lkml.org 
[lkml]   [2022]   [Aug]   [23]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.4 238/389] kprobes: Forbid probing on trampoline and BPF code areas
    Date
    From: Chen Zhongjin <chenzhongjin@huawei.com>

    [ Upstream commit 28f6c37a2910f565b4f5960df52b2eccae28c891 ]

    kernel_text_address() treats ftrace_trampoline, kprobe_insn_slot
    and bpf_text_address as valid kprobe addresses - which is not ideal.

    These text areas are removable and changeable without any notification
    to kprobes, and probing on them can trigger unexpected behavior:

    https://lkml.org/lkml/2022/7/26/1148

    Considering that jump_label and static_call text are already
    forbiden to probe, kernel_text_address() should be replaced with
    core_kernel_text() and is_module_text_address() to check other text
    areas which are unsafe to kprobe.

    [ mingo: Rewrote the changelog. ]

    Fixes: 5b485629ba0d ("kprobes, extable: Identify kprobes trampolines as kernel text area")
    Fixes: 74451e66d516 ("bpf: make jited programs visible in traces")
    Signed-off-by: Chen Zhongjin <chenzhongjin@huawei.com>
    Signed-off-by: Ingo Molnar <mingo@kernel.org>
    Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
    Link: https://lore.kernel.org/r/20220801033719.228248-1-chenzhongjin@huawei.com
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    kernel/kprobes.c | 3 ++-
    1 file changed, 2 insertions(+), 1 deletion(-)

    diff --git a/kernel/kprobes.c b/kernel/kprobes.c
    index c93340bae3ac..671b51782182 100644
    --- a/kernel/kprobes.c
    +++ b/kernel/kprobes.c
    @@ -1594,7 +1594,8 @@ static int check_kprobe_address_safe(struct kprobe *p,
    preempt_disable();

    /* Ensure it is not in reserved area nor out of text */
    - if (!kernel_text_address((unsigned long) p->addr) ||
    + if (!(core_kernel_text((unsigned long) p->addr) ||
    + is_module_text_address((unsigned long) p->addr)) ||
    within_kprobe_blacklist((unsigned long) p->addr) ||
    jump_label_text_reserved(p->addr, p->addr) ||
    find_bug((unsigned long)p->addr)) {
    --
    2.35.1


    \
     
     \ /
      Last update: 2022-08-23 13:42    [W:4.027 / U:0.092 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site