From: Masami Hiramatsu mhiramat@kernel.org
commit 804dec5bda9b4fcdab5f67fe61db4a0498af5221 upstream.
Do not modify singlestep execution buffer (kprobe.ainsn.insn) while resuming from single-stepping, instead, modifies the buffer to add a jump back instruction at preparing buffer.
Commit 176bee4cfcec ("kprobes/x86: Set kprobes pages read-only") introduced a bug in stable 4.4.y by making singlestep buffer page read-only. Attempts to modify singlestep buffer, to insert a jump instruction, at resume_execution() lead to kernel panic.
BUG: unable to handle kernel paging request at ffffffffa0011001 IP: [<ffffffff8105711c>] resume_execution+0x14c/0x1a0 PGD 1c0f067 PUD 1c10063 PMD 42ac74067 PTE 41cc35061 Oops: 0003 [#1] SMP Modules linked in: stap_6eaf26e7bd7018624e4c19b7486f4bb8_1857(OE) ipt_MASQUERADE(E) nf_nat_masquerade_ipv4(E) <...> CPU: 5 PID: 1857 Comm: stapio Tainted: G OE 4.4.136+ #1 Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 01/24/2017 task: ffff880425044940 ti: ffff88042d160000 task.ti: ffff88042d160000 RIP: 0010:[<ffffffff8105711c>] [<ffffffff8105711c>] resume_execution+0x14c/0x1a0 RSP: 0018:ffff88043fd4aeb0 EFLAGS: 00010086 RAX: ffffffffa0011001 RBX: ffff88043fd4af58 RCX: 0000000000000006 RDX: ffffffff811b9f71 RSI: ffff88043fd4af58 RDI: 0000000000000055 RBP: ffff88043fd4aee8 R08: 0000000000000001 R09: ffff88041cce8100 R10: 0000000000000004 R11: ffff8804252d9238 R12: ffff88042c6051c0 R13: ffffffff811b9f70 R14: ffff88042d163f08 R15: ffffffffa0011000 FS: 00007f05f6439740(0000) GS:ffff88043fd40000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffffffa0011001 CR3: 000000042944a000 CR4: 0000000000160670 Stack: ffff88043fd4fee0 0000000000000000 ffff88043fd4fee0 ffff88043fd4af58 ffff88042c6051c0 0000000000000000 00007ffd23764640 ffff88043fd4af10 ffffffff810571a8 ffff88043fd4af58 ffff880425044940 0000000000000000 Call Trace: <#DB> [<ffffffff810571a8>] kprobe_debug_handler+0x38/0xd0 [<ffffffff81016de2>] do_debug+0x82/0x1b0 [<ffffffff817e6aa5>] debug+0x35/0x70 <<EOE>> [<ffffffff811bac51>] ? SyS_read+0x41/0xa0 [<ffffffff817e48a1>] entry_SYSCALL_64_fastpath+0x1e/0x95
Issue was found and fix was verified by running systemtap: stap -v -e 'probe vfs.read {printf("read performed\n"); exit()}'
Fixes: 176bee4cfcec ("kprobes/x86: Set kprobes pages read-only") Cc: stable@vger.kernel.org # 4.4.x Signed-off-by: Masami Hiramatsu mhiramat@kernel.org Cc: Ananth N Mavinakayanahalli ananth@linux.vnet.ibm.com Cc: Andrey Ryabinin aryabinin@virtuozzo.com Cc: Anil S Keshavamurthy anil.s.keshavamurthy@intel.com Cc: Borislav Petkov bp@alien8.de Cc: Brian Gerst brgerst@gmail.com Cc: David S . Miller davem@davemloft.net Cc: Denys Vlasenko dvlasenk@redhat.com Cc: H. Peter Anvin hpa@zytor.com Cc: Josh Poimboeuf jpoimboe@redhat.com Cc: Linus Torvalds torvalds@linux-foundation.org Cc: Peter Zijlstra peterz@infradead.org Cc: Thomas Gleixner tglx@linutronix.de Cc: Ye Xiaolong xiaolong.ye@intel.com Link: http://lkml.kernel.org/r/149076361560.22469.1610155860343077495.stgit@devbox Signed-off-by: Ingo Molnar mingo@kernel.org Reviewed-by: "Steven Rostedt (VMware)" rostedt@goodmis.org Signed-off-by: Alexey Makhalov amakhalov@vmware.com --- arch/x86/kernel/kprobes/core.c | 42 ++++++++++++++++++++---------------------- 1 file changed, 20 insertions(+), 22 deletions(-)
diff --git a/arch/x86/kernel/kprobes/core.c b/arch/x86/kernel/kprobes/core.c index df9be5b91270..1f5c47a49e35 100644 --- a/arch/x86/kernel/kprobes/core.c +++ b/arch/x86/kernel/kprobes/core.c @@ -411,25 +411,38 @@ void free_insn_page(void *page) module_memfree(page); }
+/* Prepare reljump right after instruction to boost */ +static void prepare_boost(struct kprobe *p, int length) +{ + if (can_boost(p->ainsn.insn, p->addr) && + MAX_INSN_SIZE - length >= RELATIVEJUMP_SIZE) { + /* + * These instructions can be executed directly if it + * jumps back to correct address. + */ + synthesize_reljump(p->ainsn.insn + length, p->addr + length); + p->ainsn.boostable = 1; + } else { + p->ainsn.boostable = -1; + } +} + static int arch_copy_kprobe(struct kprobe *p) { - int ret; + int len;
set_memory_rw((unsigned long)p->ainsn.insn & PAGE_MASK, 1);
/* Copy an instruction with recovering if other optprobe modifies it.*/ - ret = __copy_instruction(p->ainsn.insn, p->addr); - if (!ret) + len = __copy_instruction(p->ainsn.insn, p->addr); + if (!len) return -EINVAL;
/* * __copy_instruction can modify the displacement of the instruction, * but it doesn't affect boostable check. */ - if (can_boost(p->ainsn.insn, p->addr)) - p->ainsn.boostable = 0; - else - p->ainsn.boostable = -1; + prepare_boost(p, len);
set_memory_ro((unsigned long)p->ainsn.insn & PAGE_MASK, 1);
@@ -894,21 +907,6 @@ static void resume_execution(struct kprobe *p, struct pt_regs *regs, break; }
- if (p->ainsn.boostable == 0) { - if ((regs->ip > copy_ip) && - (regs->ip - copy_ip) + 5 < MAX_INSN_SIZE) { - /* - * These instructions can be executed directly if it - * jumps back to correct address. - */ - synthesize_reljump((void *)regs->ip, - (void *)orig_ip + (regs->ip - copy_ip)); - p->ainsn.boostable = 1; - } else { - p->ainsn.boostable = -1; - } - } - regs->ip += orig_ip - copy_ip;
no_change: