Commit de02f2ac authored by Masami Hiramatsu (Google)'s avatar Masami Hiramatsu (Google)
Browse files

kprobes: Prohibit probing on CFI preamble symbol 

Do not allow to probe on "__cfi_" or "__pfx_" started symbol, because those
are used for CFI and not executed. Probing it will break the CFI.

Link: https://lore.kernel.org/all/168904024679.116016.18089228029322008512.stgit@devnote2/



Signed-off-by: default avatarMasami Hiramatsu (Google) <mhiramat@kernel.org>
Reviewed-by: default avatarSteven Rostedt (Google) <rostedt@goodmis.org>
parent 02ab7234

kernel/kprobes.c

+13 −1
Original line number Diff line number Diff line
@@ -1545,6 +1545,17 @@ static int check_ftrace_location(struct kprobe *p) 
	return 0;

}



static bool is_cfi_preamble_symbol(unsigned long addr)

{

	char symbuf[KSYM_NAME_LEN];



	if (lookup_symbol_name(addr, symbuf))

		return false;



	return str_has_prefix("__cfi_", symbuf) ||

		str_has_prefix("__pfx_", symbuf);

}



static int check_kprobe_address_safe(struct kprobe *p,

				     struct module **probed_mod)

{
@@ -1563,7 +1574,8 @@ static int check_kprobe_address_safe(struct kprobe *p, 
	    within_kprobe_blacklist((unsigned long) p->addr) ||

	    jump_label_text_reserved(p->addr, p->addr) ||

	    static_call_text_reserved(p->addr, p->addr) ||

	    find_bug((unsigned long)p->addr)) {

	    find_bug((unsigned long)p->addr) ||

	    is_cfi_preamble_symbol((unsigned long)p->addr)) {

		ret = -EINVAL;

		goto out;

	}