lkml.org 
[lkml]   [2022]   [Oct]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 6.0 622/862] powerpc/kprobes: Fix null pointer reference in arch_prepare_kprobe()
    Date
    From: Li Huafei <lihuafei1@huawei.com>

    [ Upstream commit 97f88a3d723162781d6cbfdc7b9617eefab55b19 ]

    I found a null pointer reference in arch_prepare_kprobe():

    # echo 'p cmdline_proc_show' > kprobe_events
    # echo 'p cmdline_proc_show+16' >> kprobe_events
    Kernel attempted to read user page (0) - exploit attempt? (uid: 0)
    BUG: Kernel NULL pointer dereference on read at 0x00000000
    Faulting instruction address: 0xc000000000050bfc
    Oops: Kernel access of bad area, sig: 11 [#1]
    LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=2048 NUMA PowerNV
    Modules linked in:
    CPU: 0 PID: 122 Comm: sh Not tainted 6.0.0-rc3-00007-gdcf8e5633e2e #10
    NIP: c000000000050bfc LR: c000000000050bec CTR: 0000000000005bdc
    REGS: c0000000348475b0 TRAP: 0300 Not tainted (6.0.0-rc3-00007-gdcf8e5633e2e)
    MSR: 9000000000009033 <SF,HV,EE,ME,IR,DR,RI,LE> CR: 88002444 XER: 20040006
    CFAR: c00000000022d100 DAR: 0000000000000000 DSISR: 40000000 IRQMASK: 0
    ...
    NIP arch_prepare_kprobe+0x10c/0x2d0
    LR arch_prepare_kprobe+0xfc/0x2d0
    Call Trace:
    0xc0000000012f77a0 (unreliable)
    register_kprobe+0x3c0/0x7a0
    __register_trace_kprobe+0x140/0x1a0
    __trace_kprobe_create+0x794/0x1040
    trace_probe_create+0xc4/0xe0
    create_or_delete_trace_kprobe+0x2c/0x80
    trace_parse_run_command+0xf0/0x210
    probes_write+0x20/0x40
    vfs_write+0xfc/0x450
    ksys_write+0x84/0x140
    system_call_exception+0x17c/0x3a0
    system_call_vectored_common+0xe8/0x278
    --- interrupt: 3000 at 0x7fffa5682de0
    NIP: 00007fffa5682de0 LR: 0000000000000000 CTR: 0000000000000000
    REGS: c000000034847e80 TRAP: 3000 Not tainted (6.0.0-rc3-00007-gdcf8e5633e2e)
    MSR: 900000000280f033 <SF,HV,VEC,VSX,EE,PR,FP,ME,IR,DR,RI,LE> CR: 44002408 XER: 00000000

    The address being probed has some special:

    cmdline_proc_show: Probe based on ftrace
    cmdline_proc_show+16: Probe for the next instruction at the ftrace location

    The ftrace-based kprobe does not generate kprobe::ainsn::insn, it gets
    set to NULL. In arch_prepare_kprobe() it will check for:

    ...
    prev = get_kprobe(p->addr - 1);
    preempt_enable_no_resched();
    if (prev && ppc_inst_prefixed(ppc_inst_read(prev->ainsn.insn))) {
    ...

    If prev is based on ftrace, 'ppc_inst_read(prev->ainsn.insn)' will occur
    with a null pointer reference. At this point prev->addr will not be a
    prefixed instruction, so the check can be skipped.

    Check if prev is ftrace-based kprobe before reading 'prev->ainsn.insn'
    to fix this problem.

    Fixes: b4657f7650ba ("powerpc/kprobes: Don't allow breakpoints on suffixes")
    Signed-off-by: Li Huafei <lihuafei1@huawei.com>
    [mpe: Trim oops]
    Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
    Link: https://lore.kernel.org/r/20220923093253.177298-1-lihuafei1@huawei.com
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    arch/powerpc/kernel/kprobes.c | 8 +++++++-
    1 file changed, 7 insertions(+), 1 deletion(-)

    diff --git a/arch/powerpc/kernel/kprobes.c b/arch/powerpc/kernel/kprobes.c
    index 912d4f8a13be..bd7b1a035459 100644
    --- a/arch/powerpc/kernel/kprobes.c
    +++ b/arch/powerpc/kernel/kprobes.c
    @@ -161,7 +161,13 @@ int arch_prepare_kprobe(struct kprobe *p)
    preempt_disable();
    prev = get_kprobe(p->addr - 1);
    preempt_enable_no_resched();
    - if (prev && ppc_inst_prefixed(ppc_inst_read(prev->ainsn.insn))) {
    +
    + /*
    + * When prev is a ftrace-based kprobe, we don't have an insn, and it
    + * doesn't probe for prefixed instruction.
    + */
    + if (prev && !kprobe_ftrace(prev) &&
    + ppc_inst_prefixed(ppc_inst_read(prev->ainsn.insn))) {
    printk("Cannot register a kprobe on the second word of prefixed instruction\n");
    ret = -EINVAL;
    }
    --
    2.35.1


    \
     
     \ /
      Last update: 2022-10-19 11:19    [W:2.507 / U:0.048 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site