Messages in this thread Patch in this message | | | From | Guo Ren <> | Date | Wed, 1 Feb 2023 10:57:43 +0800 | Subject | Re: [PATCH] riscv: kprobe: Fixup kernel panic when probing an illegal position |
| |
On Tue, Jan 31, 2023 at 8:32 PM Björn Töpel <bjorn@kernel.org> wrote: > > guoren@kernel.org writes: > > > From: Guo Ren <guoren@linux.alibaba.com> > > > > The kernel would panic when probed for an illegal position. eg: > > > > (CONFIG_RISCV_ISA_C=n) > > > > echo 'p:hello kernel_clone+0x16 a0=%a0' >> kprobe_events > > echo 1 > events/kprobes/hello/enable > > cat trace > > > > Kernel panic - not syncing: stack-protector: Kernel stack > > is corrupted in: __do_sys_newfstatat+0xb8/0xb8 > > CPU: 0 PID: 111 Comm: sh Not tainted > > 6.2.0-rc1-00027-g2d398fe49a4d #490 > > Hardware name: riscv-virtio,qemu (DT) > > Call Trace: > > [<ffffffff80007268>] dump_backtrace+0x38/0x48 > > [<ffffffff80c5e83c>] show_stack+0x50/0x68 > > [<ffffffff80c6da28>] dump_stack_lvl+0x60/0x84 > > [<ffffffff80c6da6c>] dump_stack+0x20/0x30 > > [<ffffffff80c5ecf4>] panic+0x160/0x374 > > [<ffffffff80c6db94>] generic_handle_arch_irq+0x0/0xa8 > > [<ffffffff802deeb0>] sys_newstat+0x0/0x30 > > [<ffffffff800158c0>] sys_clone+0x20/0x30 > > [<ffffffff800039e8>] ret_from_syscall+0x0/0x4 > > ---[ end Kernel panic - not syncing: stack-protector: > > Kernel stack is corrupted in: __do_sys_newfstatat+0xb8/0xb8 ]--- > > > > That is because the kprobe's ebreak instruction broke the kernel's > > original code. The user should guarantee the correction of the probe > > position, but it couldn't make the kernel panic. > > > > This patch adds arch_check_kprobe in arch_prepare_kprobe to prevent an > > illegal position (Such as the middle of an instruction). > > Nice! > > @liaochang Will you remove your patch from the OPTPROBE series? > > > Fixes: c22b0bcb1dd0 ("riscv: Add kprobes supported") > > Signed-off-by: Guo Ren <guoren@linux.alibaba.com> > > Signed-off-by: Guo Ren <guoren@kernel.org> > > --- > > arch/riscv/kernel/probes/kprobes.c | 18 ++++++++++++++++++ > > 1 file changed, 18 insertions(+) > > > > diff --git a/arch/riscv/kernel/probes/kprobes.c b/arch/riscv/kernel/probes/kprobes.c > > index f21592d20306..475989f06d6d 100644 > > --- a/arch/riscv/kernel/probes/kprobes.c > > +++ b/arch/riscv/kernel/probes/kprobes.c > > @@ -48,6 +48,21 @@ static void __kprobes arch_simulate_insn(struct kprobe *p, struct pt_regs *regs) > > post_kprobe_handler(p, kcb, regs); > > } > > > > +static bool __kprobes arch_check_kprobe(struct kprobe *p) > > +{ > > + unsigned long tmp = (unsigned long)p->addr - p->offset; > > + unsigned long addr = (unsigned long)p->addr; > > + > > + while (tmp <= addr) { > > + if (tmp == addr) > > + return true; > > + > > + tmp += GET_INSN_LENGTH(*(kprobe_opcode_t *)tmp); > > kprobe_opcode_t is u32; This can trigger a misaligned load, right? > > > + } > > + > > + return false; > > +} > > + > > int __kprobes arch_prepare_kprobe(struct kprobe *p) > > { > > unsigned long probe_addr = (unsigned long)p->addr; > > @@ -55,6 +70,9 @@ int __kprobes arch_prepare_kprobe(struct kprobe *p) > > if (probe_addr & 0x1) > > return -EILSEQ; > > > > + if (!arch_check_kprobe(p)) > > + return -EILSEQ; > > + > > /* copy instruction */ > > p->opcode = *p->addr; > > Not related to your patch, but this can also trigger a misaligned load. After rereading the spec, misaligned load/store is not mandatory supported. (Although my machines and qemu are correct)
So I need fixup:
diff --git a/arch/riscv/kernel/probes/kprobes.c b/arch/riscv/kernel/probes/kprobes.c index 27f8960c321c..0c016d496746 100644 --- a/arch/riscv/kernel/probes/kprobes.c +++ b/arch/riscv/kernel/probes/kprobes.c @@ -58,12 +58,14 @@ static bool __kprobes arch_check_kprobe(struct kprobe *p) { unsigned long tmp = (unsigned long)p->addr - p->offset; unsigned long addr = (unsigned long)p->addr; + kprobe_opcode_t opcode;
while (tmp <= addr) { if (tmp == addr) return true;
- tmp += GET_INSN_LENGTH(*(kprobe_opcode_t *)tmp); + memcpy(&opcode, (void *)tmp, sizeof(kprobe_opcode_t)); + tmp += GET_INSN_LENGTH(opcode); }
return false; @@ -80,7 +82,7 @@ int __kprobes arch_prepare_kprobe(struct kprobe *p) return -EILSEQ;
/* copy instruction */ - p->opcode = *p->addr; + memcpy(&p->opcode, p->addr, sizeof(kprobe_opcode_t));
/* decode instruction */ switch (riscv_probe_decode_insn(p->addr, &p->ainsn.api)) { > > > Björn
-- Best Regards Guo Ren
| |