Re: [PATCH 2/2] kernel/kallsyms: Prevent bypassing of kprobes blacklist

[Masami Hiramatsu (Google) <mhiramat@kernel.org>]

On Wed, 18 Feb 2026 11:48:19 -0300
"Elly I. Esparza" <ellyesparza8@gmail.com> wrote:

> Kprobes can be used to get the adress of kallsyms_lookup_name() providing
> access to blacklisted symbols.
> 
> Add kallsyms_lookup_name() to kprobes blacklist.

NACK, this NOKPROBE_SYMBOL() should be used for the functions which
is called inside the kprobe callback handler. kallsyms_lookup_name()
is used when setting up the kprobe, not from the callbacks.

Thanks,


> 
> Signed-off-by: Elly I. Esparza <ellyesparza8@gmail.com>
> ---
>  kernel/kallsyms.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/kernel/kallsyms.c b/kernel/kallsyms.c
> index 1e7635864124..13a7c0fdb5da 100644
> --- a/kernel/kallsyms.c
> +++ b/kernel/kallsyms.c
> @@ -234,6 +234,7 @@ unsigned long kallsyms_lookup_name(const char *name)
>  
>  	return module_kallsyms_lookup_name(name);
>  }
> +NOKPROBE_SYMBOL(kallsyms_lookup_name)
>  
>  /*
>   * Iterate over all symbols in vmlinux.  For symbols from modules use
> -- 
> 2.43.0
> 


-- 
Masami Hiramatsu (Google) <mhiramat@kernel.org>