From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-vk1-f177.google.com (mail-vk1-f177.google.com [209.85.221.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 63AFC2D8762 for ; Wed, 18 Feb 2026 14:48:03 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.221.177 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1771426084; cv=none; b=i0BwSBfRTvKPhSzbSeeImfBlDJVSSbzXJecDQQ0KcvuP1WBr7zrflZPUm089BoSan9gQ0mOSfb3Zk5oD/Co6FCFHKOgl+eWfC7qh6ZkcteawKqqCraFSTpvZcLshWOiX2XLTB4jmP5kKYqtlKu1DSW0W4cFF9hKhx6yY9YlVVv8= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1771426084; c=relaxed/simple; bh=M3CxcjlhncvRFsVTNAuLWZDFaxlzaw81fXCELpYm5h4=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=lfs8G5ye33Fz17Y8cXkXlAmOF9kLS60wLDfsmLtxEJn6u+gm/ktUu+KPLCyVuFl8K4z7cy8SqFk7zFZXITXzNGStxQ9RayIJgzfDysTlA2bur6yIC1TZsA1oT+fj206Jj3S5dwBr4qkKICSziime+/eE2wDQT9ODQMOhtzeT1ZY= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=kLtCCfCt; arc=none smtp.client-ip=209.85.221.177 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="kLtCCfCt" Received: by mail-vk1-f177.google.com with SMTP id 71dfb90a1353d-56641200d6eso5033824e0c.0 for ; Wed, 18 Feb 2026 06:48:03 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1771426082; x=1772030882; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=6H14I4vuf+rU+PVdJuaIF5E0v61TptJEioteny5lO44=; b=kLtCCfCtLsTRBh4DlME97gvoVH4770cujPVnTxSHnchXxJCeDQHmGSyNKZNLxfgM3A hNF/HYhVImdT3qA4S799q9SEwZLm6l9/1cCVnGvveReD+0B7ncpnDasb7QR84bCoqgXV 5Sp8X/yaDEpJfVRK+2pJhp2fniB1GAod8SZOo3jfd0//9r2ojL752lz6t9htC2MqhUBK qiS2xqi8SwElevrlE1sVEi5A2aiwrXZpcn61cwAClta9Gqx21VZJuEZckNGVL5OmECDa UOBZtFCV9a0OVvwAFg8nYoAJzG0Zxo4grqZLTkf6+vXIkZCG+aHwenLeHPwSvRy67inb +M4A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1771426082; x=1772030882; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=6H14I4vuf+rU+PVdJuaIF5E0v61TptJEioteny5lO44=; b=BGHUJC3xLdqsOGipvuBZL5T+JKm1uig6QVMwbU2msT9WrZq3IM/ktuY0BJVRH6Xuof we5zYYcS4dHqQwNicqjdwrm57zDN1zajj6Nq/+Ux7vXVs5k7b2e7KXnYbxJZ51seGzDF Qtg1tF7Chmufs0Zc4vg8vBjkiRXGqXPodSQXHE89HC60clwfEdNu8jZ7e5FEPcZ8w1DZ //+ZZfoWYdQan9bB90Xrb4UPmfKELa+G1qBpL87cJITPO+aIDYQ3+AsdIhIfXOtGrihz EmJ9TdOOYlg3CuRWgScZpgGAMPP7fn+XYmOssPjqaWJv4ekEBy/QTNXez/Y1TPr78QZJ 8aTQ== X-Gm-Message-State: AOJu0YzXI/edNJfJ3SUoA6S0mtgvWY+pVqkXwu5sbTSb0Q4mLvIvQhOB +C9XgR0RFMbKhSoMQHB5ArZfvJ0Q6+afvF7FyEUeHfKOCm2qjOKIk+V7dnhQjw== X-Gm-Gg: AZuq6aJjN6VgM/0OP3f+tTRlK2kTGMde9mRVAubmf+UONTjqU7k5TQhwDqJ2IzzBu43 ue8K9NwNkTmJZJtfj6ulo7V1f/3nhLDPtc3Sz3cjnd3I8BpVZdPo85JKDXR4W2LCwsYTtUQV3RV 0lc17zOfWrGF3wYyaIkZ7dkI3y1Bq4JVQ2LJJgAUjtlkjrXIXpjcPPnN5IVchgbe4BcGmr+tbM3 +LOR7Sb3REYFVOvkjzZskRyixDnoHq+z4T8NJehHJPrA25NT/PMk0BdqwG7VCQcEXDVjtD3iRY1 Jkthq0FaGUZ1/yHGyhT8ba0J76xMhSyC5aESd4QGvkaIG1Q7+6w6dDZUea4okcYfWuRE05jXYQE