linux-kernel - Re: [PATCH tip/master v4] kprobes: extable: Identify kprobes' insn-slots as kernel text area

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 10 Jan 2017 10:11:01 +0900
From:   Masami Hiramatsu <mhiramat@...nel.org>
To:     Josh Poimboeuf <jpoimboe@...hat.com>
Cc:     Ingo Molnar <mingo@...hat.com>, linux-kernel@...r.kernel.org,
        Peter Zijlstra <peterz@...radead.org>,
        Ananth N Mavinakayanahalli <ananth@...ux.vnet.ibm.com>,
        Thomas Gleixner <tglx@...utronix.de>,
        "H . Peter Anvin" <hpa@...or.com>,
        Andrey Konovalov <andreyknvl@...gle.com>,
        Andy Lutomirski <luto@...nel.org>
Subject: Re: [PATCH tip/master v4] kprobes: extable: Identify kprobes'
 insn-slots as kernel text area

On Mon, 9 Jan 2017 11:36:48 -0600
Josh Poimboeuf <jpoimboe@...hat.com> wrote:

> On Sun, Jan 08, 2017 at 11:58:09PM +0900, Masami Hiramatsu wrote:
> > Make __kernel_text_address()/kernel_text_address() returns
> > true if the given address is on a kprobe's instruction slot,
> > which is generated by kprobes as a trampoline code.
> > This can help stacktraces to determine the address is on a
> > text area or not.
> > 
> > To implement this without any sleep in is_kprobe_*_slot(),
> > this also modify insn_cache page list as a rcu list. It may
> > increase processing deley (not processing time) for garbage
> > slot collection, because it requires to wait an additional
> > rcu grance period when freeing a page from the list.
> > However, since it is not a hot path, we may not take care of it.
> > 
> > Note: this can give a small overhead to stack unwinders because
> > this adds 2 checks in __kernel_text_address(). However, the
> > impact should be very small, kprobe_insn_pages list has 1 entry
> > per 256 probes(on x86, on arm/arm64 it will be 1024 probes),
> > and kprobe_optinsn_pages has 1 entry per 32 probes(on x86).
> > In most use cases, the number of kprobe events may be less
> > than 20, this means is_kprobe_*_slot() will check just 1 entry.
> > 
> > Signed-off-by: Masami Hiramatsu <mhiramat@...nel.org>
> 
> Thanks for doing this Masami!  I verified that it works:
> 
>   Tested-by: Josh Poimboeuf <jpoimboe@...hat.com>

Thanks!

> 
> I suspect that BPF generated code also has the same issue, so I'll leave
> the unwinder warning disabled for now.
> 
> BTW, I think we'll have more problems with generated code if/when we
> move to an x86 DWARF unwinder, because it won't have any idea how to
> unwind past generated code.  Long term I wonder if it would make sense
> to create some kind of framework for creating or registering generated
> code, so we can solve these types of problems in a single place.

Agreed. I think that can also help us to make the generated code RO :).

Thank you,

-- 
Masami Hiramatsu <mhiramat@...nel.org>