[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 3 Jun 2020 20:30:28 +0300
From: Ilya Matveychikov <matvejchikov@...il.com>
To: lkrg-users@...ts.openwall.com
Subject: Re: Support for 5.7 linux kernel?
> On Jun 3, 2020, at 7:06 PM, Adam Zabrocki <pi3@....com.pl> wrote:
>
> Hi Ilya,
>
> On Wed, Jun 03, 2020 at 12:49:12PM +0300, Ilya Matveychikov wrote:
>> Hey Adam,
>>
>> I see 2 ways of getting kallsyms_lookup_name() address:
>> - parsing /proc/kallsyms from the kernel using filp_open()
>> - parsing /proc/kallsyms before loading LKRG and passing
>> address of this symbol as module parameter
>>
>
> Yes, these are possible options.
>
>> Any other options?
>>
>
> In fact yes. I'm more thinking about the trick with kprobes. We are already
> depended on it so it won't introduce any new one. In short, kprobes internally
> do have/has access to kallsyms* API. We can try to put a kprobe on
> kallsyms_lookup_name() function, extract the address where it was placed and
> then remove it.
>
Yeah, I followed the link you mention right after sending the email. It’s
a nice trick with kprobes. The funniest thing of all the story with
kallsyms_lookup_name() unexport from the kernel is that it doesn’t
change anything but only breaks some useful out-of-tree projects.
> Thanks,
> Adam
>
>>> On Jun 3, 2020, at 7:48 AM, Adam Zabrocki <pi3@....com.pl> wrote:
>>>
>>> Hi Mikhail,
>>>
>>> On Tue, Jun 02, 2020 at 10:17:44AM +0200, Mikhail Morfikov wrote:
>>>> It looks like the lkrg module doesn't build for 5.7 linux kernel.
>>>> Are there any plans to support the new stable mainline kernel in the near future?
>>>
>>> Thanks for reporting this problem. I've verified that and it looks like the
>>> kernel maintainers unexported some symbols which LKRG uses:
>>>
>>> https://lkml.org/lkml/2020/5/5/478
>>>
>>> We need to think about the proper solution for that. We might go with the same
>>> path as LTTs maintaners.
>>>
>>> Thanks,
>>> Adam
>>>
>>> --
>>> pi3 (pi3ki31ny) - pi3 (at) itsec pl
>>> http://pi3.com.pl
>>>
>>
>
> --
> pi3 (pi3ki31ny) - pi3 (at) itsec pl
> http://pi3.com.pl
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
