From: Guo Ren <guoren@kernel.org>
To: "Björn Töpel" <bjorn@kernel.org>
Cc: palmer@dabbelt.com, paul.walmsley@sifive.com,
mhiramat@kernel.org, conor.dooley@microchip.com,
penberg@kernel.org, mark.rutland@arm.com,
liaochang <liaochang1@huawei.com>,
linux-riscv@lists.infradead.org, linux-kernel@vger.kernel.org,
Guo Ren <guoren@linux.alibaba.com>
Subject: Re: [PATCH] riscv: kprobe: Fixup kernel panic when probing an illegal position
Date: Tue, 31 Jan 2023 21:01:42 +0800 [thread overview]
Message-ID: <CAJF2gTSnb4cvcXFvgkesgjuPOiZbcp4GZ2qJas4VWn68Pfsb9A@mail.gmail.com> (raw)
In-Reply-To: <878rhig9zj.fsf@all.your.base.are.belong.to.us>
On Tue, Jan 31, 2023 at 8:32 PM Björn Töpel <bjorn@kernel.org> wrote:
>
> guoren@kernel.org writes:
>
> > From: Guo Ren <guoren@linux.alibaba.com>
> >
> > The kernel would panic when probed for an illegal position. eg:
> >
> > (CONFIG_RISCV_ISA_C=n)
> >
> > echo 'p:hello kernel_clone+0x16 a0=%a0' >> kprobe_events
> > echo 1 > events/kprobes/hello/enable
> > cat trace
> >
> > Kernel panic - not syncing: stack-protector: Kernel stack
> > is corrupted in: __do_sys_newfstatat+0xb8/0xb8
> > CPU: 0 PID: 111 Comm: sh Not tainted
> > 6.2.0-rc1-00027-g2d398fe49a4d #490
> > Hardware name: riscv-virtio,qemu (DT)
> > Call Trace:
> > [<ffffffff80007268>] dump_backtrace+0x38/0x48
> > [<ffffffff80c5e83c>] show_stack+0x50/0x68
> > [<ffffffff80c6da28>] dump_stack_lvl+0x60/0x84
> > [<ffffffff80c6da6c>] dump_stack+0x20/0x30
> > [<ffffffff80c5ecf4>] panic+0x160/0x374
> > [<ffffffff80c6db94>] generic_handle_arch_irq+0x0/0xa8
> > [<ffffffff802deeb0>] sys_newstat+0x0/0x30
> > [<ffffffff800158c0>] sys_clone+0x20/0x30
> > [<ffffffff800039e8>] ret_from_syscall+0x0/0x4
> > ---[ end Kernel panic - not syncing: stack-protector:
> > Kernel stack is corrupted in: __do_sys_newfstatat+0xb8/0xb8 ]---
> >
> > That is because the kprobe's ebreak instruction broke the kernel's
> > original code. The user should guarantee the correction of the probe
> > position, but it couldn't make the kernel panic.
> >
> > This patch adds arch_check_kprobe in arch_prepare_kprobe to prevent an
> > illegal position (Such as the middle of an instruction).
>
> Nice!
>
> @liaochang Will you remove your patch from the OPTPROBE series?
>
> > Fixes: c22b0bcb1dd0 ("riscv: Add kprobes supported")
> > Signed-off-by: Guo Ren <guoren@linux.alibaba.com>
> > Signed-off-by: Guo Ren <guoren@kernel.org>
> > ---
> > arch/riscv/kernel/probes/kprobes.c | 18 ++++++++++++++++++
> > 1 file changed, 18 insertions(+)
> >
> > diff --git a/arch/riscv/kernel/probes/kprobes.c b/arch/riscv/kernel/probes/kprobes.c
> > index f21592d20306..475989f06d6d 100644
> > --- a/arch/riscv/kernel/probes/kprobes.c
> > +++ b/arch/riscv/kernel/probes/kprobes.c
> > @@ -48,6 +48,21 @@ static void __kprobes arch_simulate_insn(struct kprobe *p, struct pt_regs *regs)
> > post_kprobe_handler(p, kcb, regs);
> > }
> >
> > +static bool __kprobes arch_check_kprobe(struct kprobe *p)
> > +{
> > + unsigned long tmp = (unsigned long)p->addr - p->offset;
> > + unsigned long addr = (unsigned long)p->addr;
> > +
> > + while (tmp <= addr) {
> > + if (tmp == addr)
> > + return true;
> > +
> > + tmp += GET_INSN_LENGTH(*(kprobe_opcode_t *)tmp);
>
> kprobe_opcode_t is u32; This can trigger a misaligned load, right?
>
> > + }
> > +
> > + return false;
> > +}
> > +
> > int __kprobes arch_prepare_kprobe(struct kprobe *p)
> > {
> > unsigned long probe_addr = (unsigned long)p->addr;
> > @@ -55,6 +70,9 @@ int __kprobes arch_prepare_kprobe(struct kprobe *p)
> > if (probe_addr & 0x1)
> > return -EILSEQ;
> >
> > + if (!arch_check_kprobe(p))
> > + return -EILSEQ;
> > +
> > /* copy instruction */
> > p->opcode = *p->addr;
>
> Not related to your patch, but this can also trigger a misaligned load.
Yes, it would trigger a misaligned load.
What's the problem of that?
>
>
> Björn
--
Best Regards
Guo Ren
_______________________________________________
linux-riscv mailing list
linux-riscv@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-riscv
next prev parent reply other threads:[~2023-01-31 13:02 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-01-26 13:05 [PATCH] riscv: kprobe: Fixup kernel panic when probing an illegal position guoren
2023-01-28 2:55 ` liaochang (A)
2023-01-28 3:46 ` Guo Ren
2023-01-28 3:52 ` Guo Ren
2023-01-28 9:53 ` liaochang (A)
2023-01-28 5:22 ` Guo Ren
2023-01-28 9:53 ` liaochang (A)
2023-01-31 12:32 ` Björn Töpel
2023-01-31 13:01 ` Guo Ren [this message]
2023-02-01 2:57 ` Guo Ren
2023-02-01 9:30 ` Björn Töpel
2023-02-02 6:06 ` Guo Ren
2023-02-02 8:32 ` Björn Töpel
2023-02-01 3:49 ` liaochang (A)
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=CAJF2gTSnb4cvcXFvgkesgjuPOiZbcp4GZ2qJas4VWn68Pfsb9A@mail.gmail.com \
--to=guoren@kernel.org \
--cc=bjorn@kernel.org \
--cc=conor.dooley@microchip.com \
--cc=guoren@linux.alibaba.com \
--cc=liaochang1@huawei.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-riscv@lists.infradead.org \
--cc=mark.rutland@arm.com \
--cc=mhiramat@kernel.org \
--cc=palmer@dabbelt.com \
--cc=paul.walmsley@sifive.com \
--cc=penberg@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).