From: Masami Hiramatsu <mhiramat@kernel.org>
To: Steven Rostedt <rostedt@goodmis.org>,
Josh Poimboeuf <jpoimboe@redhat.com>,
Ingo Molnar <mingo@kernel.org>
Cc: X86 ML <x86@kernel.org>, Masami Hiramatsu <mhiramat@kernel.org>,
Daniel Xu <dxu@dxuuu.xyz>,
linux-kernel@vger.kernel.org, bpf@vger.kernel.org,
kuba@kernel.org, mingo@redhat.com, ast@kernel.org,
Thomas Gleixner <tglx@linutronix.de>,
Borislav Petkov <bp@alien8.de>,
Peter Zijlstra <peterz@infradead.org>,
kernel-team@fb.com, yhs@fb.com, linux-ia64@vger.kernel.org,
Abhishek Sagar <sagar.abhishek@gmail.com>,
Andrii Nakryiko <andrii.nakryiko@gmail.com>,
Paul McKenney <paulmck@kernel.org>
Subject: [PATCH -tip v11 24/27] x86/kprobes: Push a fake return address at kretprobe_trampoline
Date: Tue, 14 Sep 2021 23:42:22 +0900 [thread overview]
Message-ID: <163163054185.489837.14338744048957727386.stgit@devnote2> (raw)
In-Reply-To: <163163030719.489837.2236069935502195491.stgit@devnote2>
Change __kretprobe_trampoline() to push the address of the
__kretprobe_trampoline() as a fake return address at the bottom
of the stack frame. This fake return address will be replaced
with the correct return address in the trampoline_handler().
With this change, the ORC unwinder can check whether the return
address is modified by kretprobes or not.
Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
Suggested-by: Josh Poimboeuf <jpoimboe@redhat.com>
Tested-by: Andrii Nakryiko <andrii@kernel.org>
Acked-by: Josh Poimboeuf <jpoimboe@redhat.com>
---
Changes in v9:
- Update changelog and comment.
- Remove unneeded type casting.
---
arch/x86/kernel/kprobes/core.c | 34 +++++++++++++++++++++++++---------
1 file changed, 25 insertions(+), 9 deletions(-)
diff --git a/arch/x86/kernel/kprobes/core.c b/arch/x86/kernel/kprobes/core.c
index d1436d7463fd..7e1111c19605 100644
--- a/arch/x86/kernel/kprobes/core.c
+++ b/arch/x86/kernel/kprobes/core.c
@@ -1022,28 +1022,33 @@ asm(
".global __kretprobe_trampoline\n"
".type __kretprobe_trampoline, @function\n"
"__kretprobe_trampoline:\n"
- /* We don't bother saving the ss register */
#ifdef CONFIG_X86_64
- " pushq %rsp\n"
+ /* Push a fake return address to tell the unwinder it's a kretprobe. */
+ " pushq $__kretprobe_trampoline\n"
UNWIND_HINT_FUNC
+ /* Save the 'sp - 8', this will be fixed later. */
+ " pushq %rsp\n"
" pushfq\n"
SAVE_REGS_STRING
" movq %rsp, %rdi\n"
" call trampoline_handler\n"
- /* Replace saved sp with true return address. */
- " movq %rax, 19*8(%rsp)\n"
RESTORE_REGS_STRING
+ /* In trampoline_handler(), 'regs->flags' is copied to 'regs->sp'. */
+ " addq $8, %rsp\n"
" popfq\n"
#else
- " pushl %esp\n"
+ /* Push a fake return address to tell the unwinder it's a kretprobe. */
+ " pushl $__kretprobe_trampoline\n"
UNWIND_HINT_FUNC
+ /* Save the 'sp - 4', this will be fixed later. */
+ " pushl %esp\n"
" pushfl\n"
SAVE_REGS_STRING
" movl %esp, %eax\n"
" call trampoline_handler\n"
- /* Replace saved sp with true return address. */
- " movl %eax, 15*4(%esp)\n"
RESTORE_REGS_STRING
+ /* In trampoline_handler(), 'regs->flags' is copied to 'regs->sp'. */
+ " addl $4, %esp\n"
" popfl\n"
#endif
" ret\n"
@@ -1063,8 +1068,10 @@ STACK_FRAME_NON_STANDARD_FP(__kretprobe_trampoline);
/*
* Called from __kretprobe_trampoline
*/
-__used __visible void *trampoline_handler(struct pt_regs *regs)
+__used __visible void trampoline_handler(struct pt_regs *regs)
{
+ unsigned long *frame_pointer;
+
/* fixup registers */
regs->cs = __KERNEL_CS;
#ifdef CONFIG_X86_32
@@ -1072,8 +1079,17 @@ __used __visible void *trampoline_handler(struct pt_regs *regs)
#endif
regs->ip = (unsigned long)&__kretprobe_trampoline;
regs->orig_ax = ~0UL;
+ regs->sp += sizeof(long);
+ frame_pointer = ®s->sp + 1;
+
+ /* Replace fake return address with real one. */
+ *frame_pointer = kretprobe_trampoline_handler(regs, frame_pointer);
- return (void *)kretprobe_trampoline_handler(regs, ®s->sp);
+ /*
+ * Copy FLAGS to 'pt_regs::sp' so that __kretprobe_trapmoline()
+ * can do RET right after POPF.
