linux-kernel - Re: WARNING at arch/x86/kernel/alternative.c:707 text

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 17 May 2017 01:27:38 +0900
From:   Masami Hiramatsu <mhiramat@...nel.org>
To:     Steven Rostedt <rostedt@...dmis.org>
Cc:     LKML <linux-kernel@...r.kernel.org>,
        Thomas Gleixner <tglx@...utronix.de>
Subject: Re: WARNING at arch/x86/kernel/alternative.c:707
 text_poke+0x25d/0x270

On Tue, 16 May 2017 11:30:19 -0400
Steven Rostedt <rostedt@...dmis.org> wrote:

> On Wed, 17 May 2017 00:15:39 +0900
> Masami Hiramatsu <mhiramat@...nel.org> wrote:
> 
> 
> > > It appears that the kprobe_optimizer work thread call happened after
> > > the init pages were freed, causing alternative.c to give the above
> > > warning because the text that is being unoptimized happens to no longer
> > > exist.  
> > 
> > Ah, I see. I need to check that case. Actually for the module
> > init text area, kill_kprobe() correctly kicks kill_optimized_kprobe()
> > so it should safe. But above case is on the init-text in kernel
> > itself. I guess module_notifier may not be called for that area...
> 
> Hmm, what happens if you add a kprobe to a module, remove it, and then
> remove the module.

In that case the kprobe will be removed before unloading the module.
If the kprobe is optimized, the optimized probe itself is queued
to unoptimize.

> If the module is still loaded when it is removed,
> wouldn't that cause the optimized probe to be delayed?

Yes, it is queued, but before unloading module, it should be
dequeued forcibly by kill_optimized_kprobe() from module-notifier.

> Wouldn't that
> open a race where the optimizer work queue can be called when no module
> exists?

Since both kprobe_mutex and module_mutex are held in optimizer,
I couldn't think there is such race. I guess when the kernel's
init-text (not module's one) is freed, it doesn't kick the
module notifier and kprobes missed that.

Thank you,

-- 
Masami Hiramatsu <mhiramat@...nel.org>