linux-kernel - Re: [RFC] [PATCH 2.6.37-rc5-tip 10/20] 10: uprobes: task specific information.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 25 Jan 2011 10:55:44 -0800 (PST)
From:	Roland McGrath <roland@...hat.com>
To:	Josh Stone <jistone@...hat.com>
Cc:	Peter Zijlstra <peterz@...radead.org>,
	Srikar Dronamraju <srikar@...ux.vnet.ibm.com>,
	Ingo Molnar <mingo@...e.hu>,
	Steven Rostedt <rostedt@...dmis.org>,
	Arnaldo Carvalho de Melo <acme@...radead.org>,
	Linus Torvalds <torvalds@...ux-foundation.org>,
	Masami Hiramatsu <masami.hiramatsu.pt@...achi.com>,
	Christoph Hellwig <hch@...radead.org>,
	Andi Kleen <andi@...stfloor.org>,
	Oleg Nesterov <oleg@...hat.com>,
	LKML <linux-kernel@...r.kernel.org>,
	SystemTap <systemtap@...rces.redhat.com>,
	Linux-mm <linux-mm@...r.kernel.org>,
	Jim Keniston <jkenisto@...ux.vnet.ibm.com>,
	Frederic Weisbecker <fweisbec@...il.com>,
	Ananth N Mavinakayanahalli <ananth@...ibm.com>,
	Andrew Morton <akpm@...ux-foundation.org>,
	"Paul E. McKenney" <paulmck@...ux.vnet.ibm.com>
Subject: Re: [RFC] [PATCH 2.6.37-rc5-tip 10/20] 10: uprobes: task specific information.

> On 01/25/2011 05:56 AM, Peter Zijlstra wrote:
> > Ah, I think I found it while reading patch 13, you need the pre/post_xol
> > callbacks, can't you simply synthesize their effect into the replacement
> > sequence?
> > 
> >   push %rax
> >   mov $vaddr, %rax
> >   $INSN
> >   pop %rax
> >   jmp $next_insn
> > 
> > like replacements would obviate the need for the pre/post callbacks and
> > allow you to run straight through.
> 
> For this particular example, you'd better be sure that $INSN doesn't
> need %rsp intact.

In general it is quite bad form to touch the user's stack at all for
instrumentation purposes.  Unexpected stack usage might be what you are
trying to debug, after all.

On x86-64 in particular, it is strictly verboten to touch the user's stack
immediately below the SP.  In the x86-64 ABI, the 128 bytes below %rsp are
a scratch area for leaf functions that normal compiled user code will use
to store data that must not be clobbered.  (Normal signal handler frames
start 128 bytes below %rsp for this reason.)

That's aside from the more obvious issues Josh mentioned, where the
instruction itself is a push/pop/call/ret or uses an addressing mode
relative to %rsp.


Thanks,
Roland
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/