[PATCH] arm: uprobes: Don't hook on thumb instructions

[PATCH] arm: uprobes: Don't hook on thumb instructions

[Fredrik Strupe]

Since uprobes is not supported for thumb, check that the thumb bit is
not set when matching the uprobes instruction hooks.

The Arm UDF instructions used for uprobes triggering
(UPROBE_SWBP_ARM_INSN and UPROBE_SS_ARM_INSN) coincidentally share the
same encoding as a pair of unallocated 32-bit thumb instructions (not
UDF) when the condition code is 0b1111 (0xf). This in effect makes it
possible to trigger the uprobes functionality from thumb, and at that
using two unallocated instructions which are not permanently undefined.

Signed-off-by: Fredrik Strupe <fredrik@strupe.net>
Fixes: c7edc9e326d5 ("ARM: add uprobes support")
---
 arch/arm/probes/uprobes/core.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/arm/probes/uprobes/core.c b/arch/arm/probes/uprobes/core.c
index c4b49b322e8a..f5f790c6e5f8 100644
--- a/arch/arm/probes/uprobes/core.c
+++ b/arch/arm/probes/uprobes/core.c
@@ -204,7 +204,7 @@ unsigned long uprobe_get_swbp_addr(struct pt_regs *regs)
 static struct undef_hook uprobes_arm_break_hook = {
 	.instr_mask	= 0x0fffffff,
 	.instr_val	= (UPROBE_SWBP_ARM_INSN & 0x0fffffff),
-	.cpsr_mask	= MODE_MASK,
+	.cpsr_mask	= (PSR_T_BIT | MODE_MASK),
 	.cpsr_val	= USR_MODE,
 	.fn		= uprobe_trap_handler,
 };
@@ -212,7 +212,7 @@ static struct undef_hook uprobes_arm_break_hook = {
 static struct undef_hook uprobes_arm_ss_hook = {
 	.instr_mask	= 0x0fffffff,
 	.instr_val	= (UPROBE_SS_ARM_INSN & 0x0fffffff),
-	.cpsr_mask	= MODE_MASK,
+	.cpsr_mask	= (PSR_T_BIT | MODE_MASK),
 	.cpsr_val	= USR_MODE,
 	.fn		= uprobe_trap_handler,
 };
-- 
2.20.1

Re: [PATCH] arm: uprobes: Don't hook on thumb instructions

[Marc Zyngier]

Hi Fredrik,

On  Mon, 18 May 2020, Fredrik Strupe wrote:
> Since uprobes is not supported for thumb, check that the thumb bit is
> not set when matching the uprobes instruction hooks.
>
> The Arm UDF instructions used for uprobes triggering
> (UPROBE_SWBP_ARM_INSN and UPROBE_SS_ARM_INSN) coincidentally share the
> same encoding as a pair of unallocated 32-bit thumb instructions (not
> UDF) when the condition code is 0b1111 (0xf). This in effect makes it
> possible to trigger the uprobes functionality from thumb, and at that
> using two unallocated instructions which are not permanently
> undefined.
>
> Signed-off-by: Fredrik Strupe <fredrik@strupe.net
> Fixes: c7edc9e326d5 ("ARM: add uprobes support")

It looks like we dropped the ball on this patch. Could you please add
it to Russell's patch system, together with a Cc: stable?

Otherwise, just say the word and I'll do it for you.

Thanks,

	M.

-- 
Without deviation from the norm, progress is not possible.