| From dc96f2af02827f085e607499f73a01cf7aa05934 Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Mon, 1 Aug 2022 11:37:19 +0800 |
| Subject: kprobes: Forbid probing on trampoline and BPF code areas |
| |
| From: Chen Zhongjin <chenzhongjin@huawei.com> |
| |
| [ Upstream commit 28f6c37a2910f565b4f5960df52b2eccae28c891 ] |
| |
| kernel_text_address() treats ftrace_trampoline, kprobe_insn_slot |
| and bpf_text_address as valid kprobe addresses - which is not ideal. |
| |
| These text areas are removable and changeable without any notification |
| to kprobes, and probing on them can trigger unexpected behavior: |
| |
| https://lkml.org/lkml/2022/7/26/1148 |
| |
| Considering that jump_label and static_call text are already |
| forbiden to probe, kernel_text_address() should be replaced with |
| core_kernel_text() and is_module_text_address() to check other text |
| areas which are unsafe to kprobe. |
| |
| [ mingo: Rewrote the changelog. ] |
| |
| Fixes: 5b485629ba0d ("kprobes, extable: Identify kprobes trampolines as kernel text area") |
| Fixes: 74451e66d516 ("bpf: make jited programs visible in traces") |
| Signed-off-by: Chen Zhongjin <chenzhongjin@huawei.com> |
| Signed-off-by: Ingo Molnar <mingo@kernel.org> |
| Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org> |
| Link: https://lore.kernel.org/r/20220801033719.228248-1-chenzhongjin@huawei.com |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| kernel/kprobes.c | 3 ++- |
| 1 file changed, 2 insertions(+), 1 deletion(-) |
| |
| diff --git a/kernel/kprobes.c b/kernel/kprobes.c |
| index c93340bae3ac..671b51782182 100644 |
| --- a/kernel/kprobes.c |
| +++ b/kernel/kprobes.c |
| @@ -1594,7 +1594,8 @@ static int check_kprobe_address_safe(struct kprobe *p, |
| preempt_disable(); |
| |
| /* Ensure it is not in reserved area nor out of text */ |
| - if (!kernel_text_address((unsigned long) p->addr) || |
| + if (!(core_kernel_text((unsigned long) p->addr) || |
| + is_module_text_address((unsigned long) p->addr)) || |
| within_kprobe_blacklist((unsigned long) p->addr) || |
| jump_label_text_reserved(p->addr, p->addr) || |
| find_bug((unsigned long)p->addr)) { |
| -- |
| 2.35.1 |
| |
