From: Chen Zhongjin <chenzhongjin@huawei.com>
To: <linux-arm-kernel@lists.infradead.org>,
<linux-kernel@vger.kernel.org>, <linux-arch@vger.kernel.org>
Cc: <naveen.n.rao@linux.ibm.com>, <anil.s.keshavamurthy@intel.com>,
<davem@davemloft.net>, <mhiramat@kernel.org>,
<chenzhongjin@huawei.com>
Subject: [PATCH] kprobes: Forbid probing on kprobe_insn_slot
Date: Wed, 27 Jul 2022 11:20:58 +0800 [thread overview]
Message-ID: <20220727032058.60444-1-chenzhongjin@huawei.com> (raw)
Syzkaller reported a BUG on arm64:
Unrecoverable kprobe detected.
Dumping kprobe:
Name: (null)
Offset: 0
Address: 0xffffa00010019000
------------[ cut here ]------------
kernel BUG at arch/arm64/kernel/probes/kprobes.c:235!
Internal error: Oops - BUG: 0 [#1] SMP
Modules linked in:
CPU: 1 PID: 31060 Comm: syz-executor.6 Not tainted 5.10.0 #11
...
Call trace:
reenter_kprobe arch/arm64/kernel/probes/kprobes.c:234 [inline]
kprobe_handler+0x23c/0x26c arch/arm64/kernel/probes/kprobes.c:339
kprobe_breakpoint_handler+0x24/0x34 arch/arm64/kernel/probes/kprobes.c:406
call_break_hook+0xf4/0x13c arch/arm64/kernel/debug-monitors.c:322
brk_handler+0x2c/0xa0 arch/arm64/kernel/debug-monitors.c:329
do_debug_exception+0x140/0x230 arch/arm64/mm/fault.c:867
el1_dbg+0x38/0x50 arch/arm64/kernel/entry-common.c:182
el1_sync_handler+0xf4/0x150 arch/arm64/kernel/entry-common.c:219
el1_sync+0x74/0x100 arch/arm64/kernel/entry.S:665
0xffffa00010019000
do_futex+0x2f4/0x370 kernel/futex.c:3735
__do_sys_futex kernel/futex.c:3798 [inline]
__se_sys_futex kernel/futex.c:3764 [inline]
__arm64_sys_futex+0x168/0x3a0 kernel/futex.c:3764
__invoke_syscall arch/arm64/kernel/syscall.c:36 [inline]
invoke_syscall arch/arm64/kernel/syscall.c:48 [inline]
el0_svc_common.constprop.0+0xf4/0x414 arch/arm64/kernel/syscall.c:155
do_el0_svc+0x50/0x11c arch/arm64/kernel/syscall.c:217
el0_svc+0x20/0x30 arch/arm64/kernel/entry-common.c:353
el0_sync_handler+0xe4/0x1e0 arch/arm64/kernel/entry-common.c:369
el0_sync+0x148/0x180 arch/arm64/kernel/entry.S:683
Code: 91018360 97ff1838 aa1703e0 97ff1fdf (d4210000)
---[ end trace 767503e946e01b15 ]---
Syzbot tried to porbe on a kprobe_insn_slot.
kprobe will replace instruciton with a break and store the origin one
on kprobe_insn_slot. However these slots are not in .kprobes.text and
exported by perf_event_ksymbol so can be probed by perf interface.
Probing these slots will triggers kprobe handler inside single step
process and for some architectures such as arm64 this will causes a
bug().
These slots are kprobe process so they should not be probed anyway.
Add kprobe_insn_slot check when register_kprobe to forbid probing on
these slots.
Signed-off-by: Chen Zhongjin <chenzhongjin@huawei.com>
---
kernel/kprobes.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/kernel/kprobes.c b/kernel/kprobes.c
index f214f8c088ed..3e798b62db70 100644
--- a/kernel/kprobes.c
+++ b/kernel/kprobes.c
@@ -1562,6 +1562,8 @@ static int check_kprobe_address_safe(struct kprobe *p,
/* Ensure it is not in reserved area nor out of text */
if (!kernel_text_address((unsigned long) p->addr) ||
within_kprobe_blacklist((unsigned long) p->addr) ||
+ is_kprobe_insn_slot((unsigned long) p->addr) ||
+ is_kprobe_optinsn_slot((unsigned long) p->addr) ||
jump_label_text_reserved(p->addr, p->addr) ||
static_call_text_reserved(p->addr, p->addr) ||
find_bug((unsigned long)p->addr)) {
--
2.17.1
next reply other threads:[~2022-07-27 3:23 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-07-27 3:20 Chen Zhongjin [this message]
2022-07-31 15:48 ` [PATCH] kprobes: Forbid probing on kprobe_insn_slot Masami Hiramatsu
2022-08-01 3:44 ` Chen Zhongjin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220727032058.60444-1-chenzhongjin@huawei.com \
--to=chenzhongjin@huawei.com \
--cc=anil.s.keshavamurthy@intel.com \
--cc=davem@davemloft.net \
--cc=linux-arch@vger.kernel.org \
--cc=linux-arm-kernel@lists.infradead.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mhiramat@kernel.org \
--cc=naveen.n.rao@linux.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).