linux-kernel - Re: [RFC Patch 2/2][Bugfix][x86][hw-breakpoint] Fix return-code to notifier chain in hw_breakpoint

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 25 Jan 2010 23:11:04 +0100
From:	Frederic Weisbecker <fweisbec@...il.com>
To:	"K.Prasad" <prasad@...ux.vnet.ibm.com>
Cc:	LKML <linux-kernel@...r.kernel.org>, Ingo Molnar <mingo@...e.hu>,
	Alan Stern <stern@...land.harvard.edu>
Subject: Re: [RFC Patch 2/2][Bugfix][x86][hw-breakpoint] Fix return-code to
	notifier chain in hw_breakpoint_handler

On Sat, Dec 26, 2009 at 11:58:33PM +0530, K.Prasad wrote:
> The hw-breakpoint handler will return NOTIFY_DONE for user-space breakpoints
> to generate SIGTRAP signal (and not for kernel-space addresses). 


Please tell a bit more in your changelogs. It took me some time
to guess whether this is a fix or not.

And this is not a fix but an optimization because SIGTRAP
is only sent if needed.

Here is what happens in do_debug() after handling the
breakpoint:

	if (tsk->thread.debugreg6 & (DR_STEP | DR_TRAP_BITS))
		send_sigtrap(tsk, regs, error_code, si_code);

This can only happen if we took the ptrace handler path.

Also:


> Signed-off-by: K.Prasad <prasad@...ux.vnet.ibm.com>
> ---
>  arch/x86/kernel/hw_breakpoint.c |    9 +++++++--
>  1 file changed, 7 insertions(+), 2 deletions(-)
> 
> Index: linux-2.6-tip/arch/x86/kernel/hw_breakpoint.c
> ===================================================================
> --- linux-2.6-tip.orig/arch/x86/kernel/hw_breakpoint.c
> +++ linux-2.6-tip/arch/x86/kernel/hw_breakpoint.c
> @@ -502,8 +502,6 @@ static int __kprobes hw_breakpoint_handl
>  		rcu_read_lock();
>  
>  		bp = per_cpu(bp_per_reg[i], cpu);
> -		if (bp)
> -			rc = NOTIFY_DONE;
>  		/*
>  		 * Reset the 'i'th TRAP bit in dr6 to denote completion of
>  		 * exception handling
> @@ -517,6 +515,13 @@ static int __kprobes hw_breakpoint_handl
>  			rcu_read_unlock();
>  			break;
>  		}
> +		/*
> +		 * Further processing in do_debug() is needed for a) user-space
> +		 * breakpoints (to generate signals) and b) when the system has
> +		 * taken exception due to multiple causes
> +		 */
> +		if (bp->attr.bp_addr < TASK_SIZE)
> +			rc = NOTIFY_DONE;



Is that < TASK_SIZE an accurate check? We want support for
userspace breakpoints on perf tools later, and those don't want
signals.

We do this cleanup in the beginning of the breakpoint handler:

	current->thread.debugreg6 &= ~DR_TRAP_BITS;

And from ptrace.c:ptrace_triggered():

	thread->debugreg6 |= (DR_TRAP0 << i);

This is called on perf_bp_event().
Instead of checking if this is a userspace thread, we should actually
check if this is a ptrace breakpoint by looking at this
in the end of hw_breakpoint_handler().


	current->thread.debugreg6 & DR_TRAP_BITS


Only ptrace breakpoints require signals.

Thanks.

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/