lkml.org 
[lkml]   [2021]   [Jun]   [25]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
Date
SubjectRe: [Phishing Risk] [PATCH] kprobe: fix kretprobe stack backtrace
On Fri, Jun 25, 2021 at 4:49 PM Qiang Wang
<wangqiang.wq.frank@bytedance.com> wrote:
>
> We found that we couldn't get the correct kernel stack from
> kretprobe. For example:
>
> bpftrace -e 'kr:submit_bio {print(kstack)}'
> Attaching 1 probe...
>
> kretprobe_trampoline+0
>
> kretprobe_trampoline+0
>
> The problem is caused by the wrong instruction register which
> points to the address of kretprobe_trampoline in regs.
> So we set the real return address in instruction register.
> Finally, we tested and successfully fixed it.
>
> bpftrace -e 'kr:submit_bio {print(kstack)}'
> Attaching 1 probe...
>
> ext4_mpage_readpages+475
> read_pages+139
> page_cache_ra_unbounded+417
> filemap_get_pages+245
> filemap_read+169
> __kernel_read+327
> bprm_execve+648
> do_execveat_common.isra.39+409
> __x64_sys_execve+50
> do_syscall_64+54
> entry_SYSCALL_64_after_hwframe+68
>
> Reported-by: Chengming Zhou <zhouchengming@bytedance.com>
> Signed-off-by: Qiang Wang <wangqiang.wq.frank@bytedance.com>

Seems like a bug. Maybe we should add a "Fixes" tag here.

> ---
> kernel/kprobes.c | 3 +++
> 1 file changed, 3 insertions(+)
>
> diff --git a/kernel/kprobes.c b/kernel/kprobes.c
> index 745f08fdd..1130381ca 100644
> --- a/kernel/kprobes.c
> +++ b/kernel/kprobes.c
> @@ -1899,6 +1899,9 @@ unsigned long __kretprobe_trampoline_handler(struct pt_regs *regs,
> current->kretprobe_instances.first = node->next;
> node->next = NULL;
>
> + /* Kretprobe handler expects address is the real return address */
> + instruction_pointer_set(regs, (unsigned long)correct_ret_addr);
> +
> /* Run them.. */
> while (first) {
> ri = container_of(first, struct kretprobe_instance, llist);
> --
> 2.20.1
>

\
 
 \ /
  Last update: 2021-06-25 12:25    [W:0.027 / U:0.200 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site