linux-kernel - Re: [PATCH] kprobes: bugfix: checks kprobes_all_disarmed in unoptimized

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 19 Jan 2015 21:45:34 +0900
From:	Masami Hiramatsu <masami.hiramatsu.pt@...achi.com>
To:	Wang Nan <wangnan0@...wei.com>
Cc:	tixy@...aro.org, linux@....linux.org.uk,
	linux-kernel@...r.kernel.org, linux-arm-kernel@...ts.infradead.org,
	lizefan@...wei.com
Subject: Re: [PATCH] kprobes: bugfix: checks kprobes_all_disarmed in unoptimized_kprobe().

(2015/01/19 20:21), Wang Nan wrote:
> On 2015/1/19 17:05, Masami Hiramatsu wrote:
>> Hi Wang,
>>
>> I've found a problem on this patch, since kprobes calls unoptioize_kprobe
>> with kprobes_all_disarmed=true when trying to disable all kprobes, this
>> cause a serious problem.
>>
>> Moreover, I couldn't reproduce your reported bug on my 3.19-rc4 kernel.
>> Could you test it again?
>>
> 
> I tested it again based on 3.19-rc5 and found that the problem still exists.
> My testing is based on QEMU.
> 
> First I tested my kprobeopt for ARM, then on x86_64. The test results are pasted
> at the bottom of this mail. Commands after 'gdb attaches to QEMU' is my actions
> on a gdb console attached to QEMU; commands after 'inside virtual machine' is
> what I do in Linux run under QEMU.

Thank you for the reporting.
So, now I know what happened, the problem is "debugfs/kprobes/enabled doesn't work
correctly on optimized kprobes". Please make update the patch description.

I also reproduced the bug without gdb.
Here is the log.

----
[root@...alhost ~]# cd /sys/kernel/debug/tracing/
[root@...alhost tracing]# echo p do_fork+5 > kprobe_events	# setup new event
[root@...alhost tracing]# echo $$ > set_ftrace_pid		# trace only this process
[root@...alhost tracing]# echo 1 > events/kprobes/p_do_fork_5/enable	# enable it
[root@...alhost tracing]# cat trace				# check the trace data
# tracer: nop
#
# entries-in-buffer/entries-written: 1/1   #P:8
#
#                              _-----=> irqs-off
#                             / _----=> need-resched
#                            | / _---=> hardirq/softirq
#                            || / _--=> preempt-depth
#                            ||| /     delay
#           TASK-PID   CPU#  ||||    TIMESTAMP  FUNCTION
#              | |       |   ||||       |         |
            bash-3883  [006] d...   279.799023: p_do_fork_5: (do_fork+0x5/0x360) # OK, now tracing
[root@...alhost tracing]# cat ../kprobes/list
ffffffff810bc1c5  k  do_fork+0x5    [OPTIMIZED]			# and it is actually optimized
[root@...alhost tracing]# echo 0 > ../kprobes/enabled		# disable *ALL* kprobes
[root@...alhost tracing]# echo > trace				# clear events
[root@...alhost tracing]# cat trace				# this should show empty buffer
# tracer: nop
#
# entries-in-buffer/entries-written: 1/1   #P:8
#
#                              _-----=> irqs-off
#                             / _----=> need-resched
#                            | / _---=> hardirq/softirq
#                            || / _--=> preempt-depth
#                            ||| /     delay
#           TASK-PID   CPU#  ||||    TIMESTAMP  FUNCTION
#              | |       |   ||||       |         |
            bash-3883  [006] d...   337.770785: p_do_fork_5: (do_fork+0x5/0x360)  # But still tracing!
[root@...alhost tracing]# cat trace				# Check again
# tracer: nop
#
# entries-in-buffer/entries-written: 2/2   #P:8
#
#                              _-----=> irqs-off
#                             / _----=> need-resched
#                            | / _---=> hardirq/softirq
#                            || / _--=> preempt-depth
#                            ||| /     delay
#           TASK-PID   CPU#  ||||    TIMESTAMP  FUNCTION
#              | |       |   ||||       |         |
            bash-3883  [006] d...   337.770785: p_do_fork_5: (do_fork+0x5/0x360)
            bash-3883  [006] d...   345.592178: p_do_fork_5: (do_fork+0x5/0x360) # We are tracing!!

So, after global disabling kprobes, ALL kprobes event should be disabled, but not.

OK, I think your first patch is better than the second one, but not enough.
What we should do is use kprobes_all_disarmed for force option like below.

	unoptimize_kprobe(p, kprobes_all_disarmed);    /* Try to unoptimize */

We also would better to check the flag in unregistering path for skipping unneeded
disarming process when kprobes globally disarmed.

Thank you,

-- 
Masami HIRAMATSU
Software Platform Research Dept. Linux Technology Research Center
Hitachi, Ltd., Yokohama Research Laboratory
E-mail: masami.hiramatsu.pt@...achi.com


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/