From: Kristen Carlson Accardi <kristen@linux.intel.com>
To: keescook@chromium.org, tglx@linutronix.de, mingo@redhat.com,
bp@alien8.de, Josh Poimboeuf <jpoimboe@redhat.com>,
Jiri Kosina <jikos@kernel.org>, Miroslav Benes <mbenes@suse.cz>,
Petr Mladek <pmladek@suse.com>,
Joe Lawrence <joe.lawrence@redhat.com>
Cc: arjan@linux.intel.com, x86@kernel.org,
linux-kernel@vger.kernel.org,
kernel-hardening@lists.openwall.com, rick.p.edgecombe@intel.com,
Kristen Carlson Accardi <kristen@linux.intel.com>,
live-patching@vger.kernel.org
Subject: [PATCH v5 10/10] livepatch: only match unique symbols when using fgkaslr
Date: Wed, 23 Sep 2020 10:39:04 -0700 [thread overview]
Message-ID: <20200923173905.11219-11-kristen@linux.intel.com> (raw)
In-Reply-To: <20200923173905.11219-1-kristen@linux.intel.com>
If any type of function granular randomization is enabled, the sympos
algorithm will fail, as it will be impossible to resolve symbols when
there are duplicates using the previous symbol position.
Override the value of sympos to always be zero if fgkaslr is enabled for
either the core kernel or modules, forcing the algorithm
to require that only unique symbols are allowed to be patched.
Signed-off-by: Kristen Carlson Accardi <kristen@linux.intel.com>
---
kernel/livepatch/core.c | 11 +++++++++++
1 file changed, 11 insertions(+)
diff --git a/kernel/livepatch/core.c b/kernel/livepatch/core.c
index f76fdb925532..da08e40f2da2 100644
--- a/kernel/livepatch/core.c
+++ b/kernel/livepatch/core.c
@@ -170,6 +170,17 @@ static int klp_find_object_symbol(const char *objname, const char *name,
kallsyms_on_each_symbol(klp_find_callback, &args);
mutex_unlock(&module_mutex);
+ /*
+ * If any type of function granular randomization is enabled, it
+ * will be impossible to resolve symbols when there are duplicates
+ * using the previous symbol position (i.e. sympos != 0). Override
+ * the value of sympos to always be zero in this case. This will
+ * force the algorithm to require that only unique symbols are
+ * allowed to be patched.
+ */
+ if (IS_ENABLED(CONFIG_FG_KASLR) || IS_ENABLED(CONFIG_MODULE_FG_KASLR))
+ sympos = 0;
+
/*
* Ensure an address was found. If sympos is 0, ensure symbol is unique;
* otherwise ensure the symbol position count matches sympos.
--
2.20.1
next parent reply other threads:[~2020-09-23 17:41 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <20200923173905.11219-1-kristen@linux.intel.com>
2020-09-23 17:39 ` Kristen Carlson Accardi [this message]
2020-09-24 13:06 ` [PATCH v5 10/10] livepatch: only match unique symbols when using fgkaslr Miroslav Benes
2020-09-25 13:06 ` [PATCH v5 00/10] Function Granular KASLR Miroslav Benes
2020-09-28 17:31 ` Kristen Carlson Accardi
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200923173905.11219-11-kristen@linux.intel.com \
--to=kristen@linux.intel.com \
--cc=arjan@linux.intel.com \
--cc=bp@alien8.de \
--cc=jikos@kernel.org \
--cc=joe.lawrence@redhat.com \
--cc=jpoimboe@redhat.com \
--cc=keescook@chromium.org \
--cc=kernel-hardening@lists.openwall.com \
--cc=linux-kernel@vger.kernel.org \
--cc=live-patching@vger.kernel.org \
--cc=mbenes@suse.cz \
--cc=mingo@redhat.com \
--cc=pmladek@suse.com \
--cc=rick.p.edgecombe@intel.com \
--cc=tglx@linutronix.de \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).