This is the mail archive of the
systemtap@sourceware.org
mailing list for the systemtap project.
Re: SYSTEMTAP TEST RESULTS : Kernel version 2.6.35-rc3 on POWER ppc64 architecture.
On 06/24/2010 01:34 PM, Roland McGrath wrote:
>> Thank SYSCALL_WRAPPERS for that. SyS_foo has all "long" arguments, and
>> then the inline SYSC_foo has the real argument types.
>
> That suggests that on SYSCALL_WRAPPERS machines/kernels you want to probe
> the SYSC_* inlines instead of the SyS_* functions.
Ugh, after I just banished SyS_* in favor of their sys_* aliasing... I'd
really rather not reintroduce such ugliness to the tapset. :(
It's not clear how much the correct DWARF types *really* matter in this
case. We shouldn't be dereferencing any __user arguments directly. In
sys_pipe, we're just being lazy about pointer math: &$fildes[0] is just
$fildes; &$fildes[1] is just $fildes + sizeof(int). (And doesn't
sizeof(int)==4 on every Linux arch?)
Regarding the CVE that SYSCALL_WRAPPERS fixes, I don't think it matters
much to stap. We could read a badly-padded number, but the rest of our
prophylactics should protect us from doing anything crazy from this.
Still, I'm tempted to just treat this as the special case that it is.
Within the translator, we could recognize when a SyS_foo is matched in
the kernel and silently rewrite it as SYSC_foo instead. We could even
let .return go on these inlines, as it should do the right thing as far
as kretprobes is concerned.
Josh