[PATCH 2/2] kernel/kallsyms: Prevent bypassing of kprobes blacklist

[PATCH 2/2] kernel/kallsyms: Prevent bypassing of kprobes blacklist

[Elly I. Esparza]

Kprobes can be used to get the adress of kallsyms_lookup_name() providing
access to blacklisted symbols.

Add kallsyms_lookup_name() to kprobes blacklist.

Signed-off-by: Elly I. Esparza <ellyesparza8@gmail.com>
---
 kernel/kallsyms.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/kernel/kallsyms.c b/kernel/kallsyms.c
index 1e7635864124..13a7c0fdb5da 100644
--- a/kernel/kallsyms.c
+++ b/kernel/kallsyms.c
@@ -234,6 +234,7 @@ unsigned long kallsyms_lookup_name(const char *name)
 
 	return module_kallsyms_lookup_name(name);
 }
+NOKPROBE_SYMBOL(kallsyms_lookup_name)
 
 /*
  * Iterate over all symbols in vmlinux.  For symbols from modules use
-- 
2.43.0

Re: [PATCH 2/2] kernel/kallsyms: Prevent bypassing of kprobes blacklist

[Masami Hiramatsu]

On Wed, 18 Feb 2026 11:48:19 -0300
"Elly I. Esparza" <ellyesparza8@gmail.com> wrote:

> Kprobes can be used to get the adress of kallsyms_lookup_name() providing
> access to blacklisted symbols.
> 
> Add kallsyms_lookup_name() to kprobes blacklist.

NACK, this NOKPROBE_SYMBOL() should be used for the functions which
is called inside the kprobe callback handler. kallsyms_lookup_name()
is used when setting up the kprobe, not from the callbacks.

Thanks,


> 
> Signed-off-by: Elly I. Esparza <ellyesparza8@gmail.com>
> ---
>  kernel/kallsyms.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/kernel/kallsyms.c b/kernel/kallsyms.c
> index 1e7635864124..13a7c0fdb5da 100644
> --- a/kernel/kallsyms.c
> +++ b/kernel/kallsyms.c
> @@ -234,6 +234,7 @@ unsigned long kallsyms_lookup_name(const char *name)
>  
>  	return module_kallsyms_lookup_name(name);
>  }
> +NOKPROBE_SYMBOL(kallsyms_lookup_name)
>  
>  /*
>   * Iterate over all symbols in vmlinux.  For symbols from modules use
> -- 
> 2.43.0
> 


-- 
Masami Hiramatsu (Google) <mhiramat@kernel.org>

Re: [PATCH 2/2] kernel/kallsyms: Prevent bypassing of kprobes blacklist

[Christoph Hellwig]

On Thu, Feb 19, 2026 at 10:29:15AM +0900, Masami Hiramatsu wrote:
> On Wed, 18 Feb 2026 11:48:19 -0300
> "Elly I. Esparza" <ellyesparza8@gmail.com> wrote:
> 
> > Kprobes can be used to get the adress of kallsyms_lookup_name() providing
> > access to blacklisted symbols.
> > 
> > Add kallsyms_lookup_name() to kprobes blacklist.
> 
> NACK, this NOKPROBE_SYMBOL() should be used for the functions which
> is called inside the kprobe callback handler. kallsyms_lookup_name()
> is used when setting up the kprobe, not from the callbacks.

I don't think that's the point Elly made.  The point is that
kallsyms_lookup_name + kprobes is used to bypass lacking symbol exports.
So preventing it is a good idea, and this seems like a cute hack for
that.  But it really needs a better commit log, and a big fat comment
explaining the slight abuse of NOKPROBE_SYMBOL in the code.