From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
	id S1752948AbbFEVlB (ORCPT <rfc822;w@1wt.eu>);
	Fri, 5 Jun 2015 17:41:01 -0400
Received: from mx1.redhat.com ([209.132.183.28]:60123 "EHLO mx1.redhat.com"
	rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP
	id S1751972AbbFEVlA (ORCPT <rfc822;linux-kernel@vger.kernel.org>);
	Fri, 5 Jun 2015 17:41:00 -0400
Date: Fri, 5 Jun 2015 23:40:03 +0200
From: Oleg Nesterov <oleg@redhat.com>
To: Ananth N Mavinakayanahalli <ananth@in.ibm.com>,
        Anton Arapov <arapov@gmail.com>, David Long <dave.long@linaro.org>,
        Denys Vlasenko <dvlasenk@redhat.com>,
        "Frank Ch. Eigler" <fche@redhat.com>, Ingo Molnar <mingo@kernel.org>,
        Jan Willeke <willeke@de.ibm.com>, Jim Keniston <jkenisto@us.ibm.com>,
        Mark Wielaard <mjw@redhat.com>, Pratyush Anand <panand@redhat.com>,
        Srikar Dronamraju <srikar@linux.vnet.ibm.com>
Cc: linux-kernel@vger.kernel.org
Subject: Re: [PATCH 09/10] uprobes: Change prepare_uretprobe() to (try to)
	flush the dead frames
Message-ID: <20150605214003.GA26264@redhat.com>
References: <20150504124835.GA22462@redhat.com> <20150504124922.GA22522@redhat.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20150504124922.GA22522@redhat.com>
User-Agent: Mutt/1.5.18 (2008-05-17)
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On 05/04, Oleg Nesterov wrote:
>
> --- a/kernel/events/uprobes.c
> +++ b/kernel/events/uprobes.c
> @@ -1522,6 +1522,16 @@ static unsigned long get_trampoline_vaddr(void)
>  	return trampoline_vaddr;
>  }
>  
> +static void cleanup_return_instances(struct uprobe_task *utask, struct pt_regs *regs)
> +{
> +	struct return_instance *ri = utask->return_instances;
> +	while (ri && !arch_uretprobe_is_alive(&ri->auret, regs)) {
> +		ri = free_ret_instance(ri);
> +		utask->depth--;
> +	}
> +	utask->return_instances = ri;
> +}
> +
>  static void prepare_uretprobe(struct uprobe *uprobe, struct pt_regs *regs)
>  {
>  	struct return_instance *ri;
> @@ -1576,6 +1586,9 @@ static void prepare_uretprobe(struct uprobe *uprobe, struct pt_regs *regs)
>  	ri->orig_ret_vaddr = orig_ret_vaddr;
>  	ri->chained = chained;
>  
> +	if (utask->depth) /* drop the entries invalidated by longjmp() */
> +		cleanup_return_instances(utask, regs);
> +

Self nack ;)

Note that that prepare_uretprobe() does

	if (orig_ret_vaddr == trampoline_vaddr) {
		if (!utask->return_instances) {
			/*
			 * This situation is not possible. Likely we have an
			 * attack from user-space.
			 */
			pr_warn("uprobe: unable to set uretprobe pid/tgid=%d/%d\n",
						current->pid, current->tgid);
			goto fail;

_before_ we do cleanup_return_instances().

This is actually fine in a sense that ->return_instances == NULL after
cleanup_return_instances() is not possible if chained, there should be
another _alive() frame. But malicious user can obviously fool the kernel.

Easy to fix. But after discussion with Srikar and Pratyush (thanks!) I
decided to update 6-10.

Oleg.