| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <538786D8.1070303@in.ibm.com>
Date: Fri, 30 May 2014 00:43:28 +0530
From: "Suzuki K. Poulose" <suzuki@...ibm.com>
To: Masami Hiramatsu <masami.hiramatsu.pt@...achi.com>,
Benjamin Herrenschmidt <benh@...nel.crashing.org>,
Paul Mackerras <paulus@...ba.org>,
Tony Luck <tony.luck@...il.com>
CC: Jeremy Fitzhardinge <jeremy@...p.org>, linux-ia64@...r.kernel.org,
sparse@...isli.org, "H. Peter Anvin" <hpa@...or.com>,
akataria@...are.com, linux-tip-commits@...r.kernel.org,
anil.s.keshavamurthy@...el.com, Ingo Molnar <mingo@...nel.org>,
Fenghua Yu <fenghua.yu@...el.com>,
Arnd Bergmann <arnd@...db.de>,
Rusty Russell <rusty@...tcorp.com.au>,
Chris Wright <chrisw@...s-sol.org>,
yrl.pp-manager.tt@...achi.com,
Thomas Gleixner <tglx@...utronix.de>,
Tony Luck <tony.luck@...el.com>,
Kevin Hao <haokexin@...il.com>,
Linus Torvalds <torvalds@...ux-foundation.org>,
rdunlap@...radead.org,
Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
dl9pf@....de, Andrew Morton <akpm@...ux-foundation.org>,
linuxppc-dev@...ts.ozlabs.org,
"David S. Miller" <davem@...emloft.net>
Subject: Re: [RFT PATCH -next v2] [BUGFIX] kprobes: Fix "Failed to find blacklist"
error on ia64 and ppc64
On 05/27/2014 12:01 PM, Masami Hiramatsu wrote:
> On ia64 and ppc64, the function pointer does not point the
> entry address of the function, but the address of function
> discriptor (which contains the entry address and misc
> data.) Since the kprobes passes the function pointer stored
> by NOKPROBE_SYMBOL() to kallsyms_lookup_size_offset() for
> initalizing its blacklist, it fails and reports many errors
> as below.
>
> Failed to find blacklist 0001013168300000
> Failed to find blacklist 0001013000f0a000
> Failed to find blacklist 000101315f70a000
> Failed to find blacklist 000101324c80a000
> Failed to find blacklist 0001013063f0a000
> Failed to find blacklist 000101327800a000
> Failed to find blacklist 0001013277f0a000
> Failed to find blacklist 000101315a70a000
> Failed to find blacklist 0001013277e0a000
> Failed to find blacklist 000101305a20a000
> Failed to find blacklist 0001013277d0a000
> Failed to find blacklist 00010130bdc0a000
> Failed to find blacklist 00010130dc20a000
> Failed to find blacklist 000101309a00a000
> Failed to find blacklist 0001013277c0a000
> Failed to find blacklist 0001013277b0a000
> Failed to find blacklist 0001013277a0a000
> Failed to find blacklist 000101327790a000
> Failed to find blacklist 000101303140a000
> Failed to find blacklist 0001013a3280a000
>
> To fix this bug, this introduces function_entry() macro to
> retrieve the entry address from the given function pointer,
> and uses for kallsyms_lookup_size_offset() while initializing
> blacklist.
>
> Changes in V2:
> - Use function_entry() macro when lookin up symbols instead
> of storing it.
> - Update for the latest -next.
>
> Signed-off-by: Masami Hiramatsu <masami.hiramatsu.pt@...achi.com>
> Reported-by: Tony Luck <tony.luck@...il.com>
> Cc: Suzuki K. Poulose <suzuki@...ibm.com>
> Cc: Tony Luck <tony.luck@...el.com>
> Cc: Fenghua Yu <fenghua.yu@...el.com>
> Cc: Benjamin Herrenschmidt <benh@...nel.crashing.org>
> Cc: Paul Mackerras <paulus@...ba.org>
> Cc: Ananth N Mavinakayanahalli <ananth@...ibm.com>
> Cc: Kevin Hao <haokexin@...il.com>
> Cc: linux-ia64@...r.kernel.org
> Cc: linux-kernel@...r.kernel.org
> Cc: linuxppc-dev@...ts.ozlabs.org
> ---
> arch/ia64/include/asm/types.h | 2 ++
> arch/powerpc/include/asm/types.h | 11 +++++++++++
> include/linux/types.h | 4 ++++
> kernel/kprobes.c | 4 +++-
> 4 files changed, 20 insertions(+), 1 deletion(-)
>
> diff --git a/arch/ia64/include/asm/types.h b/arch/ia64/include/asm/types.h
> index 4c351b1..95279dd 100644
> --- a/arch/ia64/include/asm/types.h
> +++ b/arch/ia64/include/asm/types.h
> @@ -27,5 +27,7 @@ struct fnptr {
> unsigned long gp;
> };
>
> +#define function_entry(fn) (((struct fnptr *)(fn))->ip)
> +
> #endif /* !__ASSEMBLY__ */
> #endif /* _ASM_IA64_TYPES_H */
> diff --git a/arch/powerpc/include/asm/types.h b/arch/powerpc/include/asm/types.h
> index bfb6ded..8b89d65 100644
> --- a/arch/powerpc/include/asm/types.h
> +++ b/arch/powerpc/include/asm/types.h
> @@ -25,6 +25,17 @@ typedef struct {
> unsigned long env;
> } func_descr_t;
>
> +#if defined(CONFIG_PPC64) && (!defined(_CALL_ELF) || _CALL_ELF == 1)
> +/*
> + * On PPC64 ABIv1 the function pointer actually points to the
> + * function's descriptor. The first entry in the descriptor is the
> + * address of the function text.
