[PATCH] perf/core: Check kernel access for text poke and ksymbol events

[PATCH] perf/core: Check kernel access for text poke and ksymbol events

[Kyle Zeng]

PERF_RECORD_TEXT_POKE contains kernel text addresses and the old and new
instruction bytes. PERF_RECORD_KSYMBOL similarly exposes kernel symbol
addresses. Both records are delivered independently of exclude_kernel,
but perf_event_open() does not check kernel access when their respective
attributes are requested.

With perf_event_paranoid=2, an unprivileged task can therefore open a
user-only software event with text_poke set and observe kernel text
patches. Opening and closing permitted counting-only tracepoint events
can produce these records through static-call updates, disclosing
relocated kernel text and branch targets.

Include ksymbol and text_poke in the existing perf_allow_kernel() check.
This authorizes the source event before allocation, also covering
inherited events and output redirection, while retaining the existing
sideband behavior for callers allowed to observe the kernel.

Fixes: e17d43b93e54 ("perf: Add perf text poke event")
Fixes: 76193a94522f ("perf, bpf: Introduce PERF_RECORD_KSYMBOL")
Assisted-by: Codex:gpt-6-astra
Signed-off-by: Kyle Zeng <kylebot@openai.com>
---
 kernel/events/core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/events/core.c b/kernel/events/core.c
index db7b76d6b68a..7301b320f746 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -13946,7 +13946,7 @@ SYSCALL_DEFINE5(perf_event_open,
 	if (err)
 		return err;
 
-	if (!attr.exclude_kernel ||
+	if (!attr.exclude_kernel || attr.ksymbol || attr.text_poke ||
 	    ((attr.sample_type & PERF_SAMPLE_CALLCHAIN) &&
 	     !attr.exclude_callchain_kernel)) {
 		err = perf_allow_kernel();

base-commit: fd179f8a05be3ccae366b9b96e176b51fbe54aab
-- 
2.53.0

Re: [PATCH] perf/core: Check kernel access for text poke and ksymbol events

[sashiko-bot]

> PERF_RECORD_TEXT_POKE contains kernel text addresses and the old and new
> instruction bytes. PERF_RECORD_KSYMBOL similarly exposes kernel symbol
> addresses. Both records are delivered independently of exclude_kernel,
> but perf_event_open() does not check kernel access when their respective
> attributes are requested.
> 
> With perf_event_paranoid=2, an unprivileged task can therefore open a
> user-only software event with text_poke set and observe kernel text
> patches. Opening and closing permitted counting-only tracepoint events
> can produce these records through static-call updates, disclosing
> relocated kernel text and branch targets.
> 
> Include ksymbol and text_poke in the existing perf_allow_kernel() check.
> This authorizes the source event before allocation, also covering
> inherited events and output redirection, while retaining the existing
> sideband behavior for callers allowed to observe the kernel.
> 
> Fixes: e17d43b93e54 ("perf: Add perf text poke event")
> Fixes: 76193a94522f ("perf, bpf: Introduce PERF_RECORD_KSYMBOL")
> Assisted-by: Codex:gpt-6-astra
> Signed-off-by: Kyle Zeng <kylebot@openai.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261006225248.54708-1-kylebot@openai.com?part=1