaded_module_func" exists, the
> > kretprobe will then be added.
> >
> > The strchr(symbol,":") check is to see if "MOD:" (or some other ":" command)
> > is in the name, and we don't want it to fail if it is. Which is why we
> > should have that commented.
>
> Agreed, this matches my understanding.
>
> But just in case... not sure I read this code correctly, but I think that
> module_kallsyms_lookup_name("not_yet_loaded_module_func") should work even
> without the "MOD:" prefix.
>
> IOW, kprobe_on_func_entry("not_yet_loaded_module_func") can fail, and then
> later succeed if you load the module which provides this symbol.
>
> But even if I am right, I agree with the strchr(symbol,":") check.
I see what you are saying. If "MOD" is not loaded yet, the
kprobe_on_func_entry() should succeed.
kprobe_on_func_entry(name) {
_kprobe_addr(name) {
_kprobe_lookup_name(name) {
kallsyms_lookup_name(name) {
module_kallsyms_lookup_name(name) {
Which is:
unsigned long module_kallsyms_lookup_name(const char *name)
{
struct module *mod;
char *colon;
unsigned long ret = 0;
/* Don't lock: we're in enough trouble already. */
preempt_disable();
if ((colon = strnchr(name, MODULE_NAME_LEN, ':')) != NULL) {
if ((mod = find_module_all(name, colon - name, false)) != NULL)
ret = find_kallsyms_symbol_value(mod, colon+1);
} else {
list_for_each_entry_rcu(mod, &modules, list) {
if (mod->state == MODULE_STATE_UNFORMED)
continue;
if ((ret = find_kallsyms_symbol_value(mod, name)) != 0)
break;
}
}
preempt_enable();
return ret;
}
And if find_module_all() fails, ret isn't updated, and "return ret" will
return zero.
That is, the ":" check may not be needed, but its at least good to have?
-- Steve
