linux-kernel - [tip:perf/urgent] kprobes: Fix error check when reusing optimized probes

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <tip-5f843ed415581cfad4ef8fefe31c138a8346ca8a@git.kernel.org>
Date:   Tue, 16 Apr 2019 00:43:06 -0700
From:   tip-bot for Masami Hiramatsu <tipbot@...or.com>
To:     linux-tip-commits@...r.kernel.org
Cc:     mhiramat@...nel.org, mingo@...nel.org,
        anil.s.keshavamurthy@...el.com, peterz@...radead.org,
        hpa@...or.com, davem@...emloft.net,
        naveen.n.rao@...ux.vnet.ibm.com, tglx@...utronix.de,
        linux-kernel@...r.kernel.org, torvalds@...ux-foundation.org
Subject: [tip:perf/urgent] kprobes: Fix error check when reusing optimized
 probes

Commit-ID:  5f843ed415581cfad4ef8fefe31c138a8346ca8a
Gitweb:     https://git.kernel.org/tip/5f843ed415581cfad4ef8fefe31c138a8346ca8a
Author:     Masami Hiramatsu <mhiramat@...nel.org>
AuthorDate: Mon, 15 Apr 2019 15:01:25 +0900
Committer:  Ingo Molnar <mingo@...nel.org>
CommitDate: Tue, 16 Apr 2019 09:38:16 +0200

kprobes: Fix error check when reusing optimized probes

The following commit introduced a bug in one of our error paths:

  819319fc9346 ("kprobes: Return error if we fail to reuse kprobe instead of BUG_ON()")

it missed to handle the return value of kprobe_optready() as
error-value. In reality, the kprobe_optready() returns a bool
result, so "true" case must be passed instead of 0.

This causes some errors on kprobe boot-time selftests on ARM:

 [   ] Beginning kprobe tests...
 [   ] Probe ARM code
 [   ]     kprobe
 [   ]     kretprobe
 [   ] ARM instruction simulation
 [   ]     Check decoding tables
 [   ]     Run test cases
 [   ] FAIL: test_case_handler not run
 [   ] FAIL: Test andge	r10, r11, r14, asr r7
 [   ] FAIL: Scenario 11
 ...
 [   ] FAIL: Scenario 7
 [   ] Total instruction simulation tests=1631, pass=1433 fail=198
 [   ] kprobe tests failed

This can happen if an optimized probe is unregistered and next
kprobe is registered on same address until the previous probe
is not reclaimed.

If this happens, a hidden aggregated probe may be kept in memory,
and no new kprobe can probe same address. Also, in that case
register_kprobe() will return "1" instead of minus error value,
which can mislead caller logic.

Signed-off-by: Masami Hiramatsu <mhiramat@...nel.org>
Cc: Anil S Keshavamurthy <anil.s.keshavamurthy@...el.com>
Cc: David S . Miller <davem@...emloft.net>
Cc: Linus Torvalds <torvalds@...ux-foundation.org>
Cc: Naveen N . Rao <naveen.n.rao@...ux.vnet.ibm.com>
Cc: Peter Zijlstra <peterz@...radead.org>
Cc: Thomas Gleixner <tglx@...utronix.de>
Cc: stable@...r.kernel.org # v5.0+
Fixes: 819319fc9346 ("kprobes: Return error if we fail to reuse kprobe instead of BUG_ON()")
Link: http://lkml.kernel.org/r/155530808559.32517.539898325433642204.stgit@devnote2
Signed-off-by: Ingo Molnar <mingo@...nel.org>
---
 kernel/kprobes.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/kernel/kprobes.c b/kernel/kprobes.c
index c83e54727131..b1ea30a5540e 100644
--- a/kernel/kprobes.c
+++ b/kernel/kprobes.c
@@ -709,7 +709,6 @@ static void unoptimize_kprobe(struct kprobe *p, bool force)
 static int reuse_unused_kprobe(struct kprobe *ap)
 {
 	struct optimized_kprobe *op;
-	int ret;
 
 	/*
 	 * Unused kprobe MUST be on the way of delayed unoptimizing (means
@@ -720,9 +719,8 @@ static int reuse_unused_kprobe(struct kprobe *ap)
 	/* Enable the probe again */
 	ap->flags &= ~KPROBE_FLAG_DISABLED;
 	/* Optimize it again (remove from op->list) */
-	ret = kprobe_optready(ap);
-	if (ret)
-		return ret;
+	if (!kprobe_optready(ap))
+		return -EINVAL;
 
 	optimize_kprobe(ap);
 	return 0;