[PATCH v8 08/14] livepatch: only match unique symbols when using FG-KASLR
From: Alexander Lobakin <hidden>
Date: 2021-12-02 22:33:32
Also in:
linux-hardening, linux-kbuild, live-patching, lkml, llvm
Subsystem:
live patching, the rest · Maintainers:
Josh Poimboeuf, Jiri Kosina, Miroslav Benes, Petr Mladek, Linus Torvalds
If any type of function granular randomization is enabled, the sympos algorithm will fail, as it will be impossible to resolve symbols when there are duplicates using the previous symbol position. We could override sympos to 0, but make it more clear to the user and bail out if the symbol is not unique. Suggested-by: Miroslav Benes <mbenes@suse.cz> Signed-off-by: Alexander Lobakin <redacted> --- kernel/livepatch/core.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
diff --git a/kernel/livepatch/core.c b/kernel/livepatch/core.c
index 335d988bd811..10ea75111057 100644
--- a/kernel/livepatch/core.c
+++ b/kernel/livepatch/core.c@@ -169,6 +169,17 @@ static int klp_find_object_symbol(const char *objname, const char *name, else kallsyms_on_each_symbol(klp_find_callback, &args); + /* + * If function granular randomization is enabled, it is impossible + * to resolve symbols when there are duplicates using the previous + * symbol position (i.e. sympos != 0). + */ + if (IS_ENABLED(CONFIG_FG_KASLR) && sympos) { + pr_err("FG-KASLR is enabled, specifying symbol position %lu for symbol '%s' in object '%s' does not work\n", + sympos, name, objname ? objname : "vmlinux"); + goto out_err; + } + /* * Ensure an address was found. If sympos is 0, ensure symbol is unique; * otherwise ensure the symbol position count matches sympos.
@@ -186,6 +197,7 @@ static int klp_find_object_symbol(const char *objname, const char *name, return 0; } +out_err: *addr = 0; return -EINVAL; }
--
2.33.1