linux-kernel - Re: [PATCH 4/9] x86/dumpstack: Improve opcodes dumping in the Code: section

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20180315181911.jpnxzbhltkxsissv@treble>
Date:   Thu, 15 Mar 2018 13:19:11 -0500
From:   Josh Poimboeuf <jpoimboe@...hat.com>
To:     Borislav Petkov <bp@...en8.de>
Cc:     X86 ML <x86@...nel.org>, Andy Lutomirski <luto@...capital.net>,
        Linus Torvalds <torvalds@...ux-foundation.org>,
        Peter Zijlstra <peterz@...radead.org>,
        LKML <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH 4/9] x86/dumpstack: Improve opcodes dumping in the Code:
 section

On Thu, Mar 15, 2018 at 04:44:43PM +0100, Borislav Petkov wrote:
> From: Borislav Petkov <bp@...e.de>
> 
> The code used to iterate byte-by-byte over the bytes around RIP and that
> is expensive: disabling pagefaults around it, copy_from_user, etc...
> 
> Make it read the whole buffer of OPCODE_BUFSIZE size in one go. Use a
> statically allocated 64 bytes buffer so that concurrent show_opcodes()
> do not interleave in the output even though in the majority of the cases
> we sync on die_lock. Except the #PF path which doesn't...
> 
> Also, do the PAGE_OFFSET check outside of the function because latter
> will be reused in other context.
> 
> Signed-off-by: Borislav Petkov <bp@...e.de>
> ---
>  arch/x86/kernel/dumpstack.c | 34 ++++++++++++++++------------------
>  1 file changed, 16 insertions(+), 18 deletions(-)
> 
> diff --git a/arch/x86/kernel/dumpstack.c b/arch/x86/kernel/dumpstack.c
> index eb9d6c00a52f..3f781a8dddb8 100644
> --- a/arch/x86/kernel/dumpstack.c
> +++ b/arch/x86/kernel/dumpstack.c
> @@ -22,8 +22,6 @@
>  #include <asm/stacktrace.h>
>  #include <asm/unwind.h>
>  
> -#define OPCODE_BUFSIZE 64
> -
>  int panic_on_unrecovered_nmi;
>  int panic_on_io_nmi;
>  static int die_counter;
> @@ -72,29 +70,25 @@ static void printk_stack_address(unsigned long address, int reliable,
>  
>  static void show_opcodes(u8 *rip)
>  {
> -	unsigned int code_prologue = OPCODE_BUFSIZE * 43 / 64;
> -	unsigned int code_len = OPCODE_BUFSIZE;
> -	unsigned char c;
> +#define OPCODE_BUFSIZE 64
> +	unsigned int code_prologue = OPCODE_BUFSIZE * 2 / 3;
> +	u8 opcodes[OPCODE_BUFSIZE];
>  	u8 *ip;
>  	int i;
>  
>  	printk(KERN_DEFAULT "Code: ");
>  
>  	ip = (u8 *)rip - code_prologue;
> -	if (ip < (u8 *)PAGE_OFFSET || probe_kernel_address(ip, c)) {
> -		/* try starting at IP */
> -		ip = (u8 *)rip;
> -		code_len = code_len - code_prologue + 1;
> +	if (probe_kernel_read(opcodes, ip, OPCODE_BUFSIZE)) {
> +		pr_cont(" Bad RIP value.\n");
> +		return;

As long as you're changing the code, might as well remove the leading
space here, so it shows

	Code: Bad RIP value.

instead of

	Code:  Bad RIP value.

-- 
Josh