On Fri, May 27, 2022 at 08:30:43AM -0400, Steven Rostedt wrote:
> On Thu, 26 May 2022 14:19:12 -0400
> Steven Rostedt <rostedt@xxxxxxxxxxx> (by way of Steven Rostedt
> <rostedt@xxxxxxxxxxx>) wrote:
>
> > +++ b/kernel/trace/ftrace.c
> > @@ -3654,6 +3654,31 @@ static void add_trampoline_func(struct seq_file *m, struct ftrace_ops *ops,
> > seq_printf(m, " ->%pS", ptr);
> > }
> >
> > +#ifdef FTRACE_MCOUNT_MAX_OFFSET
> > +static int print_rec(struct seq_file *m, unsigned long ip)
> > +{
> > + unsigned long offset;
> > + char str[KSYM_SYMBOL_LEN];
> > + char *modname;
> > + const char *ret;
> > +
> > + ret = kallsyms_lookup(ip, NULL, &offset, &modname, str);
> > + if (!ret || offset > FTRACE_MCOUNT_MAX_OFFSET)
> > + return -1;
>
> Unfortunately, I can't just skip printing these functions. The reason is
> because it breaks trace-cmd (libtracefs specifically). As trace-cmd can
> filter with full regular expressions (regex(3)), and does so by searching
> the available_filter_functions. It collects an index of functions to
> enabled, then passes that into set_ftrace_filter.
>
> As a speed up, set_ftrace_filter allows you to pass an index, defined by the
> line in available_filter_functions, into it that uses array indexing into
> the ftrace table to enable/disable functions for tracing. By skipping
> entries, it breaks the indexing, because the index is a 1 to 1 paring of
> the lines of available_filter_functions.
In what order does available_filter_functions print the symbols?
The pending FGKASLR patches randomize kallsyms order and anything that
prints symbols in address order will be a security leak.
