Re: [RFC PATCH 1/2] kprobes: Prohibit probing on CFI preamble symbol
From: Google
Date: Mon Jul 10 2023 - 19:50:32 EST
On Mon, 10 Jul 2023 17:37:24 +0200
Peter Zijlstra <peterz@xxxxxxxxxxxxx> wrote:
> On Mon, Jul 10, 2023 at 09:14:24PM +0900, Masami Hiramatsu (Google) wrote:
>
>
> > +#ifdef CONFIG_CFI_CLANG
> > +static bool is_cfi_preamble_symbol(unsigned long addr)
> > +{
> > + char symbuf[KSYM_NAME_LEN];
> > +
> > + if (lookup_symbol_name(addr, symbuf))
> > + return false;
> > +
> > + return str_has_prefix("__cfi_", symbuf)
> || str_has_prefix("__pfx_", symbol);
>
> The __pfx_ symbols can happen when !CFI_CLANG but still having
> FUNCTION_PADDING_BYTES.
Indeed. Currently __pfx is not probed via tracefs interface because it is
notrace function but kprobe itself should also prohibit that.
>
> > +}
> > +#else
> > +#define is_cfi_preamble_symbol(addr) (0)
> > +#endif
>
> As such I think we can do the above unconditionally, without either
> there should not be any matching symbols.
OK.
Thank you!
>
--
Masami Hiramatsu (Google) <mhiramat@xxxxxxxxxx>