+ */
+ regs->sp = regs->flags;
}
NOKPROBE_SYMBOL(trampoline_handler);
next prev parent reply other threads:[~2021-09-14 14:43 UTC|newest]
Thread overview: 38+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-09-14 14:38 [PATCH -tip v11 00/27] kprobes: Fix stacktrace with kretprobes on x86 Masami Hiramatsu
2021-09-14 14:38 ` [PATCH -tip v11 01/27] kprobes: Do not use local variable when creating debugfs file Masami Hiramatsu
2021-09-14 14:38 ` [PATCH -tip v11 02/27] kprobes: Use helper to parse boolean input from userspace Masami Hiramatsu
2021-09-14 14:38 ` [PATCH -tip v11 03/27] kprobe: Simplify prepare_kprobe() by dropping redundant version Masami Hiramatsu
2021-09-14 14:39 ` [PATCH -tip v11 04/27] csky: ftrace: Drop duplicate implementation of arch_check_ftrace_location() Masami Hiramatsu
2021-09-14 14:39 ` [PATCH -tip v11 05/27] kprobes: Make arch_check_ftrace_location static Masami Hiramatsu
2021-09-14 14:39 ` [PATCH -tip v11 06/27] kprobes: treewide: Cleanup the error messages for kprobes Masami Hiramatsu
2021-09-14 14:39 ` [PATCH -tip v11 07/27] kprobes: Fix coding style issues Masami Hiramatsu
2021-09-14 14:39 ` [PATCH -tip v11 08/27] kprobes: Use IS_ENABLED() instead of kprobes_built_in() Masami Hiramatsu
2021-09-14 14:39 ` [PATCH -tip v11 09/27] kprobes: Add assertions for required lock Masami Hiramatsu
2021-09-14 14:40 ` [PATCH -tip v11 10/27] kprobes: treewide: Use 'kprobe_opcode_t *' for the code address in get_optimized_kprobe() Masami Hiramatsu
2021-09-14 14:40 ` [PATCH -tip v11 11/27] kprobes: Use bool type for functions which returns boolean value Masami Hiramatsu
2021-09-14 14:40 ` [PATCH -tip v11 12/27] ia64: kprobes: Fix to pass correct trampoline address to the handler Masami Hiramatsu
2021-09-14 14:40 ` [PATCH -tip v11 13/27] kprobes: treewide: Replace arch_deref_entry_point() with dereference_symbol_descriptor() Masami Hiramatsu
2021-09-14 14:40 ` [PATCH -tip v11 14/27] kprobes: treewide: Remove trampoline_address from kretprobe_trampoline_handler() Masami Hiramatsu
2021-09-14 14:40 ` [PATCH -tip v11 15/27] kprobes: treewide: Make it harder to refer kretprobe_trampoline directly Masami Hiramatsu
2021-09-14 14:41 ` [PATCH -tip v11 16/27] kprobes: Add kretprobe_find_ret_addr() for searching return address Masami Hiramatsu
2021-09-14 14:41 ` [PATCH -tip v11 17/27] objtool: Add frame-pointer-specific function ignore Masami Hiramatsu
2021-09-14 14:41 ` [PATCH -tip v11 18/27] objtool: Ignore unwind hints for ignored functions Masami Hiramatsu
2021-09-14 14:41 ` [PATCH -tip v11 19/27] x86/kprobes: Add UNWIND_HINT_FUNC on kretprobe_trampoline() Masami Hiramatsu
2021-09-14 14:41 ` [PATCH -tip v11 20/27] ARC: Add instruction_pointer_set() API Masami Hiramatsu
2021-09-14 14:41 ` [PATCH -tip v11 21/27] ia64: " Masami Hiramatsu
2021-09-14 14:42 ` [PATCH -tip v11 22/27] arm: kprobes: Make space for instruction pointer on stack Masami Hiramatsu
2021-09-14 14:42 ` [PATCH -tip v11 23/27] kprobes: Enable stacktrace from pt_regs in kretprobe handler Masami Hiramatsu
2021-09-14 14:42 ` Masami Hiramatsu [this message]
2021-09-14 14:42 ` [PATCH -tip v11 25/27] x86/unwind: Recover kretprobe trampoline entry Masami Hiramatsu
2021-09-14 14:42 ` [PATCH -tip v11 26/27] tracing: Show kretprobe unknown indicator only for kretprobe_trampoline Masami Hiramatsu
2021-09-14 14:42 ` [PATCH -tip v11 27/27] x86/kprobes: Fixup return address in generic trampoline handler Masami Hiramatsu
2021-09-14 22:55 ` [PATCH -tip v11 00/27] kprobes: Fix stacktrace with kretprobes on x86 Andrii Nakryiko
2021-09-29 2:24 ` Masami Hiramatsu
2021-09-30 18:17 ` Alexei Starovoitov
2021-09-30 19:34 ` Thomas Gleixner
2021-09-30 21:22 ` Steven Rostedt
2021-09-30 23:11 ` Thomas Gleixner
2021-09-30 23:27 ` Masami Hiramatsu
2021-09-30 23:37 ` Steven Rostedt
2021-10-01 0:35 ` Masami Hiramatsu
2021-09-30 23:54 ` Masami Hiramatsu
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=163163054185.489837.14338744048957727386.stgit@devnote2 \
--to=mhiramat@kernel.org \
--cc=andrii.nakryiko@gmail.com \
--cc=ast@kernel.org \
--cc=bp@alien8.de \
--cc=bpf@vger.kernel.org \
--cc=dxu@dxuuu.xyz \
--cc=jpoimboe@redhat.com \
--cc=kernel-team@fb.com \
--cc=kuba@kernel.org \
--cc=linux-ia64@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mingo@kernel.org \
--cc=mingo@redhat.com \
--cc=paulmck@kernel.org \
--cc=peterz@infradead.org \
--cc=rostedt@goodmis.org \
--cc=sagar.abhishek@gmail.com \
--cc=tglx@linutronix.de \
--cc=x86@kernel.org \
--cc=yhs@fb.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).