From: Masami Hiramatsu <mhiramat@xxxxxxxxxx>
commit 804dec5bda9b4fcdab5f67fe61db4a0498af5221 upstream.
Do not modify singlestep execution buffer (kprobe.ainsn.insn)
while resuming from single-stepping, instead, modifies
the buffer to add a jump back instruction at preparing
buffer.
Commit 176bee4cfcec ("kprobes/x86: Set kprobes pages read-only")
introduced a bug in stable 4.4.y by making singlestep buffer page
read-only. Attempts to modify singlestep buffer, to insert a jump
instruction, at resume_execution() lead to kernel panic.
BUG: unable to handle kernel paging request at ffffffffa0011001
IP: [<ffffffff8105711c>] resume_execution+0x14c/0x1a0
PGD 1c0f067 PUD 1c10063 PMD 42ac74067 PTE 41cc35061
Oops: 0003 [#1] SMP
Modules linked in: stap_6eaf26e7bd7018624e4c19b7486f4bb8_1857(OE) ipt_MASQUERADE(E) nf_nat_masquerade_ipv4(E) <...>
CPU: 5 PID: 1857 Comm: stapio Tainted: G OE 4.4.136+ #1
Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 01/24/2017
task: ffff880425044940 ti: ffff88042d160000 task.ti: ffff88042d160000
RIP: 0010:[<ffffffff8105711c>] [<ffffffff8105711c>] resume_execution+0x14c/0x1a0
RSP: 0018:ffff88043fd4aeb0 EFLAGS: 00010086
RAX: ffffffffa0011001 RBX: ffff88043fd4af58 RCX: 0000000000000006
RDX: ffffffff811b9f71 RSI: ffff88043fd4af58 RDI: 0000000000000055
RBP: ffff88043fd4aee8 R08: 0000000000000001 R09: ffff88041cce8100
R10: 0000000000000004 R11: ffff8804252d9238 R12: ffff88042c6051c0
R13: ffffffff811b9f70 R14: ffff88042d163f08 R15: ffffffffa0011000
FS: 00007f05f6439740(0000) GS:ffff88043fd40000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffa0011001 CR3: 000000042944a000 CR4: 0000000000160670
Stack:
ffff88043fd4fee0 0000000000000000 ffff88043fd4fee0 ffff88043fd4af58
ffff88042c6051c0 0000000000000000 00007ffd23764640 ffff88043fd4af10
ffffffff810571a8 ffff88043fd4af58 ffff880425044940 0000000000000000
Call Trace:
<#DB>
[<ffffffff810571a8>] kprobe_debug_handler+0x38/0xd0
[<ffffffff81016de2>] do_debug+0x82/0x1b0
[<ffffffff817e6aa5>] debug+0x35/0x70
<<EOE>>
[<ffffffff811bac51>] ? SyS_read+0x41/0xa0
[<ffffffff817e48a1>] entry_SYSCALL_64_fastpath+0x1e/0x95
Issue was found and fix was verified by running systemtap:
stap -v -e 'probe vfs.read {printf("read performed\n"); exit()}'
Fixes: 176bee4cfcec ("kprobes/x86: Set kprobes pages read-only")
Cc: <stable@xxxxxxxxxxxxxxx> # 4.4.x
Signed-off-by: Masami Hiramatsu <mhiramat@xxxxxxxxxx>
Cc: Ananth N Mavinakayanahalli <ananth@xxxxxxxxxxxxxxxxxx>
Cc: Andrey Ryabinin <aryabinin@xxxxxxxxxxxxx>
Cc: Anil S Keshavamurthy <anil.s.keshavamurthy@xxxxxxxxx>
Cc: Borislav Petkov <bp@xxxxxxxxx>
Cc: Brian Gerst <brgerst@xxxxxxxxx>
Cc: David S . Miller <davem@xxxxxxxxxxxxx>
Cc: Denys Vlasenko <dvlasenk@xxxxxxxxxx>
Cc: H. Peter Anvin <hpa@xxxxxxxxx>
Cc: Josh Poimboeuf <jpoimboe@xxxxxxxxxx>
Cc: Linus Torvalds <torvalds@xxxxxxxxxxxxxxxxxxxx>
Cc: Peter Zijlstra <peterz@xxxxxxxxxxxxx>
Cc: Thomas Gleixner <tglx@xxxxxxxxxxxxx>
Cc: Ye Xiaolong <xiaolong.ye@xxxxxxxxx>
Link: http://lkml.kernel.org/r/149076361560.22469.1610155860343077495.stgit@devbox
Signed-off-by: Ingo Molnar <mingo@xxxxxxxxxx>
Reviewed-by: "Steven Rostedt (VMware)" <rostedt@xxxxxxxxxxx>
Signed-off-by: Alexey Makhalov <amakhalov@xxxxxxxxxx>
---
arch/x86/kernel/kprobes/core.c | 42 ++++++++++++++++++++----------------------
1 file changed, 20 insertions(+), 22 deletions(-)
diff --git a/arch/x86/kernel/kprobes/core.c b/arch/x86/kernel/kprobes/core.c
index df9be5b91270..1f5c47a49e35 100644
--- a/arch/x86/kernel/kprobes/core.c
+++ b/arch/x86/kernel/kprobes/core.c
@@ -411,25 +411,38 @@ void free_insn_page(void *page)
module_memfree(page);
}
+/* Prepare reljump right after instruction to boost */
+static void prepare_boost(struct kprobe *p, int length)
+{
+ if (can_boost(p->ainsn.insn, p->addr) &&
+ MAX_INSN_SIZE - length >= RELATIVEJUMP_SIZE) {
+ /*
+ * These instructions can be executed directly if it
+ * jumps back to correct address.
+ */
+ synthesize_reljump(p->ainsn.insn + length, p->addr + length);
+ p->ainsn.boostable = 1;
+ } else {
+ p->ainsn.boostable = -1;
+ }
+}
+
static int arch_copy_kprobe(struct kprobe *p)
{
- int ret;
+ int len;
set_memory_rw((unsigned long)p->ainsn.insn & PAGE_MASK, 1);
/* Copy an instruction with recovering if other optprobe modifies it.*/
- ret = __copy_instruction(p->ainsn.insn, p->addr);
- if (!ret)
+ len = __copy_instruction(p->ainsn.insn, p->addr);
+ if (!len)
return -EINVAL;
/*
* __copy_instruction can modify the displacement of the instruction,
* but it doesn't affect boostable check.
*/
- if (can_boost(p->ainsn.insn, p->addr))
- p->ainsn.boostable = 0;
- else
- p->ainsn.boostable = -1;
+ prepare_boost(p, len);
set_memory_ro((unsigned long)p->ainsn.insn & PAGE_MASK, 1);
@@ -894,21 +907,6 @@ static void resume_execution(struct kprobe *p, struct pt_regs *regs,
break;
}
- if (p->ainsn.boostable == 0) {
- if ((regs->ip > copy_ip) &&
- (regs->ip - copy_ip) + 5 < MAX_INSN_SIZE) {
- /*
- * These instructions can be executed directly if it
- * jumps back to correct address.
- */
- synthesize_reljump((void *)regs->ip,
- (void *)orig_ip + (regs->ip - copy_ip));
- p->ainsn.boostable = 1;
- } else {
- p->ainsn.boostable = -1;
- }
- }
-
regs->ip += orig_ip - copy_ip;
no_change:
--
2.14.2
