4 files changed, 68 insertions, 6 deletions

diff --git a/tools/perf/util/event.c b/tools/perf/util/event.c
index 6635fcd11ca5..0fe9adf76379 100644
--- a/tools/perf/util/event.c
+++ b/tools/perf/util/event.c
@@ -553,9 +553,18 @@ static int perf_event__process_kernel_mmap(union perf_event *event,
                         goto out_problem;
 
                 perf_event__set_kernel_mmap_len(event, machine->vmlinux_maps);
-                perf_session__set_kallsyms_ref_reloc_sym(machine->vmlinux_maps,
-                                                         symbol_name,
-                                                         event->mmap.pgoff);
+
+                /*
+                 * Avoid using a zero address (kptr_restrict) for the ref reloc
+                 * symbol. Effectively having zero here means that at record
+                 * time /proc/sys/kernel/kptr_restrict was non zero.
+                 */
+                if (event->mmap.pgoff != 0) {
+                        perf_session__set_kallsyms_ref_reloc_sym(machine->vmlinux_maps,
+                                                                 symbol_name,
+                                                                 event->mmap.pgoff);
+                }
+
                 if (machine__is_default_guest(machine)) {
                         /*
                          * preload dso of guest kernel and modules
diff --git a/tools/perf/util/header.c b/tools/perf/util/header.c
index 0717bebc7649..afb0849fe530 100644
--- a/tools/perf/util/header.c
+++ b/tools/perf/util/header.c
@@ -193,9 +193,13 @@ int build_id_cache__add_s(const char *sbuild_id, const char *debugdir,
              *linkname = malloc(size), *targetname;
         int len, err = -1;
 
-        if (is_kallsyms)
+        if (is_kallsyms) {
+                if (symbol_conf.kptr_restrict) {
+                        pr_debug("Not caching a kptr_restrict'ed /proc/kallsyms\n");
+                        return 0;
+                }
                 realname = (char *)name;
-        else
+        } else
                 realname = realpath(name, NULL);
 
         if (realname == NULL || filename == NULL || linkname == NULL)
diff --git a/tools/perf/util/symbol.c b/tools/perf/util/symbol.c
index 516876dfbe52..eec196329fd9 100644
--- a/tools/perf/util/symbol.c
+++ b/tools/perf/util/symbol.c
@@ -676,9 +676,30 @@ discard_symbol:		rb_erase(&pos->rb_node, root);
         return count + moved;
 }
 
+static bool symbol__restricted_filename(const char *filename,
+                                        const char *restricted_filename)
+{
+        bool restricted = false;
+
+        if (symbol_conf.kptr_restrict) {
+                char *r = realpath(filename, NULL);
+
+                if (r != NULL) {
+                        restricted = strcmp(r, restricted_filename) == 0;
+                        free(r);
+                        return restricted;
+                }
+        }
+
+        return restricted;
+}
+
 int dso__load_kallsyms(struct dso *dso, const char *filename,
                        struct map *map, symbol_filter_t filter)
 {
+        if (symbol__restricted_filename(filename, "/proc/kallsyms"))
+                return -1;
+
         if (dso__load_all_kallsyms(dso, filename, map) < 0)
                 return -1;
 
@@ -1790,6 +1811,9 @@ static int machine__create_modules(struct machine *machine)
                 modules = path;
         }
 
+        if (symbol__restricted_filename(path, "/proc/modules"))
+                return -1;
+
         file = fopen(modules, "r");
         if (file == NULL)
                 return -1;
@@ -2239,6 +2263,9 @@ static u64 machine__get_kernel_start_addr(struct machine *machine)
                 }
         }
 
+        if (symbol__restricted_filename(filename, "/proc/kallsyms"))
+                return 0;
+
         if (kallsyms__parse(filename, &args, symbol__in_kernel) <= 0)
                 return 0;
 
@@ -2410,6 +2437,25 @@ static int setup_list(struct strlist **list, const char *list_str,
         return 0;
 }
 
+static bool symbol__read_kptr_restrict(void)
+{
+        bool value = false;
+
+        if (geteuid() != 0) {
+                FILE *fp = fopen("/proc/sys/kernel/kptr_restrict", "r");
+                if (fp != NULL) {
+                        char line[8];
+
+                        if (fgets(line, sizeof(line), fp) != NULL)
+                                value = atoi(line) != 0;
+
+                        fclose(fp);
+                }
+        }
+
+        return value;
+}
+
 int symbol__init(void)
 {
         const char *symfs;
@@ -2456,6 +2502,8 @@ int symbol__init(void)
         if (symfs != symbol_conf.symfs)
                 free((void *)symfs);
 
+        symbol_conf.kptr_restrict = symbol__read_kptr_restrict();
+
         symbol_conf.initialized = true;
         return 0;
 
diff --git a/tools/perf/util/symbol.h b/tools/perf/util/symbol.h
index 242de0101a86..325ee36a9d29 100644
--- a/tools/perf/util/symbol.h
+++ b/tools/perf/util/symbol.h
@@ -75,7 +75,8 @@ struct symbol_conf {
                         use_callchain,
                         exclude_other,
                         show_cpu_utilization,
-                        initialized;
+                        initialized,
+                        kptr_restrict;
         const char      *vmlinux_name,
                         *kallsyms_name,
                         *source_prefix,