linux-kernel - Re: [PATCH] x86/kprobes: Fix optprobe to detect padding int3 correctly

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20201211200433.GA4773@pi3.com.pl>
Date:   Fri, 11 Dec 2020 21:04:33 +0100
From:   Adam Zabrocki <pi3@....com.pl>
To:     Kees Cook <keescook@...omium.org>
Cc:     Masami Hiramatsu <mhiramat@...nel.org>,
        Ingo Molnar <mingo@...nel.org>,
        Steven Rostedt <rostedt@...dmis.org>,
        Thomas Gleixner <tglx@...utronix.de>,
        Ingo Molnar <mingo@...hat.com>, Borislav Petkov <bp@...en8.de>,
        x86@...nel.org, "H . Peter Anvin" <hpa@...or.com>,
        linux-kernel@...r.kernel.org,
        "Naveen N . Rao" <naveen.n.rao@...ux.ibm.com>,
        Anil S Keshavamurthy <anil.s.keshavamurthy@...el.com>,
        "David S . Miller" <davem@...emloft.net>,
        Solar Designer <solar@...nwall.com>
Subject: Re: [PATCH] x86/kprobes: Fix optprobe to detect padding int3
 correctly

Hi,

I've applied this patch on the top of kernel 5.9.7 and verified it works 
fine:

ffffffff813050e0 <ftrace_enable_sysctl>:
...
...
ffffffff813052f1:       e9 fe fe ff ff          jmpq   ffffffff813051f4 <ftrace_enable_sysctl+0x114>
ffffffff813052f6:       cc                      int3
ffffffff813052f7:       cc                      int3
ffffffff813052f8:       cc                      int3
ffffffff813052f9:       cc                      int3
ffffffff813052fa:       cc                      int3
ffffffff813052fb:       cc                      int3
ffffffff813052fc:       cc                      int3
ffffffff813052fd:       cc                      int3
ffffffff813052fe:       cc                      int3
ffffffff813052ff:       cc                      int3

When I install KRETPROBE on this function, it is correctly optimized:

root@pi3:~/off-debug/git/lkrg# cat /sys/kernel/debug/kprobes/list|grep ftrace_enable_sysctl
ffffffff813050e0  r  ftrace_enable_sysctl+0x0    [OPTIMIZED]
root@pi3:~/off-debug/git/lkrg# 

gef➤  x/2i ftrace_enable_sysctl
   0xffffffff813050e0 <ftrace_enable_sysctl>:   jmp    0xffffffffc062807a
   0xffffffff813050e5 <ftrace_enable_sysctl+5>: push   r14

Thanks,
Adam

On Fri, Dec 11, 2020 at 11:39:15AM -0800, Kees Cook wrote:
> On Fri, Dec 11, 2020 at 04:04:17PM +0900, Masami Hiramatsu wrote:
> > Fix optprobe to detect padding int3 correctly.
> > 
> > Since commit 7705dc855797 ("x86/vmlinux: Use INT3 instead of NOP
> > for linker fill bytes") changed the padding bytes between functions
> > from nop to int3, when optprobe decodes a target function it finds
> > int3 and gives up the jump optimization.
> > 
> > Instead of giving up any int3 detection, this checks whether the
> > rest of bytes to the end of the function are int3 or not. If all
> > of those are int3, those come from the linker. In that case,
> > optprobe continues jump optimization.
> > 
> > Fixes: 7705dc855797 ("x86/vmlinux: Use INT3 instead of NOP for linker fill bytes")
> > Cc: stable@...r.kernel.org
> > Reported-by: Adam Zabrocki <pi3@....com.pl>
> > Signed-off-by: Masami Hiramatsu <mhiramat@...nel.org>
> 
> Reviewed-by: Kees Cook <keescook@...omium.org>
> 
> -- 
> Kees Cook

-- 
pi3 (pi3ki31ny) - pi3 (at) itsec pl
http://pi3.com.pl