linux-kernel - Re: [PATCH] kretprobe: avoid re-registration of the same kretprobe earlier

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <d2dd6daf-39d4-0330-bf11-8f41672eac2e@huawei.com>
Date:   Thu, 14 Jan 2021 09:06:36 +0800
From:   "Wangshaobo (bobo)" <bobo.shaobowang@...wei.com>
To:     Masami Hiramatsu <mhiramat@...nel.org>,
        Steven Rostedt <rostedt@...dmis.org>
CC:     <naveen.n.rao@...ux.ibm.com>, <anil.s.keshavamurthy@...el.com>,
        <davem@...emloft.net>, <linux-kernel@...r.kernel.org>,
        <huawei.libin@...wei.com>, <cj.chengjian@...wei.com>
Subject: Re: [PATCH] kretprobe: avoid re-registration of the same kretprobe
 earlier

I have found other problems when following Masami's proposals,

I have been dealing with other things this two days and i will send 
patch as soon.


Thank you,

在 2021/1/14 8:25, Masami Hiramatsu 写道:
> On Wed, 13 Jan 2021 17:48:45 -0500
> Steven Rostedt <rostedt@...dmis.org> wrote:
>
>> Anything more on this?
> I need Wangshaobo's confirmation, because this is essentially a kind of programming bug,
> not a runtime bug. kprobes user must check the kprobe(kretprobe) must be unregistered
> and cleaned up before reusing it. (I recommend to re-alloc new data structure each time)
>
> For example, if you re-register your driver/filesystem without releasing, it will
> break the kernel.
>
> Thank you,
>
>> -- Steve
>>
>>
>> On Tue, 22 Dec 2020 20:03:56 +0900
>> Masami Hiramatsu <mhiramat@...nel.org> wrote:
>>
>>> On Mon, 21 Dec 2020 21:31:42 +0800
>>> "Wangshaobo (bobo)" <bobo.shaobowang@...wei.com> wrote:
>>>
>>>> Hi steven, Masami,
>>>> We have encountered a problem, when we attempted to use steven's suggestion as following,
>>>>    
>>>>>>> If you call this here, you must make sure kprobe_addr() is called on rp->kp.
>>>>>>> But if kretprobe_blacklist_size == 0, kprobe_addr() is not called before
>>>>>>> this check. So it should be in between kprobe_on_func_entry() and
>>>>>>> kretprobe_blacklist_size check, like this
>>>>>>>
>>>>>>> 	if (!kprobe_on_func_entry(rp->kp.addr, rp->kp.symbol_name, rp->kp.offset))
>>>>>>> 		return -EINVAL;
>>>>>>>
>>>>>>> 	addr = kprobe_addr(&rp->kp);
>>>>>>> 	if (IS_ERR(addr))
>>>>>>> 		return PTR_ERR(addr);
>>>>>>> 	rp->kp.addr = addr;
>>>> //there exists no-atomic operation risk, we should not modify any rp->kp's information, not all arch ensure atomic operation here.
>>>>    
>>>>>>> 	ret = check_kprobe_rereg(&rp->kp);
>>>>>>> 	if (WARN_ON(ret))
>>>>>>> 		return ret;
>>>>>>>
>>>>>>>            if (kretprobe_blacklist_size) {
>>>>>>> 		for (i = 0; > > +	ret = check_kprobe_rereg(&rp->kp);
>>>> it returns failure from register_kprobe() end called by register_kretprobe() when
>>>> we registered a kretprobe through .symbol_name at first time(through .addr is OK),
>>>> kprobe_addr() called at the begaining of register_kprobe() will recheck and
>>>> failed at following place because at this time we symbol_name is not NULL and addr is also.
>>> Good catch! Yes, it will reject if both kp->addr and kp->symbol are set.
>>>
>>>>     static kprobe_opcode_t *_kprobe_addr(const char *symbol_name,
>>>>                            unsigned int offset)
>>>>      {
>>>>            if ((symbol_name && addr) || (!symbol_name && !addr))  //we failed here
>>>>
>>>>
>>>> So we attempted to move this sentence rp->kp.addr = addr to __get_valid_kprobe() like this to
