From: Adam Zabrocki <pi3@pi3.com.pl>
To: Kees Cook <keescook@chromium.org>
Cc: Masami Hiramatsu <mhiramat@kernel.org>,
Ingo Molnar <mingo@kernel.org>,
Steven Rostedt <rostedt@goodmis.org>,
Thomas Gleixner <tglx@linutronix.de>,
Ingo Molnar <mingo@redhat.com>, Borislav Petkov <bp@alien8.de>,
x86@kernel.org, "H . Peter Anvin" <hpa@zytor.com>,
linux-kernel@vger.kernel.org,
"Naveen N . Rao" <naveen.n.rao@linux.ibm.com>,
Anil S Keshavamurthy <anil.s.keshavamurthy@intel.com>,
"David S . Miller" <davem@davemloft.net>,
Solar Designer <solar@openwall.com>
Subject: Re: [PATCH] x86/kprobes: Fix optprobe to detect padding int3 correctly
Date: Fri, 11 Dec 2020 21:04:33 +0100 [thread overview]
Message-ID: <20201211200433.GA4773@pi3.com.pl> (raw)
In-Reply-To: <202012111139.948F2ECF1@keescook>
Hi,
I've applied this patch on the top of kernel 5.9.7 and verified it works
fine:
ffffffff813050e0 <ftrace_enable_sysctl>:
...
...
ffffffff813052f1: e9 fe fe ff ff jmpq ffffffff813051f4 <ftrace_enable_sysctl+0x114>
ffffffff813052f6: cc int3
ffffffff813052f7: cc int3
ffffffff813052f8: cc int3
ffffffff813052f9: cc int3
ffffffff813052fa: cc int3
ffffffff813052fb: cc int3
ffffffff813052fc: cc int3
ffffffff813052fd: cc int3
ffffffff813052fe: cc int3
ffffffff813052ff: cc int3
When I install KRETPROBE on this function, it is correctly optimized:
root@pi3:~/off-debug/git/lkrg# cat /sys/kernel/debug/kprobes/list|grep ftrace_enable_sysctl
ffffffff813050e0 r ftrace_enable_sysctl+0x0 [OPTIMIZED]
root@pi3:~/off-debug/git/lkrg#
gef➤ x/2i ftrace_enable_sysctl
0xffffffff813050e0 <ftrace_enable_sysctl>: jmp 0xffffffffc062807a
0xffffffff813050e5 <ftrace_enable_sysctl+5>: push r14
Thanks,
Adam
On Fri, Dec 11, 2020 at 11:39:15AM -0800, Kees Cook wrote:
> On Fri, Dec 11, 2020 at 04:04:17PM +0900, Masami Hiramatsu wrote:
> > Fix optprobe to detect padding int3 correctly.
> >
> > Since commit 7705dc855797 ("x86/vmlinux: Use INT3 instead of NOP
> > for linker fill bytes") changed the padding bytes between functions
> > from nop to int3, when optprobe decodes a target function it finds
> > int3 and gives up the jump optimization.
> >
> > Instead of giving up any int3 detection, this checks whether the
> > rest of bytes to the end of the function are int3 or not. If all
> > of those are int3, those come from the linker. In that case,
> > optprobe continues jump optimization.
> >
> > Fixes: 7705dc855797 ("x86/vmlinux: Use INT3 instead of NOP for linker fill bytes")
> > Cc: stable@vger.kernel.org
> > Reported-by: Adam Zabrocki <pi3@pi3.com.pl>
> > Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
>
> Reviewed-by: Kees Cook <keescook@chromium.org>
>
> --
> Kees Cook
--
pi3 (pi3ki31ny) - pi3 (at) itsec pl
http://pi3.com.pl
next prev parent reply other threads:[~2020-12-11 21:21 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-12-11 7:04 [PATCH] x86/kprobes: Fix optprobe to detect padding int3 correctly Masami Hiramatsu
2020-12-11 14:49 ` Steven Rostedt
2020-12-11 19:39 ` Kees Cook
2020-12-11 20:04 ` Adam Zabrocki [this message]
2020-12-12 14:38 ` [tip: x86/urgent] x86/kprobes: Fix optprobe to detect INT3 padding correctly tip-bot2 for Masami Hiramatsu
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20201211200433.GA4773@pi3.com.pl \
--to=pi3@pi3.com.pl \
--cc=anil.s.keshavamurthy@intel.com \
--cc=bp@alien8.de \
--cc=davem@davemloft.net \
--cc=hpa@zytor.com \
--cc=keescook@chromium.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mhiramat@kernel.org \
--cc=mingo@kernel.org \
--cc=mingo@redhat.com \
--cc=naveen.n.rao@linux.ibm.com \
--cc=rostedt@goodmis.org \
--cc=solar@openwall.com \
--cc=tglx@linutronix.de \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).