linux-kernel - Re: [GIT PULL] uprobes: fix the handling of relative jmp/call's

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 18 Apr 2014 10:35:10 +0200
From:	Ingo Molnar <mingo@...nel.org>
To:	Oleg Nesterov <oleg@...hat.com>
Cc:	Ingo Molnar <mingo@...e.hu>,
	Ananth N Mavinakayanahalli <ananth@...ibm.com>,
	Anton Arapov <aarapov@...hat.com>,
	David Long <dave.long@...aro.org>,
	Denys Vlasenko <dvlasenk@...hat.com>,
	"Frank Ch. Eigler" <fche@...hat.com>,
	Jim Keniston <jkenisto@...ibm.com>,
	Jonathan Lebon <jlebon@...hat.com>,
	Masami Hiramatsu <masami.hiramatsu.pt@...achi.com>,
	Srikar Dronamraju <srikar@...ux.vnet.ibm.com>,
	linux-kernel@...r.kernel.org
Subject: Re: [GIT PULL] uprobes: fix the handling of relative jmp/call's


* Oleg Nesterov <oleg@...hat.com> wrote:

> Ingo, please pull from
> 
>   git://git.kernel.org/pub/scm/linux/kernel/git/oleg/misc uprobes/core
> 
> 
> To remind, we have a serious bug. Any probed jmp/call can kill the
> application, see the changelog in 11/15.
> 
> I tried to test this as much as possible, seems to work. I also wrote
> the test-case which explicitly checks every conditional jump with all
> possible bits combinations in eflags:
> 
> 	#include <asm/processor-flags.h>
> 	#include <stdio.h>
> 
> 	static int nojmp;
> 
> 	#define __MK_FUNC(opc, name)				\
> 		asm (						\
> 			".text\n"				\
> 			".globl " #name "; " #name ":\n"	\
> 			".byte 0x" #opc "\n"			\
> 			".byte 0x0a \n"	/* offs to 1f below */	\
> 			"movl $1, nojmp(%rip)\n"		\
> 			"1: ret\n"				\
> 		);						\
> 
> 	#define MK_FUNC(opc)	__MK_FUNC(opc, probe_func_ ## opc)
> 
> 	MK_FUNC(70) MK_FUNC(71) MK_FUNC(72) MK_FUNC(73)
> 	MK_FUNC(74) MK_FUNC(75) MK_FUNC(76) MK_FUNC(77)
> 	MK_FUNC(78) MK_FUNC(79) MK_FUNC(7a) MK_FUNC(7b)
> 	MK_FUNC(7c) MK_FUNC(7d) MK_FUNC(7e) MK_FUNC(7f)
> 
> 
> 	#define __CALL(flags, func)	\
> 		asm volatile ("pushf; push %0; popf; call " #func "; popf"	\
> 				: : "m" (flags) : "memory");
> 
> 	#define CALL(opc)		\
> 	({						\
> 		nojmp = 0;				\
> 		__CALL(flags, probe_func_ ## opc);	\
> 		!nojmp;					\
> 	})
> 
> 	long test_flags(unsigned long flags)
> 	{
> 		printf("%04lx %d %d %d %d %d %d %d %d %d %d %d %d %d %d %d %d\n",
> 			flags,
> 			CALL(70), CALL(71), CALL(72), CALL(73),
> 			CALL(74), CALL(75), CALL(76), CALL(77),
> 			CALL(78), CALL(79), CALL(7a), CALL(7b),
> 			CALL(7c), CALL(7d), CALL(7e), CALL(7f));
> 
> 		return 0;
> 	}
> 
> 	#define XF(xf)		(X86_EFLAGS_ ## xf)
> 	#define XF_MASK		(XF(CF) | XF(OF) | XF(PF) | XF(SF) | XF(ZF))
> 
> 	int main(void)
> 	{
> 		unsigned int bits;
> 		unsigned long __flags, flags;
> 
> 		asm volatile("pushf; pop %0" : "=rm" (__flags) : : "memory");
> 
> 		for (bits = 0; bits < (1 << 5); bits++) {
> 			flags = __flags & ~XF_MASK;
> 
> 			#define	CPY_BIT(nr, xf) \
> 				if (bits & (1 << nr)) flags |= XF(xf)
> 
> 			CPY_BIT(0, CF);
> 			CPY_BIT(1, OF);
> 			CPY_BIT(2, PF);
> 			CPY_BIT(3, SF);
> 			CPY_BIT(4, ZF);
> 
> 			test_flags(flags);
> 		}
> 
> 		return 0;
> 	}
> 
> The output is the same with probe_func_70..probe_func_7f probed.
> 
> This series only fixes the problem. I'll send more changes to address
> some of TODO's mentioned in the changelogs later. In particular, we
> need to do something with "callw", see "Note: in 13/15.
> 
> Oleg Nesterov (15):
>       uprobes: Kill UPROBE_SKIP_SSTEP and can_skip_sstep()
>       uprobes/x86: Fold prepare_fixups() into arch_uprobe_analyze_insn()
>       uprobes/x86: Kill the "ia32_compat" check in handle_riprel_insn(), remove "mm" arg
>       uprobes/x86: Gather "riprel" functions together
>       uprobes/x86: move the UPROBE_FIX_{RIP,IP,CALL} code at the end of pre/post hooks
>       uprobes/x86: Introduce uprobe_xol_ops and arch_uprobe->ops
>       uprobes/x86: Conditionalize the usage of handle_riprel_insn()
>       uprobes/x86: Send SIGILL if arch_uprobe_post_xol() fails
>       uprobes/x86: Teach arch_uprobe_post_xol() to restart if possible
>       uprobes/x86: Introduce sizeof_long(), cleanup adjust_ret_addr() and arch_uretprobe_hijack_return_addr()
>       uprobes/x86: Emulate unconditional relative jmp's
>       uprobes/x86: Emulate nop's using ops->emulate()
>       uprobes/x86: Emulate relative call's
>       uprobes/x86: Emulate relative conditional "short" jmp's
>       uprobes/x86: Emulate relative conditional "near" jmp's
> 
>  arch/x86/include/asm/uprobes.h |   16 +-
>  arch/x86/kernel/uprobes.c      |  551 +++++++++++++++++++++++++---------------
>  kernel/events/uprobes.c        |   31 +--
>  3 files changed, 372 insertions(+), 226 deletions(-)

Pulled into tip:perf/core, thanks a lot Oleg!

	Ingo
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/