KQ0NVFFEdo+1pmD18iBL203nizP+UjuzImajXI83NhNQmMFimvB3JebSL0aO1AyeQexLUtGYD/d AoucfpgmKpFczk3vLnZXvA5i1KpiGErIx8Ab4u9Y9DeVfn X-Received: by 2002:a05:6122:7cf:b0:559:6b7f:b110 with SMTP id 71dfb90a1353d-56889b55de2mr5528888e0c.2.1771426081769; Wed, 18 Feb 2026 06:48:01 -0800 (PST) Received: from elly-G3-3579.. ([2803:9800:9881:bd6c:f409:18ee:69ab:1183]) by smtp.gmail.com with ESMTPSA id 71dfb90a1353d-56769ab0762sm8814877e0c.4.2026.02.18.06.47.58 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 18 Feb 2026 06:48:01 -0800 (PST) From: "Elly I. Esparza" To: linux-kernel@vger.kernel.org, luto@kernel.org, tglx@linutronix.de, mingo@redhat.com, bp@alien8.de, dave.hansen@linux.intel.com, x86@kernel.org, hpa@zytor.com Cc: "Elly I . Esparza" Subject: [PATCH 1/2] x86: Prevent syscall hooking Date: Wed, 18 Feb 2026 11:47:35 -0300 Message-ID: <20260218144735.24307-1-ellyesparza8@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Kprobes can be used by rootkits to find the address of x64_sys_call(), x32_sys_call() and ia32_sys_call(). This in turn allows for the rootkits to find an specific syscall handler and hook it. Add x64_sys_call(), x32_sys_call() and ia32_sys_call() to the kprobes blacklist. Signed-off-by: Elly I. Esparza --- arch/x86/entry/syscall_32.c | 2 ++ arch/x86/entry/syscall_64.c | 3 +++ 2 files changed, 5 insertions(+) diff --git a/arch/x86/entry/syscall_32.c b/arch/x86/entry/syscall_32.c index 2b15ea17bb7c..75d34d2c8067 100644 --- a/arch/x86/entry/syscall_32.c +++ b/arch/x86/entry/syscall_32.c @@ -1,6 +1,7 @@ // SPDX-License-Identifier: GPL-2.0-only /* 32-bit system call dispatch */ +#include #include #include #include @@ -48,6 +49,7 @@ long ia32_sys_call(const struct pt_regs *regs, unsigned int nr) default: return __ia32_sys_ni_syscall(regs); } } +NOKPROBE_SYMBOL(ia32_sys_call) static __always_inline int syscall_32_enter(struct pt_regs *regs) { diff --git a/arch/x86/entry/syscall_64.c b/arch/x86/entry/syscall_64.c index b6e68ea98b83..1e8045a499d4 100644 --- a/arch/x86/entry/syscall_64.c +++ b/arch/x86/entry/syscall_64.c @@ -1,6 +1,7 @@ // SPDX-License-Identifier: GPL-2.0-only /* 64-bit system call dispatch */ +#include #include #include #include @@ -39,6 +40,7 @@ long x64_sys_call(const struct pt_regs *regs, unsigned int nr) default: return __x64_sys_ni_syscall(regs); } } +NOKPROBE_SYMBOL(x64_sys_call) #ifdef CONFIG_X86_X32_ABI long x32_sys_call(const struct pt_regs *regs, unsigned int nr) @@ -48,6 +50,7 @@ long x32_sys_call(const struct pt_regs *regs, unsigned int nr) default: return __x64_sys_ni_syscall(regs); } } +NOKPROBE_SYMBOL(x32_sys_call) #endif static __always_inline bool do_syscall_x64(struct pt_regs *regs, int nr) -- 2.43.0