All of lore.kernel.org
 help / color / mirror / Atom feed
From: Al Viro <viro@ZenIV.linux.org.uk>
To: Wen Yan Xin <WenYan_Xin@symantec.com>
Cc: "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
	Zongliang Li <Zongliang_Li@symantec.com>,
	Gang He <Gang_He@symantec.com>,
	Yong Jun Chai <YongJun_Chai@symantec.com>
Subject: Re: what's the replace for the big kernel lock after kernel version 2.6.39 for system call.
Date: Tue, 29 Nov 2011 21:41:36 +0000	[thread overview]
Message-ID: <20111129214136.GR2203@ZenIV.linux.org.uk> (raw)
In-Reply-To: <F0BE05962279964D949D53875492E2E24FC27D7C30@APJ1XCHEVSPIN32.SYMC.SYMANTEC.COM>

On Mon, Nov 28, 2011 at 01:03:07AM -0800, Wen Yan Xin wrote:
> Hi all,
> 
> I have a trouble of working on kernel 2.6.39 and later. Originally when our kernel module startups, it hooks some file system call, like sys_open... , and the big kernel lock - lock_kernel() - will be held before creating the hook to prevent user application use system calls, and be released after the hook created.
> 
> 
> But after the kernel 2.6.39, the big kernel lock has been removed. I'm thinking there should be one or more lock that should be used. 
> 
> So, my question is which lock should be held now, when we hook the system call of file system?
> 
> I'd really appreciate your answer in advance.

1) your rootkit has always been racy; taking BKL does *NOT* prevent another
CPU from entering a system call.

2) none; just don't do it.

  reply	other threads:[~2011-11-29 21:41 UTC|newest]

Thread overview: 5+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
     [not found] <S1752501Ab1KYJXy/20111125092354Z+1871@vger.kernel.org>
2011-11-28  9:03 ` what's the replace for the big kernel lock after kernel version 2.6.39 for system call Wen Yan Xin
2011-11-29 21:41   ` Al Viro [this message]
2011-11-30  9:44     ` Tvrtko Ursulin
2011-11-30 13:56       ` Al Viro
2011-11-30 14:12         ` Tvrtko Ursulin

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20111129214136.GR2203@ZenIV.linux.org.uk \
    --to=viro@zeniv.linux.org.uk \
    --cc=Gang_He@symantec.com \
    --cc=WenYan_Xin@symantec.com \
    --cc=YongJun_Chai@symantec.com \
    --cc=Zongliang_Li@symantec.com \
    --cc=linux-kernel@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.