riscv: kprobes: Fix probe address validation

When adding a kprobe such as "p:probe/tcp_sendmsg _text+15392192",
arch_check_kprobe would start iterating all instructions starting from
_text until the probed address. Not only is this very inefficient, but
literal values in there (e.g. left by function patching) are
misinterpreted in a way that causes a desync.

Fix this by doing it like x86: start the iteration at the closest
preceding symbol instead of the given starting point.

Fixes: 87f48c7ccc73 ("riscv: kprobe: Fixup kernel panic when probing an illegal position")
Signed-off-by: Fabian Vogt <fvogt@suse.de>
Signed-off-by: Marvin Friedrich <marvin.friedrich@suse.com>
Acked-by: Guo Ren <guoren@kernel.org>
Link: https://lore.kernel.org/r/6191817.lOV4Wx5bFT@fvogt-thinkpad
Signed-off-by: Paul Walmsley <pjw@kernel.org>

diff --git a/arch/riscv/kernel/probes/kprobes.c b/arch/riscv/kernel/probes/kprobes.c
index c0738d6c6498a51a0f3fd4c0e62e3bd13fadf600..8723390c7cad5f36deeee94894cb41c92a42c38e 100644 (file)
--- a/arch/riscv/kernel/probes/kprobes.c
+++ b/arch/riscv/kernel/probes/kprobes.c
@@ -49,10 +49,15 @@ static void __kprobes arch_simulate_insn(struct kprobe *p, struct pt_regs *regs)
        post_kprobe_handler(p, kcb, regs);
 }
 
-static bool __kprobes arch_check_kprobe(struct kprobe *p)
+static bool __kprobes arch_check_kprobe(unsigned long addr)
 {
-       unsigned long tmp  = (unsigned long)p->addr - p->offset;
-       unsigned long addr = (unsigned long)p->addr;
+       unsigned long tmp, offset;
+
+       /* start iterating at the closest preceding symbol */
+       if (!kallsyms_lookup_size_offset(addr, NULL, &offset))
+               return false;
+
+       tmp = addr - offset;
 
        while (tmp <= addr) {
                if (tmp == addr)
@@ -71,7 +76,7 @@ int __kprobes arch_prepare_kprobe(struct kprobe *p)
        if ((unsigned long)insn & 0x1)
                return -EILSEQ;
 
-       if (!arch_check_kprobe(p))
+       if (!arch_check_kprobe((unsigned long)p->addr))
                return -EILSEQ;
 
        /* copy instruction */