linux-kernel - Re: [PATCH 01/12] uprobes: split THPs before trying replace them

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1485366269.29861.0.camel@redhat.com>
Date:   Wed, 25 Jan 2017 12:44:29 -0500
From:   Rik van Riel <riel@...hat.com>
To:     Srikar Dronamraju <srikar@...ux.vnet.ibm.com>,
        "Kirill A. Shutemov" <kirill@...temov.name>
Cc:     Andrew Morton <akpm@...ux-foundation.org>,
        "Kirill A. Shutemov" <kirill.shutemov@...ux.intel.com>,
        Andrea Arcangeli <aarcange@...hat.com>,
        Hugh Dickins <hughd@...gle.com>, linux-mm@...ck.org,
        linux-kernel@...r.kernel.org, Oleg Nesterov <oleg@...hat.com>,
        Peter Zijlstra <peterz@...radead.org>
Subject: Re: [PATCH 01/12] uprobes: split THPs before trying replace them

On Wed, 2017-01-25 at 08:55 -0800, Srikar Dronamraju wrote:
> > 
> > > 
> > > 
> > > > 
> > > > For THPs page_check_address() always fails. It's better to
> > > > split them
> > > > first before trying to replace.
> > > So what does this mean.  uprobes simply fails to work when trying
> > > to
> > > place a probe into a THP memory region?
> > Looks like we can end up with endless retry loop in
> > uprobe_write_opcode().
> > 
> > > 
> > > How come nobody noticed (and reported) this when using the
> > > feature?
> > I guess it's not often used for anon memory.
> > 
> The first time the breakpoint is hit on a page, it replaces the text
> page with anon page.  Now lets assume we insert breakpoints in all
> the
> pages in a range. Here each page is individually replaced by a non
> THP
> anonpage. (since we dont have bulk breakpoint insertion support,
> breakpoint insertion happens one at a time). Now the only interesting
> case may be when each of these replaced pages happen to be physically
> contiguous so that THP kicks in to replace all of these pages with
> one
> THP page. Can happen in practice?
> 
> Are there any other cases that I have missed?

A JIT compiler placing executable code in anonymous
memory before executing it, and a debugger trying to
insert a uprobe in one of those areas?

Not common, but I suppose it could be done.

-- 
All rights reversed

Download attachment "signature.asc" of type "application/pgp-signature" (474 bytes)