• Steven Rostedt (VMware)'s avatar
    ftrace: Zero out ftrace hashes when a module is removed · 2a5bfe47
    Steven Rostedt (VMware) authored
    When a ftrace filter has a module function, and that module is removed, the
    filter still has its address as being enabled. This can cause interesting
    side effects. Nothing dangerous, but unwanted functions can be traced
    because of it.
    
     # cd /sys/kernel/tracing
     # echo ':mod:snd_seq' > set_ftrace_filter
     # cat set_ftrace_filter
    snd_use_lock_sync_helper [snd_seq]
    check_event_type_and_length [snd_seq]
    snd_seq_ioctl_pversion [snd_seq]
    snd_seq_ioctl_client_id [snd_seq]
    snd_seq_ioctl_get_queue_tempo [snd_seq]
    update_timestamp_of_queue [snd_seq]
    snd_seq_ioctl_get_queue_status [snd_seq]
    snd_seq_set_queue_tempo [snd_seq]
    snd_seq_ioctl_set_queue_tempo [snd_seq]
    snd_seq_ioctl_get_queue_timer [snd_seq]
    seq_free_client1 [snd_seq]
    [..]
     # rmmod snd_seq
     # cat set_ftrace_filter
    
     # modprobe kvm
     # cat set_ftrace_filter
    kvm_set_cr4 [kvm]
    kvm_emulate_hypercall [kvm]
    kvm_set_dr [kvm]
    
    This is because removing the snd_seq module after it was being filtered,
    left the address of the snd_seq functions in the hash. When the kvm module
    was loaded, some of its functions were loaded at the same address as the
    snd_seq module. This would enable them to be filtered and traced.
    
    Now we don't want to clear the hash completely. That would cause removing a
    module where only its functions are filtered, to cause the tracing to enable
    all functions, as an empty filter means to trace all functions. Instead,
    just set the hash ip address to zero. Then it will never match any function.
    Signed-off-by: default avatarSteven Rostedt (VMware) <rostedt@goodmis.org>
    2a5bfe47
ftrace.c 161 KB