>>>> avoid explict usage of rp->kp.addr = addr in register_kretprobe().
>>>>
>>>> diff --git a/kernel/kprobes.c b/kernel/kprobes.c
>>>> index dd5821f753e6..ea014779edfe 100644
>>>> --- a/kernel/kprobes.c
>>>> +++ b/kernel/kprobes.c
>>>> @@ -1502,10 +1502,15 @@ static kprobe_opcode_t *kprobe_addr(struct kprobe *p)
>>>>    static struct kprobe *__get_valid_kprobe(struct kprobe *p)
>>>>    {
>>>>           struct kprobe *ap, *list_p;
>>>> +       void *addr;
>>>>
>>>>           lockdep_assert_held(&kprobe_mutex);
>>>>
>>>> -       ap = get_kprobe(p->addr);
>>>> +       addr = kprobe_addr(p);
>>>> +       if (IS_ERR(addr))
>>>> +               return NULL;
>>>> +
>>>> +       ap = get_kprobe(addr);
>>>>           if (unlikely(!ap))
>>>>                   return NULL;
>>>>
>>>> But it also failed when we second time attempted to register a same kretprobe, it is also
>>>> becasue symbol_name and addr is not NULL when we used __get_valid_kprobe().
>>> What the "second time" means? If you reuse the kretprobe (and kprobe) you must
>>> reset (cleanup) the kp->addr or kp->symbol_name. That is the initial state.
>>> I think the API should not allow users to enter inconsistent information.
>>>
>>>> So it seems has no idea expect for modifying _kprobe_addr() like following this, the reason is that
>>>> the patch 0bd476e6c671 ("kallsyms: unexport kallsyms_lookup_name() and kallsyms_on_each_symbol()")
>>>> has telled us we'd better use symbol name to register but not address anymore.
>>>>
>>>> -static kprobe_opcode_t *_kprobe_addr(kprobe_opcode_t *addr,
>>>> -                       const char *symbol_name, unsigned int offset)
>>>> +static kprobe_opcode_t *_kprobe_addr(const char *symbol_name,
>>>> +                       unsigned int offset)
>>>>    {
>>>> -       if ((symbol_name && addr) || (!symbol_name && !addr))
>>>> +       kprobe_opcode_t *addr;
>>>> +       if (!symbol_name)
>>>>                   goto invalid;
>>> No, there are cases that the user will set only kp->addr, but no kp->symbol_name.
>>>
>>>> For us, this modification has not caused a big impact on other modules, only expects a little
>>>> influence on bpf from calling trace_kprobe_on_func_entry(), it can not use addr to fill in
>>>> rp.kp in struct trace_event_call anymore.
>>>>
>>>> So i want to know your views, and i will resend this patch soon.
>>> OK, I think it is simpler to check the rp->kp.addr && rp->kp.symbol_name
>>> because it is not allowed (it can lead inconsistent setting).
>>>
>>> How about this code? Is this work for you?
>>>
>>> diff --git a/kernel/kprobes.c b/kernel/kprobes.c
>>> index 41fdbb7953c6..73500be564be 100644
>>> --- a/kernel/kprobes.c
>>> +++ b/kernel/kprobes.c
>>> @@ -2103,6 +2103,14 @@ int register_kretprobe(struct kretprobe *rp)
>>>          int i;
>>>          void *addr;
>>>   
>>> +       /* It is not allowed to specify addr and symbol_name at the same time */
>>> +       if (rp->kp.addr && rp->kp.symbol_name)
>>> +               return -EINVAL;
>>> +
>>> +       /* If only rp->kp.addr is specified, check reregistering kprobes */
>>> +       if (rp->kp.addr && check_kprobe_rereg(&rp->kp))
>>> +               return -EINVAL;
>>> +
>>>          if (!kprobe_on_func_entry(rp->kp.addr, rp->kp.symbol_name, rp->kp.offset))
>>>                  return -EINVAL;
>>>   
>>>
>>> Thank you,
>>>
>