Re: [PATCH 1/1] perf/core: Require kernel access for text poke events

[Peter Zijlstra <peterz@infradead.org>]

On Mon, Sep 28, 2026 at 10:59:35AM -0700, Zhengchuan Liang wrote:
> Perf events with exclude_kernel=1 can be opened without kernel perf
> access. However, exclude_kernel does not suppress text-poke sideband
> records. Every PERF_RECORD_TEXT_POKE is marked PERF_RECORD_MISC_KERNEL
> and contains a raw kernel instruction address.
> 
> An unprivileged task can therefore open and mmap a task-local software
> event with text_poke=1. Both opening a count-only tracepoint event and
> configuring UDP GRO for ESP-in-UDP cause updates to inline static calls;
> the observer receives the relocated addresses of the modified instructions.
> For a known kernel image, any such address reveals the runtime kernel
> text base despite KASLR.
> 
> Call perf_allow_kernel() whenever attr.text_poke is set, regardless of
> exclude_kernel. Events that neither monitor kernel execution nor request
> text-poke records retain their existing permissions.
> 
> Fixes: e17d43b93e54 ("perf: Add perf text poke event")
> Cc: stable@vger.kernel.org
> Assisted-by: LLM
> Signed-off-by: Zhengchuan Liang <zcliangcn@gmail.com>

Nice one. Thanks!

>  kernel/events/core.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/kernel/events/core.c b/kernel/events/core.c
> index 634d2ccbab82..b4e6e8ae3be7 100644
> --- a/kernel/events/core.c
> +++ b/kernel/events/core.c
> @@ -13953,7 +13953,7 @@ SYSCALL_DEFINE5(perf_event_open,
>  	if (err)
>  		return err;
>  
> -	if (!attr.exclude_kernel ||
> +	if (!attr.exclude_kernel || attr.text_poke ||
>  	    ((attr.sample_type & PERF_SAMPLE_CALLCHAIN) &&
>  	     !attr.exclude_callchain_kernel)) {
>  		err = perf_allow_kernel();
> -- 
> 2.34.1