ERROR: modpost: "kallsyms_lookup_name" [/home/joaomanoel/git/tyton/tyton.ko] undefined!

[jmanoel7]

ERROR: modpost: "kallsyms_lookup_name" [/home/joaomanoel/git/tyton/tyton.ko] undefined!

[v14dz]

This message says that Kprobe could be used to find the address associated with a kernel symbol. I wrote the following PoC that seems to work. Can we consider using this technique?

static struct kprobe kp;

unsigned long kprobe_lookup_name(const char *name) {
    kp.symbol_name = name;

    if (register_kprobe(&kp) < 0)
        return 0;
    unregister_kprobe(&kp);

    return (unsigned long) kp.addr;
}

[nbulischeck]

Mail Discussion: https://lwn.net/ml/linux-kernel/[email protected]/

Commit: torvalds/linux@0bd476e

They recently unexported kallsyms_lookup_name and unfortunately, this project is slow to receive updates. Feel free to submit a PR that grabs the needed symbols and works for your kernel!

[nbulischeck]

@v14dz Yeah that code looks good! I did some looking and register_kprobe is just a really roundabout way of calling kallsyms_lookup_name.

Do you know if there are any limitations across kernel versions for kprobes?

[v14dz]

@nbulischeck Hi! I suggest to use kallsyms_lookup_name() for kernel versions anterior to 5.7.0, and use the kprobe workaround only for recent kernels. This way we don't care about kprobe limitations across previous kernel versions. I'll soon propose a patch that should fixes this issue.

[nbulischeck]

Fixed in ae7988b. Please reopen if this is not the case.