Messages in this thread Patch in this message | | | Date | Mon, 6 Feb 2023 23:18:25 +0900 | From | Masami Hiramatsu (Google) <> | Subject | Re: [PATCH] x86/kprobes: Fix 1 byte conditional jump target |
| |
On Sat, 4 Feb 2023 21:08:07 +0000 Nadav Amit <nadav.amit@gmail.com> wrote:
> From: Nadav Amit <namit@vmware.com> > > Commit 3bc753c06dd0 ("kbuild: treat char as always unsigned") broke > kprobes. Setting a probe-point on 1 byte conditional jump can cause the > kernel to crash, as the branch target is not sign extended.
Oops, indeed!
> > Fix by using s8 instead of char and use immediate.value instead of > immediate.bytes for consistency.
Looks good to me. Thanks for finding this bug!
Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org> Fixes: 3bc753c06dd0 ("kbuild: treat char as always unsigned")
Thank you! > > Cc: Masami Hiramatsu (Google) <mhiramat@kernel.org> > Cc: Peter Zijlstra <peterz@infradead.org> > Signed-off-by: Nadav Amit <namit@vmware.com> > --- > arch/x86/kernel/kprobes/core.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/arch/x86/kernel/kprobes/core.c b/arch/x86/kernel/kprobes/core.c > index b36f3c367cb2..6a56d56b3817 100644 > --- a/arch/x86/kernel/kprobes/core.c > +++ b/arch/x86/kernel/kprobes/core.c > @@ -625,7 +625,7 @@ static int prepare_emulation(struct kprobe *p, struct insn *insn) > /* 1 byte conditional jump */ > p->ainsn.emulate_op = kprobe_emulate_jcc; > p->ainsn.jcc.type = opcode & 0xf; > - p->ainsn.rel32 = *(char *)insn->immediate.bytes; > + p->ainsn.rel32 = *(s8 *)&insn->immediate.value; > break; > case 0x0f: > opcode = insn->opcode.bytes[1]; > -- > 2.34.1 >
-- Masami Hiramatsu (Google) <mhiramat@kernel.org>
| |