From: Russell Currey <ruscur@russell.cc>
To: "Naveen N. Rao" <naveen.n.rao@linux.ibm.com>,
linuxppc-dev@lists.ozlabs.org
Cc: ajd@linux.ibm.com, dja@axtens.net,
kernel-hardening@lists.openwall.com, npiggin@gmail.com
Subject: Re: [PATCH v8 2/7] powerpc/kprobes: Mark newly allocated probes as RO
Date: Fri, 03 Apr 2020 20:42:14 +1100 [thread overview]
Message-ID: <02c6c3d0483e217a6d879bb7037f0b549c64ba04.camel@russell.cc> (raw)
In-Reply-To: <1585906281.fbqgtc3kpy.naveen@linux.ibm.com>
On Fri, 2020-04-03 at 15:06 +0530, Naveen N. Rao wrote:
> Russell Currey wrote:
> > On Fri, 2020-04-03 at 00:18 +0530, Naveen N. Rao wrote:
> > > Naveen N. Rao wrote:
> > > > Russell Currey wrote:
> > > > > With CONFIG_STRICT_KERNEL_RWX=y and CONFIG_KPROBES=y, there
> > > > > will
> > > > > be one
> > > > > W+X page at boot by default. This can be tested with
> > > > > CONFIG_PPC_PTDUMP=y and CONFIG_PPC_DEBUG_WX=y set, and
> > > > > checking
> > > > > the
> > > > > kernel log during boot.
> > > > >
> > > > > powerpc doesn't implement its own alloc() for kprobes like
> > > > > other
> > > > > architectures do, but we couldn't immediately mark RO anyway
> > > > > since we do
> > > > > a memcpy to the page we allocate later. After that, nothing
> > > > > should be
> > > > > allowed to modify the page, and write permissions are removed
> > > > > well
> > > > > before the kprobe is armed.
> > > > >
> > > > > The memcpy() would fail if >1 probes were allocated, so use
> > > > > patch_instruction() instead which is safe for RO.
> > > > >
> > > > > Reviewed-by: Daniel Axtens <dja@axtens.net>
> > > > > Signed-off-by: Russell Currey <ruscur@russell.cc>
> > > > > Signed-off-by: Christophe Leroy <christophe.leroy@c-s.fr>
> > > > > ---
> > > > > arch/powerpc/kernel/kprobes.c | 17 +++++++++++++----
> > > > > 1 file changed, 13 insertions(+), 4 deletions(-)
> > > > >
> > > > > diff --git a/arch/powerpc/kernel/kprobes.c
> > > > > b/arch/powerpc/kernel/kprobes.c
> > > > > index 81efb605113e..fa4502b4de35 100644
> > > > > --- a/arch/powerpc/kernel/kprobes.c
> > > > > +++ b/arch/powerpc/kernel/kprobes.c
> > > > > @@ -24,6 +24,8 @@
> > > > > #include <asm/sstep.h>
> > > > > #include <asm/sections.h>
> > > > > #include <linux/uaccess.h>
> > > > > +#include <linux/set_memory.h>
> > > > > +#include <linux/vmalloc.h>
> > > > >
> > > > > DEFINE_PER_CPU(struct kprobe *, current_kprobe) = NULL;
> > > > > DEFINE_PER_CPU(struct kprobe_ctlblk, kprobe_ctlblk);
> > > > > @@ -102,6 +104,16 @@ kprobe_opcode_t
> > > > > *kprobe_lookup_name(const
> > > > > char *name, unsigned int offset)
> > > > > return addr;
> > > > > }
> > > > >
> > > > > +void *alloc_insn_page(void)
> > > > > +{
> > > > > + void *page = vmalloc_exec(PAGE_SIZE);
> > > > > +
> > > > > + if (page)
> > > > > + set_memory_ro((unsigned long)page, 1);
> > > > > +
> > > > > + return page;
> > > > > +}
> > > > > +
> > > >
> > > > This crashes for me with KPROBES_SANITY_TEST during the
> > > > kretprobe
> > > > test.
> > >
> > > That isn't needed to reproduce this. After bootup, disabling
> > > optprobes
> > > also shows the crash with kretprobes:
> > > sysctl debug.kprobes-optimization=0
> > >
> > > The problem happens to be with patch_instruction() in
> > > arch_prepare_kprobe(). During boot, on kprobe init, we register a
> > > probe
> > > on kretprobe_trampoline for use with kretprobes (see
> > > arch_init_kprobes()). This results in an instruction slot being
> > > allocated, and arch_prepare_kprobe() to be called for copying
> > > the
> > > instruction (nop) at kretprobe_trampoline. patch_instruction()
> > > is
> > > failing resulting in corrupt instruction which we try to
> > > emulate/single
> > > step causing the crash.
> >
> > OK I think I've fixed it, KPROBES_SANITY_TEST passes too. I'd
> > appreciate it if you could test v9, and thanks again for finding
> > this -
> > very embarrassing bug on my side.
>
> Great! Thanks.
>
> I think I should also add appropriate error checking to kprobes' use
> of
> patch_instruction() which would have caught this much more easily.
Only kind of! It turns out that if the initial setup fails for
KPROBES_SANITY_TEST, it silently doesn't run - so you miss the "Kprobe
smoke test" text, but you don't get any kind of error either. I'll
send a patch so that it fails more loudly later.
>
> On a related note, I notice that x86 seems to prefer not having any
> RWX
> pages, and so they continue to do 'module_alloc()' followed by
> 'set_memory_ro()' and then 'set_memory_x()'. Is that something worth
> following for powerpc?
I just noticed that too. arm64 doesn't set theirs executable, as far
as I can tell powerpc doesn't need to.
>
> - Naveen
>
next prev parent reply other threads:[~2020-04-03 9:42 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-04-02 8:40 [PATCH v8 1/7] powerpc/mm: Implement set_memory() routines Russell Currey
2020-04-02 8:40 ` [PATCH v8 2/7] powerpc/kprobes: Mark newly allocated probes as RO Russell Currey
2020-04-02 16:16 ` Naveen N. Rao
2020-04-02 18:48 ` Naveen N. Rao
2020-04-02 23:02 ` Russell Currey
2020-04-03 7:59 ` Russell Currey
2020-04-03 9:36 ` Naveen N. Rao
2020-04-03 9:42 ` Russell Currey [this message]
2020-04-03 10:03 ` Naveen N. Rao
2020-04-02 8:40 ` [PATCH v8 3/7] powerpc/mm/ptdump: debugfs handler for W+X checks at runtime Russell Currey
2020-04-02 8:40 ` [PATCH v8 4/7] powerpc: Set ARCH_HAS_STRICT_MODULE_RWX Russell Currey
2020-04-02 8:40 ` [PATCH v8 5/7] powerpc/configs: Enable STRICT_MODULE_RWX in skiroot_defconfig Russell Currey
2020-04-02 8:40 ` [PATCH v8 6/7] powerpc/mm: implement set_memory_attr() Russell Currey
2020-04-02 8:40 ` [PATCH v8 7/7] powerpc/32: use set_memory_attr() Russell Currey
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=02c6c3d0483e217a6d879bb7037f0b549c64ba04.camel@russell.cc \
--to=ruscur@russell.cc \
--cc=ajd@linux.ibm.com \
--cc=dja@axtens.net \
--cc=kernel-hardening@lists.openwall.com \
--cc=linuxppc-dev@lists.ozlabs.org \
--cc=naveen.n.rao@linux.ibm.com \
--cc=npiggin@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).