Re: execve replacement.

From: John Levon (moz@compsoc.man.ac.uk)
Date: Wed Oct 04 2000 - 10:07:21 EST


On Wed, 4 Oct 2000, Brian Gerst wrote:

> John Levon wrote:
> > anyway, you can just put refcounts in your hijacked system calls; that is
> > the safe way to do it, and doesn't require any kernel patches, just extra
> > cost in the intercepted system calls.
> >
> > e.g. :
> >
> > my_syswhatever(...)
> > {
> > MOD_INC_USE_COUNT;
> > original_syswhatever(...);
> > MOD_DEC_USE_COUNT;
> > }
> >
> > Can you explain to me the race with this approach ?
>
> There is a small period of time between the last MOD_DEC_USE_COUNT and
> the return of the function where the module could be unloaded by another
> CPU (SMP only). It is a tiny race window, but still possible.
>

Wouldn't this require another module to be loaded inbetween the
MOD_DEC_USE_COUNT, and the function exit, to actually be dangerous ?
 
I don't know ...

john

-- 
"The Internet is a shallow and unreliable electronic repository of dirty pictures, inaccurate rumors,
 bad spelling and worse grammar, inhabited largely by people with no demonstrable social skills."
	- Chronicle of Higher Education

- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org Please read the FAQ at http://www.tux.org/lkml/



This archive was generated by hypermail 2b29 : Sat Oct 07 2000 - 21:00:14 EST