Re: [PATCH] Kprobes: Verify probepoint in register_jprobe()

[Andrew Morton <akpm@osdl.org>]

Luca Falavigna <dktrkranz@gmail.com> wrote:
>
> This patch, built against version 2.6.12, checks if probepoint address is a
> function entry point using an offset value, obtained from kallsyms_lookup().
> If offset is zero, we register jprobe, otherwise we return -EINVAL.
> 

a) kallsyms holds symbols other than just function names.

b) This won't work with CONFIG_KALLSYMS=n

> 
> --- ./kernel/kprobes.c.orig	2005-06-29 00:17:43.000000000 +0000
> +++ ./kernel/kprobes.c	2005-06-29 11:08:02.000000000 +0000
> @@ -33,6 +33,7 @@
>  #include <linux/hash.h>
>  #include <linux/init.h>
>  #include <linux/module.h>
> +#include <linux/kallsyms.h>
>  #include <asm/cacheflush.h>
>  #include <asm/errno.h>
>  #include <asm/kdebug.h>
> @@ -245,7 +246,15 @@ static struct notifier_block kprobe_exce
> 
>  int register_jprobe(struct jprobe *jp)
>  {
> -	/* Todo: Verify probepoint is a function entry point */
> +	unsigned long size, offset;
> +	char *modname, namebuf[KSYM_NAME_LEN+1];
> +	
> +	kallsyms_lookup((unsigned long)jp->kp.addr, &size,
> +			&offset, &modname, namebuf);
> +	
> +	if(unlikely(offset))
> +		return -EINVAL;
> +	
>  	jp->kp.pre_handler = setjmp_pre_handler;
>  	jp->kp.break_handler = longjmp_break_handler;
>