From: "Luis R. Rodriguez" <mcgrof@kernel.org>
To: Jessica Yu <jeyu@redhat.com>
Cc: Masami Hiramatsu <mhiramat@kernel.org>,
"Luis R. Rodriguez" <mcgrof@kernel.org>,
Ingo Molnar <mingo@kernel.org>,
Thomas Gleixner <tglx@linutronix.de>,
Steven Rostedt <rostedt@goodmis.org>,
Kees Cook <keescook@chromium.org>,
LKML <linux-kernel@vger.kernel.org>,
x86@kernel.org, Peter Zijlstra <peterz@infradead.org>,
Rusty Russell <rusty@rustcorp.com.au>,
Alexei Starovoitov <ast@kernel.org>,
Daniel Borkmann <daniel@iogearbox.net>
Subject: Re: [BUGFIX PATCH] kprobes/x86: Fix to set RWX bits correctly before releasing trampoline
Date: Thu, 1 Jun 2017 20:26:01 +0200 [thread overview]
Message-ID: <20170601182601.GM8951@wotan.suse.de> (raw)
In-Reply-To: <20170528014610.2rt2xmfv3fshqlov@jeyu>
On Sat, May 27, 2017 at 06:46:12PM -0700, Jessica Yu wrote:
> +++ Masami Hiramatsu [26/05/17 09:24 +0900]:
> > On Thu, 25 May 2017 19:24:26 +0200
> > "Luis R. Rodriguez" <mcgrof@kernel.org> wrote:
> >
> > > On Thu, May 25, 2017 at 07:38:17PM +0900, Masami Hiramatsu wrote:
> > > > Fix kprobes to set(recover) RWX bits correctly on trampoline
> > > > buffer before releasing it. Releasing readonly page to
> > > > module_memfree() crash the kernel.
> > > >
> > > > Without this fix, if kprobes user register a bunch of kprobes
> > > > in function body (since kprobes on function entry usually
> > > > use ftrace) and unregister it, kernel hits a BUG and crash.
> > > >
> > > > Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
> > > > Fixes: d0381c81c2f7 ("kprobes/x86: Set kprobes pages read-only")
> > > > ---
> > > > arch/x86/kernel/kprobes/core.c | 9 +++++++++
> > > > kernel/kprobes.c | 2 +-
> > > > 2 files changed, 10 insertions(+), 1 deletion(-)
> > > >
> > > > diff --git a/arch/x86/kernel/kprobes/core.c b/arch/x86/kernel/kprobes/core.c
> > > > index 5b2bbfb..6b87780 100644
> > > > --- a/arch/x86/kernel/kprobes/core.c
> > > > +++ b/arch/x86/kernel/kprobes/core.c
> > > > @@ -52,6 +52,7 @@
> > > > #include <linux/ftrace.h>
> > > > #include <linux/frame.h>
> > > > #include <linux/kasan.h>
> > > > +#include <linux/moduleloader.h>
> > > >
> > > > #include <asm/text-patching.h>
> > > > #include <asm/cacheflush.h>
> > > > @@ -417,6 +418,14 @@ static void prepare_boost(struct kprobe *p, struct insn *insn)
> > > > }
> > > > }
> > > >
> > > > +/* Recover page to RW mode before releasing it */
> > > > +void free_insn_page(void *page)
> > > > +{
> > > > + set_memory_nx((unsigned long)page & PAGE_MASK, 1);
> > > > + set_memory_rw((unsigned long)page & PAGE_MASK, 1);
> > > > + module_memfree(page);
> > > > +}
> > >
> > > Is this needed for all module_memfree() ? If so should / could it just do it
> > > for alloc users ?
> >
> > Hmm, would you mean setting those bits in module_memfree()?
> > I think it should be discussed with other users, kmodule, bpf and ftrace.
> > It could be, but I'm not so sure about that because setting nx
> > timing would be critical for some users. As far as I can see,
> > for ftrace and kprobes, that is OK.
>
> Memory does need to be rw before calling module_memfree(), although I
> think it might be better leave that responsibility/flexibility to the
> callers, instead of blanket calls to set_memory_rw/x. At least in the
> case of the module loader, we have finer-grained control of page
> protections; not all pages within the module_alloc'd region need
> set_memory_rw/x to be called before freeing (see disable_ro_nx() in
> module.c).
Is the module loader just a special case? If so then a special free, say
__module_memfree(), which *does* not the rw bit could be used by the module
loader ?
Luis
next prev parent reply other threads:[~2017-06-01 18:26 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-05-25 10:38 [BUGFIX PATCH] kprobes/x86: Fix to set RWX bits correctly before releasing trampoline Masami Hiramatsu
2017-05-25 17:24 ` Luis R. Rodriguez
2017-05-26 0:24 ` Masami Hiramatsu
2017-05-28 1:46 ` Jessica Yu
2017-06-01 18:26 ` Luis R. Rodriguez [this message]
2017-05-26 4:44 ` [PATCH] selftests/ftrace: Add a testcase for many kprobe events Masami Hiramatsu
2017-06-02 21:37 ` Shuah Khan
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20170601182601.GM8951@wotan.suse.de \
--to=mcgrof@kernel.org \
--cc=ast@kernel.org \
--cc=daniel@iogearbox.net \
--cc=jeyu@redhat.com \
--cc=keescook@chromium.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mhiramat@kernel.org \
--cc=mingo@kernel.org \
--cc=peterz@infradead.org \
--cc=rostedt@goodmis.org \
--cc=rusty@rustcorp.com.au \
--cc=tglx@linutronix.de \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).