This is the mail archive of the
systemtap@sourceware.org
mailing list for the systemtap project.
Re: How to change a string type argument of a system call?
On 04/03/2010 06:56 PM, Neo Liu wrote:
> I'm sorry for making a mistake when sending this email. This one contains
> attachements.
>
> On Sun, Apr 4, 2010 at 9:54 AM, Neo Liu <diabloneo@gmail.com> wrote:
>> I write a script to monitor the open syscall of a target process. In the probe
>> handler, I want to replace the $filename argument of the sys_open, so I can
>> make the sys_open open another file. In order to achieve this purpose, I use
>> __get_free_page() to allocate a new memory page (the page is in kernel spaces,
>> the address is higher than 0xC0000000), put a new filename in this
>> memory page, and let $filename parameter points to this new page. So, the
>> $filename contains a new filename string. However, the open syscall returns
>> failure. Is this because the open syscall can't access an address in the kernel
>> spaces?
Correct -- the open syscall gets the filename using strncpy_from_user,
which verifies that the pointer is within the user's address space.
I can think of a few options for you:
1. Allocate the buffer in the user's address space (if it's possible
without paging -- I'm not sure).
2. Probe somewhere after the string has been copied, like in the middle
of do_sys_open or in the call to do_filp_open, and then replace the tmp
kernel string.
3. Probe the same as 2, but overwrite the string directly with a call to
stap's set_kernel_string() (recently added to systemtap.git).
4. Write a function set_user_string() to overwrite the user's buffer. We
probably want this sort of function in the tapsets, but I haven't gotten
around to it yet.
Just be careful with 3 and 4 that the string you write can fit in the
existing buffer...
Josh