Re: intercepting syscalls (by setting pointer in sys_call_table)

Gabriel Paubert (paubert@iram.es)
Wed, 24 Mar 1999 11:58:26 +0100 (MET)


On Tue, 23 Mar 1999, Michael Hasenstein wrote:

> not really useful, just playing around, but learned a lot through it...
>
> what I do: change the entry for a syscall in sys_call_table to point
> to my own funtion (which does a few printk() and then jumps to the
> original pointer with the original arguments), using a module
> (inserted: use my function, remove: re-insert original pointer into
> sys_call_table).
>
> question: is manipulating sys_call_table, changing the pointer, safe
> (SMP)? not from a functional point of view, I know what I'm doing
> (even if my system dies ;-) ), but is it SMP-safe? I read a little
> arch/i386/entry.S, _very_ interesting, but doesn't help that much...
> I'm asking because someone who tried the same on his SMP system
> complained about a system crash when he unloaded the module, and the
> only line of code for unload is

Changing the pointer is theoretically a safe operation since it is a
single memory access (and is basically atomic if aligned). However,
if the syscall may sleep and then the module is removed, you lose for sure
when returning through the code you inserted which is no more mapped (both
UP and SMP, but SMP makes it more likely).

Regards,
Gabriel.

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/