> + */
> +#define function_entry(fn) (((func_descr_t *)(fn))->entry)
> +#else
> +#define function_entry(fn) ((unsigned long)(fn))
> +#endif
> +
> #endif /* __ASSEMBLY__ */
>
> #endif /* _ASM_POWERPC_TYPES_H */
> diff --git a/include/linux/types.h b/include/linux/types.h
> index a0bb704..3b95369 100644
> --- a/include/linux/types.h
> +++ b/include/linux/types.h
> @@ -213,5 +213,9 @@ struct callback_head {
> };
> #define rcu_head callback_head
>
> +#ifndef function_entry
> +#define function_entry(fn) ((unsigned long)(fn))
> +#endif
> +
> #endif /* __ASSEMBLY__ */
> #endif /* _LINUX_TYPES_H */
> diff --git a/kernel/kprobes.c b/kernel/kprobes.c
> index 2ac9f13..3859c88 100644
> --- a/kernel/kprobes.c
> +++ b/kernel/kprobes.c
> @@ -32,6 +32,7 @@
> * <prasanna@...ibm.com> added function-return probes.
> */
> #include <linux/kprobes.h>
> +#include <linux/types.h>
> #include <linux/hash.h>
> #include <linux/init.h>
> #include <linux/slab.h>
> @@ -2042,7 +2043,8 @@ static int __init populate_kprobe_blacklist(unsigned long *start,
> unsigned long offset = 0, size = 0;
>
> for (iter = start; iter < end; iter++) {
> - if (!kallsyms_lookup_size_offset(*iter, &size, &offset)) {
> + if (!kallsyms_lookup_size_offset(function_entry(*iter),
> + &size, &offset)) {
On powerpc we will be able to resolve the *iter to func_descr and won't
get the below error with/without this patch. So we have to actually
verify the kprobe_blacklist contents to make sure everything is alright.
> pr_err("Failed to find blacklist %p\n", (void *)*iter);
> continue;
> }
>
There is a bug here.
You need to set the ent->start using the function_entry(*iter) and not
*iter. Or else you just avoid the 'Warning' and still have an invalid
black list. As shown below :
2e:mon> ls kprobe_blacklist
kprobe_blacklist: c00000000104dad0
2e:mon> d c00000000104dad0 10
c00000000104dad0: c0000003aff800a0 c0000003aff809a0
2e:mon> d c0000003aff800a0 20 (struct kprobe_blacklist *)
c0000003aff800a0: c0000003aff800c0 c00000000104dad0
c0000003aff800b0: c0000000010ef138 c0000000010ef188
start ^^ end ^^
2e:mon> la c0000000010ef138 (start)
c0000000010ef138: notify_die+0x0/0x10 <- still points to the
function descriptor
2e:mon> la c0000000010ef188 (end)
c0000000010ef188: __blocking_notifier_call_chain+0x0/0x10
Following patch fixes the issue, with the patch :
1:mon> ls kprobe_blacklist
kprobe_blacklist: c00000000104dad0
1:mon> d c00000000104dad0 10
c00000000104dad0: c0000003ae1a00a0 c0000003ae1a09a0
1:mon> d c0000003ae1a00a0 20 (struct kprobe_blacklist *)
c0000003ae1a00a0: c0000003ae1a00c0 c00000000104dad0
c0000003ae1a00b0: c0000000000b14d0 c0000000000b1520
start ^^ end ^^
1:mon> la c0000000000b14d0
c0000000000b14d0: .notify_die+0x0/0x50
1:mon> la c0000000000b1520
c0000000000b1520: .atomic_notifier_chain_register+0x0/0xa0
1:mon> di c0000000000b14d0 10 (.notify_die)
c0000000000b14d0 7c0802a6 mflr r0
c0000000000b14d4 7c691b78 mr r9,r3
commit ed51674aca8e0496641f565421ab6691a873e80a
Author: Suzuki K. Poulose <suzuki@...ibm.com>
Date: Fri May 30 00:23:01 2014 +0530
diff --git a/kernel/kprobes.c b/kernel/kprobes.c
index 3859c88..b81d626 100644
--- a/kernel/kprobes.c
+++ b/kernel/kprobes.c
@@ -2043,7 +2043,8 @@ static int __init
populate_kprobe_blacklist(unsigned long *start,
unsigned long offset = 0, size = 0;
for (iter = start; iter < end; iter++) {
- if (!kallsyms_lookup_size_offset(function_entry(*iter),
+ unsigned long entry = function_entry(*iter);
+ if (!kallsyms_lookup_size_offset(entry,
&size, &offset)) {
pr_err("Failed to find blacklist %p\n", (void
*)*iter);
continue;
@@ -2052,8 +2053,8 @@ static int __init
populate_kprobe_blacklist(unsigned long *start,
ent = kmalloc(sizeof(*ent), GFP_KERNEL);
if (!ent)
return -ENOMEM;
- ent->start_addr = *iter;
- ent->end_addr = *iter + size;
+ ent->start_addr = entry;
+ ent->end_addr = entry + size;
INIT_LIST_HEAD(&ent->list);
list_add_tail(&ent->list, &kprobe_blacklist);
}
Thanks
Suzuki
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists