linux-kernel - Re: [PATCH tip/master v4] kprobes: extable: Identify kprobes' insn-slots as kernel text area

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 9 Jan 2017 11:36:48 -0600
From:   Josh Poimboeuf <jpoimboe@...hat.com>
To:     Masami Hiramatsu <mhiramat@...nel.org>
Cc:     Ingo Molnar <mingo@...hat.com>, linux-kernel@...r.kernel.org,
        Peter Zijlstra <peterz@...radead.org>,
        Ananth N Mavinakayanahalli <ananth@...ux.vnet.ibm.com>,
        Thomas Gleixner <tglx@...utronix.de>,
        "H . Peter Anvin" <hpa@...or.com>,
        Andrey Konovalov <andreyknvl@...gle.com>,
        Andy Lutomirski <luto@...nel.org>
Subject: Re: [PATCH tip/master v4] kprobes: extable: Identify kprobes'
 insn-slots as kernel text area

On Sun, Jan 08, 2017 at 11:58:09PM +0900, Masami Hiramatsu wrote:
> Make __kernel_text_address()/kernel_text_address() returns
> true if the given address is on a kprobe's instruction slot,
> which is generated by kprobes as a trampoline code.
> This can help stacktraces to determine the address is on a
> text area or not.
> 
> To implement this without any sleep in is_kprobe_*_slot(),
> this also modify insn_cache page list as a rcu list. It may
> increase processing deley (not processing time) for garbage
> slot collection, because it requires to wait an additional
> rcu grance period when freeing a page from the list.
> However, since it is not a hot path, we may not take care of it.
> 
> Note: this can give a small overhead to stack unwinders because
> this adds 2 checks in __kernel_text_address(). However, the
> impact should be very small, kprobe_insn_pages list has 1 entry
> per 256 probes(on x86, on arm/arm64 it will be 1024 probes),
> and kprobe_optinsn_pages has 1 entry per 32 probes(on x86).
> In most use cases, the number of kprobe events may be less
> than 20, this means is_kprobe_*_slot() will check just 1 entry.
> 
> Signed-off-by: Masami Hiramatsu <mhiramat@...nel.org>

Thanks for doing this Masami!  I verified that it works:

  Tested-by: Josh Poimboeuf <jpoimboe@...hat.com>

I suspect that BPF generated code also has the same issue, so I'll leave
the unwinder warning disabled for now.

BTW, I think we'll have more problems with generated code if/when we
move to an x86 DWARF unwinder, because it won't have any idea how to
unwind past generated code.  Long term I wonder if it would make sense
to create some kind of framework for creating or registering generated
code, so we can solve these types of problems in a single place.

-- 
Josh