linux-kernel - Re: trace: trace_kprobe.c always shows interrupts off

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20151117122333.71f5a903@gandalf.local.home>
Date:	Tue, 17 Nov 2015 12:23:33 -0500
From:	Steven Rostedt <rostedt@...dmis.org>
To:	Mathieu Desnoyers <mathieu.desnoyers@...icios.com>
Cc:	Ingo Molnar <mingo@...nel.org>,
	Thomas Gleixner <tglx@...utronix.de>,
	Peter Zijlstra <peterz@...radead.org>,
	"pt, masami" <masami.hiramatsu.pt@...achi.com>,
	LKML <linux-kernel@...r.kernel.org>
Subject: Re: trace: trace_kprobe.c always shows interrupts off

On Tue, 17 Nov 2015 16:35:35 +0000 (UTC)
Mathieu Desnoyers <mathieu.desnoyers@...icios.com> wrote:

> Hi,
> 
> I notice that trace_kprobe.c does local_save_flags() within
> __kprobe_trace_func(), which is called (at least on x86) with
> interrupts always disabled. This is then used as interrupt on/off
> state within the recorded event, which is misleading.

Kinda. The kprobe itself has interrupts disabled, so it's only a white
lie.

> 
> I also don't understand why arch/x86/kernel/kprobes/ftrace.c
> pre handler disables interrupts, considering the following
> comment above arch/x86/kernel/kprobes/core.c: kprobe_int3_handler()
> 
>  * Interrupts are disabled on entry as trap3 is an interrupt gate and they
>  * remain disabled throughout this function.

I think you answered your own question. The key piece you may be
missing is that kprobe_ftrace_handler() is not called from a trap, but
from a function traced callback, which does not disable interrupts.

> 
> A struct pt_regs is received by this function, but I don't see
> any way to get the state of irq enable/disable from struct pt_regs
> across architectures.
> 
> Any thoughts on how to fix this ?

Create a cross arch: flags = regs_irq_save(regs) function.

-- Steve

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/