[PATCH v6 kspp-next 16/22] livepatch: only match unique symbols when using fgkaslr
From: Alexander Lobakin <hidden>
Date: 2021-08-31 14:44:04
Also in:
linux-arch, linux-hardening, lkml
Subsystem:
live patching, the rest · Maintainers:
Josh Poimboeuf, Jiri Kosina, Miroslav Benes, Petr Mladek, Linus Torvalds
From: Kristen Carlson Accardi <redacted> If any type of function granular randomization is enabled, the sympos algorithm will fail, as it will be impossible to resolve symbols when there are duplicates using the previous symbol position. Override the value of sympos to always be zero if fgkaslr is enabled for either the core kernel or modules, forcing the algorithm to require that only unique symbols are allowed to be patched. Signed-off-by: Kristen Carlson Accardi <redacted> Signed-off-by: Alexander Lobakin <redacted> --- kernel/livepatch/core.c | 11 +++++++++++ 1 file changed, 11 insertions(+)
diff --git a/kernel/livepatch/core.c b/kernel/livepatch/core.c
index 335d988bd811..852bbfa9da7b 100644
--- a/kernel/livepatch/core.c
+++ b/kernel/livepatch/core.c@@ -169,6 +169,17 @@ static int klp_find_object_symbol(const char *objname, const char *name, else kallsyms_on_each_symbol(klp_find_callback, &args); + /* + * If any type of function granular randomization is enabled, it + * will be impossible to resolve symbols when there are duplicates + * using the previous symbol position (i.e. sympos != 0). Override + * the value of sympos to always be zero in this case. This will + * force the algorithm to require that only unique symbols are + * allowed to be patched. + */ + if (IS_ENABLED(CONFIG_FG_KASLR)) + sympos = 0; + /* * Ensure an address was found. If sympos is 0, ensure symbol is unique; * otherwise ensure the symbol position count matches sympos.
--
2.31.1