lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Wed, 20 Apr 2016 09:13:54 +0800 From: Li Bin <huawei.libin@...wei.com> To: <ananth@...ibm.com>, <anil.s.keshavamurthy@...el.com>, <davem@...emloft.net>, <mhiramat@...nel.org>, <dave.long@...aro.org> CC: <linux-kernel@...r.kernel.org>, <wangnan0@...wei.com>, <guohanjun@...wei.com>, <dingtianhong@...wei.com>, <huawei.libin@...wei.com> Subject: [PATCH] kprobes: fix race condition in __unregister_kprobe_top In the following case, it will trigger kernel panic: 1. register a kprobe for one function 2. register a jprobe for the same function (to make it easier to reproduce, let the entry callback take a long time such as calling mdelay) 3. trigger the function be called, and then unregister the jprobe (before the entry callback calling jprobe_return) The reason is that in __unregister_kprobe_top (unregister_jprobe) the break_handler of the aggrprobe will be set NULL, but now the entry callback may has been triggered (before jprobe_return), and then in jprobe_return, it trigger int3/brk exception, in exception handler, because the break_handler has been set NULL, it will not setup_singlestep, and will return to the original instrucion... To fix this bug, __unregister_kprobe_top call the synchronize_sched() before clearing the handler. Signed-off-by: Li Bin <huawei.libin@...wei.com> --- kernel/kprobes.c | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) diff --git a/kernel/kprobes.c b/kernel/kprobes.c index d10ab6b..5b5dd68 100644 --- a/kernel/kprobes.c +++ b/kernel/kprobes.c @@ -1615,6 +1615,7 @@ static int __unregister_kprobe_top(struct kprobe *p) */ goto disarmed; else { + synchronize_sched(); /* If disabling probe has special handlers, update aggrprobe */ if (p->break_handler && !kprobe_gone(p)) ap->break_handler = NULL; -- 1.7.1
Powered by blists - more mailing lists