linux-kernel - Re: [PATCH 2/2] kprobes/x86: Use 16 bytes for each instruction slot again

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 1 Jun 2015 10:04:37 -0700
From:	Andy Lutomirski <luto@...capital.net>
To:	Eugene Shatokhin <eugene.shatokhin@...alab.ru>
Cc:	Masami Hiramatsu <masami.hiramatsu.pt@...achi.com>,
	Ingo Molnar <mingo@...nel.org>, Ingo Molnar <mingo@...hat.com>,
	LKML <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH 2/2] kprobes/x86: Use 16 bytes for each instruction slot again

On Mon, Jun 1, 2015 at 9:32 AM, Eugene Shatokhin
<eugene.shatokhin@...alab.ru> wrote:
> Commit 91e5ed49fca0 ("x86/asm/decoder: Fix and enforce max instruction
> size in the insn decoder") has changed MAX_INSN_SIZE from 16 to 15 bytes
> on x86.
>
> As a side effect, the slots Kprobes use to store the instructions became
> 1 byte shorter. This is unfortunate because, for example, the Kprobes'
> "boost" feature can not be used now for the instructions of length 11,
> like a quite common kind of MOV:
> * movq $0xffffffffffffffff,-0x3fe8(%rax) (48 c7 80 18 c0 ff ff ff ff ff ff)
> * movq $0x0,0x88(%rdi)                   (48 c7 87 88 00 00 00 00 00 00 00)
> and so on.
>
> This patch makes the insn slots 16 bytes long, like they were before while
> keeping MAX_INSN_SIZE intact.
>
> Other tools may benefit from this change as well.

What is a "slot" and why does this patch make sense?  Naively, I'd
expect that the check you're patching is entirely unnecessary -- I
don't see what the size of the instruction being probed has to do with
the safety of executing it out of line and then jumping back.

Is there another magic 16 somewhere that this is enforcing that we
don't overrun?

--Andy
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/