linux-kernel - [RFC PATCH -tip 0/3] x86/kprobes,orc: Fix ORC unwinder to unwind stack with optimized probe

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 31 Mar 2021 14:44:24 +0900
From:   Masami Hiramatsu <mhiramat@...nel.org>
To:     Josh Poimboeuf <jpoimboe@...hat.com>,
        Ingo Molnar <mingo@...nel.org>
Cc:     X86 ML <x86@...nel.org>, Masami Hiramatsu <mhiramat@...nel.org>,
        Daniel Xu <dxu@...uu.xyz>, linux-kernel@...r.kernel.org,
        bpf@...r.kernel.org, kuba@...nel.org, mingo@...hat.com,
        ast@...nel.org, tglx@...utronix.de, kernel-team@...com, yhs@...com,
        Steven Rostedt <rostedt@...dmis.org>
Subject: [RFC PATCH -tip 0/3] x86/kprobes,orc: Fix ORC unwinder to unwind stack with optimized probe

Hello,

These patches fixes the ORC unwinder to unwind optprobe trampoline
code on the stack correctly.
This patchset is based on the kretporbe and stacktrace fix series v5
which I sent last week.

https://lore.kernel.org/bpf/161676170650.330141.6214727134265514123.stgit@devnote2/

Note that I just confirmed the it fixes the case where the 
stacktrace called from the optprobe handler. So this should be
carefully reviewed.


Here is the test code;

cd /sys/kernel/debug/tracing
echo > trace
echo p full_proxy_read+5 >> kprobe_events
echo 1 > events/kprobes/enable
sleep 1 # wait for optimization
echo stacktrace:1 > events/kprobes/p_full_proxy_read_5/trigger
echo 1 > options/sym-offset
cat /sys/kernel/debug/kprobes/list


Without this,

             cat-138     [001] ...1     6.567662: p_full_proxy_read_5: (full_proxy_read+0x5/0x80)
             cat-138     [001] ...1     6.567711: <stack trace>
 => kprobe_trace_func+0x1d0/0x2c0
 => kprobe_dispatcher+0x39/0x60
 => opt_pre_handler+0x4f/0x80
 => optimized_callback+0xc3/0xf0
 => 0xffffffffa0006032
 => 0
 => 0


With this patch,

             cat-137     [007] ...1    17.542848: p_full_proxy_read_5: (full_proxy_read+0x5/0x80)
             cat-137     [007] ...1    17.542963: <stack trace>
 => kprobe_trace_func+0x1d0/0x2c0
 => kprobe_dispatcher+0x39/0x60
 => opt_pre_handler+0x4f/0x80
 => optimized_callback+0xc3/0xf0
 => full_proxy_read+0x5/0x80
 => vfs_read+0xab/0x1a0
 => ksys_read+0x5f/0xe0
 => do_syscall_64+0x33/0x40
 => entry_SYSCALL_64_after_hwframe+0x44/0xae
 => 0
 => 0


Thank you,

---

Masami Hiramatsu (3):
      x86/kprobes: Add ORC information to optprobe template
      kprobes: Add functions to find instruction buffer entry address
      x86/kprobes,orc: Unwind optprobe trampoline correctly


 arch/x86/include/asm/kprobes.h |    6 +++
 arch/x86/kernel/kprobes/opt.c  |   72 +++++++++++++++++++++++++++++++++++++---
 arch/x86/kernel/unwind_orc.c   |   15 +++++++-
 include/linux/kprobes.h        |    8 ++++
 kernel/kprobes.c               |   25 ++++++++++----
 5 files changed, 111 insertions(+), 15 deletions(-)

--
Masami Hiramatsu (Linaro) <mhiramat@...nel.org>