linux-kernel - Re: FInal kprobes rollup patches

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 17 Dec 2007 16:28:28 -0500
From:	Masami Hiramatsu <mhiramat@...hat.com>
To:	Harvey Harrison <harvey.harrison@...il.com>
CC:	Srikar Dronamraju <srikar@...ux.vnet.ibm.com>,
	Ingo Molnar <mingo@...e.hu>,
	LKML <linux-kernel@...r.kernel.org>,
	Maneesh Soni <maneesh@...ux.vnet.ibm.com>,
	srinivasa@...ibm.com, Jim Keniston <jkenisto@...ibm.com>,
	Ananth N Mavinakayanahalli <ananth@...ibm.com>,
	Masami Hiramatsu <hiramatu@....hitachi.co.jp>,
	Rusty Lynch <rusty.lynch@...el.com>,
	Masami Hiramatsu <masami.hiramatsu.pt@...achi.com>,
	Keshavamurthy Anil S <anil.s.keshavamurthy@...el.com>
Subject: Re: FInal kprobes rollup patches

Hi Harvey,

Harvey Harrison wrote:
> On Mon, 2007-12-17 at 19:52 +0530, Srikar Dronamraju wrote:
>> * Ingo Molnar <mingo@...e.hu> [2007-12-15 14:12:04]:
>>
>>
>> Hi Ingo, Harvey
>>
>> In file include/asm-x86/kprobes_32.h
>> typedef u8 kprobe_opcode_t;
>> hence sizeof(kprobe_opcode_t) turns out to be 1.
>>
>> Hence
>>
>> memcpy(p->ainsn.insn, p->addr, MAX_INSN_SIZE * sizeof(kprobe_opcode_t));
>> is correct.
>>
> 
> OK, but this would be much clearer to adopt the X86_64 way, define
> MAX_INSN_SIZE one smaller and make this line:
> 
> /* Copy original instruction plus space for 1 byte relative jump */
> memcpy(p->ainsn.insn, p->addr, MAX_INSN_SIZE + sizeof(kprobe_opcode_t));
>
> See the first patch of my cleanup work that unified MAX_INSN_SIZE
> and you'll see why this jumped out.
>
> Harvey

If you mention about a relative jump which is inserted by
resume_execution(), I think you might misunderstand that relative jump.

The size of that relative jump, which will be embedded by kprobe-booster, is
5-bytes(not 1 byte). So it needs 5 bytes space.
And we decided not to expand MAX_INSN_SIZE when we developed the booster.
The reasons are:
 - it is supplemental feature(just accelerating kprobes), if we have no space,
   we can disable it.
 - 5 bytes are big enough compared with 15(=MAX_INSN_SIZE)
 - the lengths of most of instructions are less than 10 bytes.

Additionally, MAX_INSN_SIZE is used in kernel/kprobes.c to allocate an
instruction buffer which will be assigned to p->ainsn.insn. Since the
instruction buffer size is MAX_INSN_SIZE, you can not copy instructions
more than MAX_INSN_SIZE.

BTW, in my patch, I unified MAX_INSN_SIZE to bigger one(16).
I think it is enough for us.

Thanks,

Best Regards,

-- 
Masami Hiramatsu

Software Engineer
Hitachi Computer Products (America) Inc.
Software Solutions Division

e-mail: mhiramat@...hat.com, masami.hiramatsu.pt@...achi.com

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/