Re: [PATCH v2 5/9] kprobes: Search non-suffixed symbol in blacklist

[Steven Rostedt]

On Sat, 12 Jan 2019 11:28:02 +0900
Masami Hiramatsu  wrote:

> Newer gcc can generate some different instances of a function
> with suffixed symbols if the function is optimized and only
> has a part of that. (e.g. .constprop, .part etc.)
> 
> In this case, it is not enough to check the entry of kprobe
> blacklist because it only records non-suffixed symbol address.
> 
> To fix this issue, search non-suffixed symbol in blacklist if
> given address is within a symbol which has a suffix.
> 
> Note that this can cause false positive cases if a kprobe-safe
> function is optimized to suffixed instance and has same name
> symbol which is blacklisted.
> But I would like to chose a fail-safe design for this issue.
> 
> Signed-off-by: Masami Hiramatsu 

Reviewed-by: Steven Rostedt (VMware) 

-- Steve

[PATCH v2 5/9] kprobes: Search non-suffixed symbol in blacklist

[Masami Hiramatsu]

Newer gcc can generate some different instances of a function
with suffixed symbols if the function is optimized and only
has a part of that. (e.g. .constprop, .part etc.)

In this case, it is not enough to check the entry of kprobe
blacklist because it only records non-suffixed symbol address.

To fix this issue, search non-suffixed symbol in blacklist if
given address is within a symbol which has a suffix.

Note that this can cause false positive cases if a kprobe-safe
function is optimized to suffixed instance and has same name
symbol which is blacklisted.
But I would like to chose a fail-safe design for this issue.

Signed-off-by: Masami Hiramatsu 
---
 kernel/kprobes.c |   21 -
 1 file changed, 20 insertions(+), 1 deletion(-)

diff --git a/kernel/kprobes.c b/kernel/kprobes.c
index e8c76164f541..faa519f07aad 100644
--- a/kernel/kprobes.c
+++ b/kernel/kprobes.c
@@ -1396,7 +1396,7 @@ bool __weak arch_within_kprobe_blacklist(unsigned long 
addr)
   addr < (unsigned long)__kprobes_text_end;
 }
 
-bool within_kprobe_blacklist(unsigned long addr)
+static bool __within_kprobe_blacklist(unsigned long addr)
 {
struct kprobe_blacklist_entry *ent;
 
@@ -1410,7 +1410,26 @@ bool within_kprobe_blacklist(unsigned long addr)
if (addr >= ent->start_addr && addr < ent->end_addr)
return true;
}
+   return false;
+}
 
+bool within_kprobe_blacklist(unsigned long addr)
+{
+   char symname[KSYM_NAME_LEN], *p;
+
+   if (__within_kprobe_blacklist(addr))
+   return true;
+
+   /* Check if the address is on a suffixed-symbol */
+   if (!lookup_symbol_name(addr, symname)) {
+   p = strchr(symname, '.');
+   if (!p)
+   return false;
+   *p = '\0';
+   addr = (unsigned long)kprobe_lookup_name(symname, 0);
+   if (addr)
+   return __within_kprobe_blacklist(addr);
+   }
return false;
 }