linux-kernel - Re: [PATCH v1 2/9] uretprobes: Reserve the first slot in xol

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 9 Apr 2013 16:16:15 +0200
From:	Oleg Nesterov <oleg@...hat.com>
To:	Srikar Dronamraju <srikar@...ux.vnet.ibm.com>
Cc:	Anton Arapov <anton@...hat.com>,
	LKML <linux-kernel@...r.kernel.org>,
	Josh Stone <jistone@...hat.com>,
	Frank Eigler <fche@...hat.com>,
	Peter Zijlstra <peterz@...radead.org>,
	Ingo Molnar <mingo@...e.hu>,
	Ananth N Mavinakayanahalli <ananth@...ibm.com>,
	adrian.m.negreanu@...el.com, Torsten.Polle@....de
Subject: Re: [PATCH v1 2/9] uretprobes: Reserve the first slot in xol_vma
	for trampoline

On 04/07, Srikar Dronamraju wrote:
>
> * Anton Arapov <anton@...hat.com> [2013-04-03 18:00:32]:
>
> > Allocate trampoline page, as the very first one in uprobed
> > task xol area, and fill it with breakpoint opcode.
> >
> > Also introduce get_trampoline_vaddr() helper, to wrap the
> > trampoline address extraction from area->vaddr. That removes
> > confusion and eases the debug experience in case ->vaddr
> > notion will be changed.
> >
> > v1 changes:
> > * rework get_trampoline_vaddr() helper.
> > * init xol_area->slot_count.
> >
> > Signed-off-by: Anton Arapov <anton@...hat.com>
>
> Acked-by: Srikar Dronamraju <srikar@...ux.vnet.ibm.com>

Thanks!

> > +static unsigned long get_trampoline_vaddr(void)
> > +{
> > +	struct xol_area *area;
> > +	unsigned long trampoline_vaddr = -1;
> > +
> > +	area = current->mm->uprobes_state.xol_area;
> > +	smp_read_barrier_depends();
>
> check: do we need this barrier?

In theory yes. For example, we do not want the false positive in
handle_swbp() which does

	if (bp_vaddr == get_trampoline_vaddr())
		handler_uretprobe();

In theory we can race with another thread which initializes area
(in particular area->vaddr) and then sets uprobes_state.xol_area = area
in xol_add_vma().

If we see ->xol_area != NULL we must ensure that we read the correct
value of area->vaddr, so we need a barrier.

In short. Please note get_xol_area()->smp_read_barrier_depends(),
get_trampoline_vaddr() needs it for the same reason.

Oleg.

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/