Skip to content
  • Francis Deslauriers's avatar
    x86/kprobes: Fix kernel crash when probing .entry_trampoline code · 24e955e5
    Francis Deslauriers authored
    commit c07a8f8b
    
     upstream.
    
    Disable the kprobe probing of the entry trampoline:
    
    .entry_trampoline is a code area that is used to ensure page table
    isolation between userspace and kernelspace.
    
    At the beginning of the execution of the trampoline, we load the
    kernel's CR3 register. This has the effect of enabling the translation
    of the kernel virtual addresses to physical addresses. Before this
    happens most kernel addresses can not be translated because the running
    process' CR3 is still used.
    
    If a kprobe is placed on the trampoline code before that change of the
    CR3 register happens the kernel crashes because int3 handling pages are
    not accessible.
    
    To fix this, add the .entry_trampoline section to the kprobe blacklist
    to prohibit the probing of code before all the kernel pages are
    accessible.
    
    Signed-off-by: default avatarFrancis Deslauriers <francis.deslauriers@efficios.com>
    Reviewed-by: default avatarThomas Gleixner <tglx@linutronix.d...>
    24e955e5