Re: [PATCH v4] ftrace: Add FTRACE_MCOUNT_MAX_OFFSET to avoid adding weak function

[Peter Zijlstra]

On Fri, May 27, 2022 at 08:30:43AM -0400, Steven Rostedt wrote:
> On Thu, 26 May 2022 14:19:12 -0400
> Steven Rostedt <rostedt@xxxxxxxxxxx> (by way of Steven Rostedt
> <rostedt@xxxxxxxxxxx>) wrote:
> 
> > +++ b/kernel/trace/ftrace.c
> > @@ -3654,6 +3654,31 @@ static void add_trampoline_func(struct seq_file *m, struct ftrace_ops *ops,
> >  		seq_printf(m, " ->%pS", ptr);
> >  }
> >  
> > +#ifdef FTRACE_MCOUNT_MAX_OFFSET
> > +static int print_rec(struct seq_file *m, unsigned long ip)
> > +{
> > +	unsigned long offset;
> > +	char str[KSYM_SYMBOL_LEN];
> > +	char *modname;
> > +	const char *ret;
> > +
> > +	ret = kallsyms_lookup(ip, NULL, &offset, &modname, str);
> > +	if (!ret || offset > FTRACE_MCOUNT_MAX_OFFSET)
> > +		return -1;
> 
> Unfortunately, I can't just skip printing these functions. The reason is
> because it breaks trace-cmd (libtracefs specifically). As trace-cmd can
> filter with full regular expressions (regex(3)), and does so by searching
> the available_filter_functions. It collects an index of functions to
> enabled, then passes that into set_ftrace_filter.
> 
> As a speed up, set_ftrace_filter allows you to pass an index, defined by the
> line in available_filter_functions, into it that uses array indexing into
> the ftrace table to enable/disable functions for tracing. By skipping
> entries, it breaks the indexing, because the index is a 1 to 1 paring of
> the lines of available_filter_functions.

In what order does available_filter_functions print the symbols?

The pending FGKASLR patches randomize kallsyms order and anything that
prints symbols in address order will be a security leak.