-2

I am trying to replace a kernel function with a kernel module, and come across the following solusion proposed by kmm (https://stackoverflow.com/a/1242232/6438341)

However, it seems that the kernel does not allow copying anything to the address of 'real_printk'. The kernel complains: "BUG: unable to handle kernel paging request at ffffffff81774863", in which ffffffff81774863 is the address of printk that was found in System.map or /proc/kallsyms.

Anyone knows how to fix it?

Community
  • 1
  • 1
Qi Zhang
  • 631
  • 1
  • 7
  • 15

1 Answers1

1

At a guess, I'd say it's probably because you're running a kernel that write-protects its text pages. You will need to set those pages as writable before modifying them.

HOWEVER, keep in mind that that answer you're looking at is six years old. In the time since it was posted, a number of much better approaches to live kernel patching have emerged, including kpatch, SUSE Live Patching, and KernelCare. (Underneath, there's also ftrace, which can be used to dynamically instrument functions.) You should take a close look at these before trying to build your own patching solution from scratch.