linux-kernel - [PATCH] kretprobes: reject registration if a symbol offset is specified

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 14 Feb 2017 14:01:18 +0530
From:   "Naveen N. Rao" <naveen.n.rao@...ux.vnet.ibm.com>
To:     Ananth N Mavinakayanahalli <ananth@...ux.vnet.ibm.com>,
        Masami Hiramatsu <mhiramat@...nel.org>,
        Ingo Molnar <mingo@...nel.org>
Cc:     linux-kernel@...r.kernel.org
Subject: [PATCH] kretprobes: reject registration if a symbol offset is specified

Users shouldn't be able to specify an offset with kretprobes, as we always
want to probe at function entry. Otherwise, we won't be able to capture
the proper return address resulting in the kretprobe never firing.

With samples/kprobes/kretprobe_example.c including an offset:
	my_kretprobe.kp.offset = 40;

Before this patch, the probe gets planted but never fires.

After this patch:
	$ sudo insmod samples/kprobes/kretprobe_example.ko
	[sudo] password for naveen: 
	insmod: ERROR: could not insert module samples/kprobes/kretprobe_example.ko: Operation not permitted

And dmesg:
	[48253.757629] register_kretprobe failed, returned -22

Signed-off-by: Naveen N. Rao <naveen.n.rao@...ux.vnet.ibm.com>
---
 kernel/kprobes.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/kernel/kprobes.c b/kernel/kprobes.c
index 60a702a05684..83ad7e440417 100644
--- a/kernel/kprobes.c
+++ b/kernel/kprobes.c
@@ -1847,6 +1847,9 @@ int register_kretprobe(struct kretprobe *rp)
 	int i;
 	void *addr;
 
+	if (rp->kp.offset)
+		return -EINVAL;
+
 	if (kretprobe_blacklist_size) {
 		addr = kprobe_addr(&rp->kp);
 		if (IS_ERR(addr))
-- 
2.11.0