| Message ID | 20211202223214.72888-9-alexandr.lobakin@intel.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | Function Granular KASLR | expand |
On Thu, Dec 02, 2021 at 11:32:08PM +0100, Alexander Lobakin wrote: > If any type of function granular randomization is enabled, the sympos > algorithm will fail, as it will be impossible to resolve symbols when > there are duplicates using the previous symbol position. > > We could override sympos to 0, but make it more clear to the user > and bail out if the symbol is not unique. Since we're going lots of horrendous things already, why can't we fix this duplicate nonsense too?
From: Peter Zijlstra <peterz@infradead.org> Date: Fri, 3 Dec 2021 11:05:54 +0100 > On Thu, Dec 02, 2021 at 11:32:08PM +0100, Alexander Lobakin wrote: > > If any type of function granular randomization is enabled, the sympos > > algorithm will fail, as it will be impossible to resolve symbols when > > there are duplicates using the previous symbol position. > > > > We could override sympos to 0, but make it more clear to the user > > and bail out if the symbol is not unique. > > Since we're going lots of horrendous things already, why can't we fix > this duplicate nonsense too? Oh, I see a ton of code duplication here in Kristen's code as well. I'll address it. Al
On Fri, Dec 03, 2021 at 11:05:54AM +0100, Peter Zijlstra wrote: > On Thu, Dec 02, 2021 at 11:32:08PM +0100, Alexander Lobakin wrote: > > If any type of function granular randomization is enabled, the sympos > > algorithm will fail, as it will be impossible to resolve symbols when > > there are duplicates using the previous symbol position. > > > > We could override sympos to 0, but make it more clear to the user > > and bail out if the symbol is not unique. > > Since we're going lots of horrendous things already, why can't we fix > this duplicate nonsense too? I assume you mean using this new linker flag: "-z unique-symbol" https://sourceware.org/bugzilla/show_bug.cgi?id=26391
diff --git a/kernel/livepatch/core.c b/kernel/livepatch/core.c index 335d988bd811..10ea75111057 100644 --- a/kernel/livepatch/core.c +++ b/kernel/livepatch/core.c @@ -169,6 +169,17 @@ static int klp_find_object_symbol(const char *objname, const char *name, else kallsyms_on_each_symbol(klp_find_callback, &args); + /* + * If function granular randomization is enabled, it is impossible + * to resolve symbols when there are duplicates using the previous + * symbol position (i.e. sympos != 0). + */ + if (IS_ENABLED(CONFIG_FG_KASLR) && sympos) { + pr_err("FG-KASLR is enabled, specifying symbol position %lu for symbol '%s' in object '%s' does not work\n", + sympos, name, objname ? objname : "vmlinux"); + goto out_err; + } + /* * Ensure an address was found. If sympos is 0, ensure symbol is unique; * otherwise ensure the symbol position count matches sympos. @@ -186,6 +197,7 @@ static int klp_find_object_symbol(const char *objname, const char *name, return 0; } +out_err: *addr = 0; return -EINVAL; }
If any type of function granular randomization is enabled, the sympos algorithm will fail, as it will be impossible to resolve symbols when there are duplicates using the previous symbol position. We could override sympos to 0, but make it more clear to the user and bail out if the symbol is not unique. Suggested-by: Miroslav Benes <mbenes@suse.cz> Signed-off-by: Alexander Lobakin <alexandr.lobakin@intel.com> --- kernel/livepatch/core.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)