riscv: kprobes: Fix probe address validation

[ Upstream commit 9e68bd803fac49274fde914466fd3b07c4d602c8 ]

When adding a kprobe such as "p:probe/tcp_sendmsg _text+15392192",
arch_check_kprobe would start iterating all instructions starting from
_text until the probed address. Not only is this very inefficient, but
literal values in there (e.g. left by function patching) are
misinterpreted in a way that causes a desync.

Fix this by doing it like x86: start the iteration at the closest
preceding symbol instead of the given starting point.

Fixes: 87f48c7ccc73 ("riscv: kprobe: Fixup kernel panic when probing an illegal position")
Signed-off-by: Fabian Vogt <fvogt@suse.de>
Signed-off-by: Marvin Friedrich <marvin.friedrich@suse.com>
Acked-by: Guo Ren <guoren@kernel.org>
Link: https://lore.kernel.org/r/6191817.lOV4Wx5bFT@fvogt-thinkpad
Signed-off-by: Paul Walmsley <pjw@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/arch/riscv/kernel/probes/kprobes.c b/arch/riscv/kernel/probes/kprobes.c
index 7548b1d62509c301f2e3f55587231c2d27e79e9c..5251f182780174ec9429a45ace7fd99f7892fbff 100644 (file)
--- a/arch/riscv/kernel/probes/kprobes.c
+++ b/arch/riscv/kernel/probes/kprobes.c
@@ -48,10 +48,15 @@ static void __kprobes arch_simulate_insn(struct kprobe *p, struct pt_regs *regs)
        post_kprobe_handler(p, kcb, regs);
 }
 
-static bool __kprobes arch_check_kprobe(struct kprobe *p)
+static bool __kprobes arch_check_kprobe(unsigned long addr)
 {
-       unsigned long tmp  = (unsigned long)p->addr - p->offset;
-       unsigned long addr = (unsigned long)p->addr;
+       unsigned long tmp, offset;
+
+       /* start iterating at the closest preceding symbol */
+       if (!kallsyms_lookup_size_offset(addr, NULL, &offset))
+               return false;
+
+       tmp = addr - offset;
 
        while (tmp <= addr) {
                if (tmp == addr)
@@ -70,7 +75,7 @@ int __kprobes arch_prepare_kprobe(struct kprobe *p)
        if ((unsigned long)insn & 0x1)
                return -EILSEQ;
 
-       if (!arch_check_kprobe(p))
+       if (!arch_check_kprobe((unsigned long)p->addr))
                return -EILSEQ;
 
        /* copy instruction */