linux-kernel - [PATCH] kprobes: fix race condition in __unregister_kprobe

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <1461114834-27385-1-git-send-email-huawei.libin@huawei.com>
Date:	Wed, 20 Apr 2016 09:13:54 +0800
From:	Li Bin <huawei.libin@...wei.com>
To:	<ananth@...ibm.com>, <anil.s.keshavamurthy@...el.com>,
	<davem@...emloft.net>, <mhiramat@...nel.org>,
	<dave.long@...aro.org>
CC:	<linux-kernel@...r.kernel.org>, <wangnan0@...wei.com>,
	<guohanjun@...wei.com>, <dingtianhong@...wei.com>,
	<huawei.libin@...wei.com>
Subject: [PATCH] kprobes: fix race condition in __unregister_kprobe_top

In the following case, it will trigger kernel panic:
1. register a kprobe for one function
2. register a jprobe for the same function (to make it easier to
reproduce, let the entry callback take a long time such as calling
mdelay)
3. trigger the function be called, and then unregister the jprobe
(before the entry callback calling jprobe_return)

The reason is that in __unregister_kprobe_top (unregister_jprobe)
the break_handler of the aggrprobe will be set NULL, but now the
entry callback may has been triggered (before jprobe_return), and
then in jprobe_return, it trigger int3/brk exception, in exception
handler, because the break_handler has been set NULL, it will not
setup_singlestep, and will return to the original instrucion...

To fix this bug, __unregister_kprobe_top call the synchronize_sched()
before clearing the handler.

Signed-off-by: Li Bin <huawei.libin@...wei.com>
---
 kernel/kprobes.c |    1 +
 1 files changed, 1 insertions(+), 0 deletions(-)

diff --git a/kernel/kprobes.c b/kernel/kprobes.c
index d10ab6b..5b5dd68 100644
--- a/kernel/kprobes.c
+++ b/kernel/kprobes.c
@@ -1615,6 +1615,7 @@ static int __unregister_kprobe_top(struct kprobe *p)
 		 */
 		goto disarmed;
 	else {
+		synchronize_sched();
 		/* If disabling probe has special handlers, update aggrprobe */
 		if (p->break_handler && !kprobe_gone(p))
 			ap->break_handler = NULL;
-- 
1.7.1