linux-kernel - Re: [PATCH] kprobes: bugfix: checks kprobes_all_disarmed in unoptimized

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 19 Jan 2015 19:21:39 +0800
From:	Wang Nan <wangnan0@...wei.com>
To:	Masami Hiramatsu <masami.hiramatsu.pt@...achi.com>
CC:	<tixy@...aro.org>, <linux@....linux.org.uk>,
	<linux-kernel@...r.kernel.org>,
	<linux-arm-kernel@...ts.infradead.org>, <lizefan@...wei.com>
Subject: Re: [PATCH] kprobes: bugfix: checks kprobes_all_disarmed in unoptimized_kprobe().

On 2015/1/19 17:05, Masami Hiramatsu wrote:
> Hi Wang,
> 
> I've found a problem on this patch, since kprobes calls unoptioize_kprobe
> with kprobes_all_disarmed=true when trying to disable all kprobes, this
> cause a serious problem.
> 
> Moreover, I couldn't reproduce your reported bug on my 3.19-rc4 kernel.
> Could you test it again?
> 

I tested it again based on 3.19-rc5 and found that the problem still exists.
My testing is based on QEMU.

First I tested my kprobeopt for ARM, then on x86_64. The test results are pasted
at the bottom of this mail. Commands after 'gdb attaches to QEMU' is my actions
on a gdb console attached to QEMU; commands after 'inside virtual machine' is
what I do in Linux run under QEMU.



** ARM result **

------ gdb attaches to QEMU -------
(gdb) x/3i sys_open
   0xc013619c <SyS_open>:	mov	r12, sp          <--- *original insn*
   0xc01361a0 <SyS_open+4>:	push	{r11, r12, lr, pc}
   0xc01361a4 <SyS_open+8>:	sub	r11, r12, #4

------ inside virtual machine -------
# echo 'p:myprobe sys_open' > /sys/kernel/debug/tracing/kprobe_events
# echo 1 > /sys/kernel/debug/tracing/events/kprobes/myprobe/enable

------ gdb attaches to QEMU -------
cpu_v7_do_idle () at /home/w00229757/kernel-hydrogen/arch/arm/mm/proc-v7.S:74
74		ret	lr
(gdb) x/3i sys_open
   0xc013619c <SyS_open>:	b	0xbf000000        <--- *optimized*
   0xc01361a0 <SyS_open+4>:	push	{r11, r12, lr, pc}
   0xc01361a4 <SyS_open+8>:	sub	r11, r12, #4
(gdb) c

------ inside virtual machine -------
# echo 0 > /sys/kernel/debug/kprobes/enabled

------ gdb attaches to QEMU -------
cpu_v7_do_idle () at /home/w00229757/kernel-hydrogen/arch/arm/mm/proc-v7.S:74
74		ret	lr
(gdb) x/3i sys_open
   0xc013619c <SyS_open>:			; <UNDEFINED> instruction: 0xe7f001f8    <--- *BREAKPOINT*
   0xc01361a0 <SyS_open+4>:	push	{r11, r12, lr, pc}
   0xc01361a4 <SyS_open+8>:	sub	r11, r12, #4
(gdb) c



** x86_64 result **

------ gdb attaches to QEMU -------
(gdb) x/10i sys_open
   0xffffffff81184fe0 <SyS_open>:	data32 data32 data32 xchg %ax,%ax
   0xffffffff81184fe5 <SyS_open+5>:	push   %rbp
   0xffffffff81184fe6 <SyS_open+6>:	movzwl %dx,%ecx
   0xffffffff81184fe9 <SyS_open+9>:	mov    %esi,%edx
   0xffffffff81184feb <SyS_open+11>:	mov    %rsp,%rbp
   0xffffffff81184fee <SyS_open+14>:	mov    %rdi,%rsi
   0xffffffff81184ff1 <SyS_open+17>:	or     $0x80,%dh
   0xffffffff81184ff4 <SyS_open+20>:	mov    $0xffffff9c,%edi
   0xffffffff81184ff9 <SyS_open+25>:	callq  0xffffffff81184da0 <do_sys_open>
   0xffffffff81184ffe <SyS_open+30>:	pop    %rbp
(gdb) c
Continuing


------ inside virtual machine -------
# echo 'p:myprobe sys_open+20' > /sys/kernel/debug/tracing/kprobe_events
# echo 1 > /sys/kernel/debug/tracing/events/kprobes/myprobe/enable

------ gdb attaches to QEMU -------
(gdb) x/10i sys_open
   0xffffffff81184fe0 <SyS_open>:	data32 data32 data32 xchg %ax,%ax
   0xffffffff81184fe5 <SyS_open+5>:	push   %rbp
   0xffffffff81184fe6 <SyS_open+6>:	movzwl %dx,%ecx
   0xffffffff81184fe9 <SyS_open+9>:	mov    %esi,%edx
   0xffffffff81184feb <SyS_open+11>:	mov    %rsp,%rbp
   0xffffffff81184fee <SyS_open+14>:	mov    %rdi,%rsi
   0xffffffff81184ff1 <SyS_open+17>:	or     $0x80,%dh
   0xffffffff81184ff4 <SyS_open+20>:	jmpq   0xffffffffa0002000         <--- *optimized*
   0xffffffff81184ff9 <SyS_open+25>:	callq  0xffffffff81184da0 <do_sys_open>
   0xffffffff81184ffe <SyS_open+30>:	pop    %rbp
(gdb) c
Continuing.

------ inside virtual machine -------
# echo 0 > /sys/kernel/debug/kprobes/enabled

------ gdb attaches to QEMU -------
(gdb) x/10i sys_open
   0xffffffff81184fe0 <SyS_open>:	data32 data32 data32 xchg %ax,%ax
   0xffffffff81184fe5 <SyS_open+5>:	push   %rbp
   0xffffffff81184fe6 <SyS_open+6>:	movzwl %dx,%ecx
   0xffffffff81184fe9 <SyS_open+9>:	mov    %esi,%edx
   0xffffffff81184feb <SyS_open+11>:	mov    %rsp,%rbp
   0xffffffff81184fee <SyS_open+14>:	mov    %rdi,%rsi
   0xffffffff81184ff1 <SyS_open+17>:	or     $0x80,%dh
   0xffffffff81184ff4 <SyS_open+20>:	int3          <-- **BREAKPOINT**
   0xffffffff81184ff5 <SyS_open+21>:	pushfq
   0xffffffff81184ff6 <SyS_open+22>:	(bad)
(gdb)


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/