Commit 6143c6fb authored Feb 13, 2019 by Masami Hiramatsu Committed by Ingo Molnar Feb 13, 2019

kprobes: Search non-suffixed symbol in blacklist



Newer GCC versions can generate some different instances of a function
with suffixed symbols if the function is optimized and only
has a part of that. (e.g. .constprop, .part etc.)

In this case, it is not enough to check the entry of kprobe
blacklist because it only records non-suffixed symbol address.

To fix this issue, search non-suffixed symbol in blacklist if
given address is within a symbol which has a suffix.

Note that this can cause false positive cases if a kprobe-safe
function is optimized to suffixed instance and has same name
symbol which is blacklisted.
But I would like to chose a fail-safe design for this issue.

Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
Reviewed-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Andrea Righi <righi.andrea@gmail.com>
Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: Jiri Olsa <jolsa@redhat.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Link: http://lkml.kernel.org/r/154998799234.31052.6136378903570418008.stgit@devbox


Signed-off-by: Ingo Molnar <mingo@kernel.org>

parent 0eae81dc

kernel/kprobes.c

+20 −1

Original line number	Diff line number	Diff line
		@@ -1396,7 +1396,7 @@ bool __weak arch_within_kprobe_blacklist(unsigned long addr)
		addr < (unsigned long)__kprobes_text_end;
		}

		bool within_kprobe_blacklist(unsigned long addr)
		static bool __within_kprobe_blacklist(unsigned long addr)
		{
		struct kprobe_blacklist_entry *ent;

		@@ -1410,7 +1410,26 @@ bool within_kprobe_blacklist(unsigned long addr)
		if (addr >= ent->start_addr && addr < ent->end_addr)
		return true;
		}
		return false;
		}

		bool within_kprobe_blacklist(unsigned long addr)
		{
		char symname[KSYM_NAME_LEN], *p;

		if (__within_kprobe_blacklist(addr))
		return true;

		/* Check if the address is on a suffixed-symbol */
		if (!lookup_symbol_name(addr, symname)) {
		p = strchr(symname, '.');
		if (!p)
		return false;
		*p = '\0';
		addr = (unsigned long)kprobe_lookup_name(symname, 0);
		if (addr)
		return __within_kprobe_blacklist(addr);
		}
		return false;
		}

Admin message