linux-kernel - Re: [RFC PATCH v3 4/6] uretprobes: return probe entry, prepare uretprobe

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Sat, 2 Mar 2013 19:26:43 +0100
From:	Oleg Nesterov <oleg@...hat.com>
To:	Anton Arapov <anton@...hat.com>
Cc:	Srikar Dronamraju <srikar@...ux.vnet.ibm.com>,
	LKML <linux-kernel@...r.kernel.org>,
	Josh Stone <jistone@...hat.com>,
	Frank Eigler <fche@...hat.com>,
	Peter Zijlstra <peterz@...radead.org>,
	Ingo Molnar <mingo@...e.hu>,
	Ananth N Mavinakayanahalli <ananth@...ibm.com>
Subject: Re: [RFC PATCH v3 4/6] uretprobes: return probe entry, prepare
	uretprobe

On 02/28, Anton Arapov wrote:
>
> +static void prepare_uretprobe(struct uprobe *uprobe, struct pt_regs *regs)
> +{
> +	struct return_uprobe_i *ri;
> +	struct uprobe_task *utask;
> +	struct xol_area *area;
> +	unsigned long rp_trampoline_vaddr = 0;
> +	uprobe_opcode_t insn = UPROBE_SWBP_INSN;
> +
> +	area = get_xol_area();
> +	if (area)
> +		rp_trampoline_vaddr = area->rp_trampoline_vaddr;
> +	if (!rp_trampoline_vaddr) {
> +		rp_trampoline_vaddr = xol_get_insn_slot(&insn);
> +		if (!rp_trampoline_vaddr)
> +			return;
> +	}
> +	area->rp_trampoline_vaddr = rp_trampoline_vaddr;
> +
> +	ri = kzalloc(sizeof(struct return_uprobe_i), GFP_KERNEL);
> +	if (!ri)
> +		return;
> +
> +	utask = get_utask();
> +	ri->orig_ret_vaddr = arch_uretprobe_hijack_return_addr(rp_trampoline_vaddr, regs);
> +	if (likely(ri->orig_ret_vaddr)) {
> +		/* TODO: uretprobe bypass logic */
> +		atomic_inc(&uprobe->ref);

OK, but even this is not enough.

Once we inserted "int3" we must ensure that handle_swbp() will be
called even if this uprobe goes away. We have the reference but it
only protects uprobe itself, it can't protect agains delete_uprobe().

IOW, we must ensure that uprobe_pre_sstep_notifier() can't return 0.

So this patch needs the additional change in find_active_uprobe(),

	-	if (!uprobe && test_and_clear_bit(MMF_RECALC_UPROBES, &mm->flags))
	+	if (!uprobe && hlist_empty(->return_uprobes) &&
	+	    test_and_clear_bit(MMF_RECALC_UPROBES, &mm->flags))

Oleg.

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/