lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Tue, 31 Aug 2021 16:41:08 +0200 From: Alexander Lobakin <alexandr.lobakin@...el.com> To: linux-hardening@...r.kernel.org Cc: "Kristen C Accardi" <kristen.c.accardi@...el.com>, Kristen Carlson Accardi <kristen@...ux.intel.com>, Kees Cook <keescook@...omium.org>, Masahiro Yamada <masahiroy@...nel.org>, "H. Peter Anvin" <hpa@...or.com>, Jessica Yu <jeyu@...nel.org>, Nathan Chancellor <nathan@...nel.org>, Nick Desaulniers <ndesaulniers@...gle.com>, Marios Pomonis <pomonis@...gle.com>, Sami Tolvanen <samitolvanen@...gle.com>, Tony Luck <tony.luck@...el.com>, Ard Biesheuvel <ardb@...nel.org>, Jesse Brandeburg <jesse.brandeburg@...el.com>, Lukasz Czapnik <lukasz.czapnik@...el.com>, "Marta A Plantykow" <marta.a.plantykow@...el.com>, Michal Kubiak <michal.kubiak@...el.com>, Michal Swiatkowski <michal.swiatkowski@...el.com>, Alexander Lobakin <alexandr.lobakin@...el.com>, linux-kbuild@...r.kernel.org, linux-arch@...r.kernel.org, linux-kernel@...r.kernel.org, clang-built-linux@...glegroups.com Subject: [PATCH v6 kspp-next 16/22] livepatch: only match unique symbols when using fgkaslr From: Kristen Carlson Accardi <kristen@...ux.intel.com> If any type of function granular randomization is enabled, the sympos algorithm will fail, as it will be impossible to resolve symbols when there are duplicates using the previous symbol position. Override the value of sympos to always be zero if fgkaslr is enabled for either the core kernel or modules, forcing the algorithm to require that only unique symbols are allowed to be patched. Signed-off-by: Kristen Carlson Accardi <kristen@...ux.intel.com> Signed-off-by: Alexander Lobakin <alexandr.lobakin@...el.com> --- kernel/livepatch/core.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/kernel/livepatch/core.c b/kernel/livepatch/core.c index 335d988bd811..852bbfa9da7b 100644 --- a/kernel/livepatch/core.c +++ b/kernel/livepatch/core.c @@ -169,6 +169,17 @@ static int klp_find_object_symbol(const char *objname, const char *name, else kallsyms_on_each_symbol(klp_find_callback, &args); + /* + * If any type of function granular randomization is enabled, it + * will be impossible to resolve symbols when there are duplicates + * using the previous symbol position (i.e. sympos != 0). Override + * the value of sympos to always be zero in this case. This will + * force the algorithm to require that only unique symbols are + * allowed to be patched. + */ + if (IS_ENABLED(CONFIG_FG_KASLR)) + sympos = 0; + /* * Ensure an address was found. If sympos is 0, ensure symbol is unique; * otherwise ensure the symbol position count matches sympos. -- 2.31.1
Powered by blists - more mailing lists