linux-kernel - Re: [PATCH -tip v7 09/13] kprobes: Setup instruction pointer in __kretprobe_trampoline

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 18 Jun 2021 00:02:39 +0900
From:   Masami Hiramatsu <mhiramat@...nel.org>
To:     Masami Hiramatsu <mhiramat@...nel.org>,
        Andrii Nakryiko <andrii.nakryiko@...il.com>
Cc:     Josh Poimboeuf <jpoimboe@...hat.com>,
        Steven Rostedt <rostedt@...dmis.org>,
        Ingo Molnar <mingo@...nel.org>, X86 ML <x86@...nel.org>,
        Daniel Xu <dxu@...uu.xyz>, linux-kernel@...r.kernel.org,
        bpf@...r.kernel.org, kuba@...nel.org, mingo@...hat.com,
        ast@...nel.org, tglx@...utronix.de, kernel-team@...com, yhs@...com,
        linux-ia64@...r.kernel.org,
        Abhishek Sagar <sagar.abhishek@...il.com>
Subject: Re: [PATCH -tip v7 09/13] kprobes: Setup instruction pointer in
 __kretprobe_trampoline_handler

On Thu, 17 Jun 2021 23:40:01 +0900
Masami Hiramatsu <mhiramat@...nel.org> wrote:

> On Wed, 16 Jun 2021 23:40:32 -0500
> Josh Poimboeuf <jpoimboe@...hat.com> wrote:
> 
> > On Wed, Jun 16, 2021 at 11:39:11PM -0500, Josh Poimboeuf wrote:
> > > On Thu, May 27, 2021 at 03:40:29PM +0900, Masami Hiramatsu wrote:
> > > > To simplify the stacktrace with pt_regs from kretprobe handler,
> > > > set the correct return address to the instruction pointer in
> > > > the pt_regs before calling kretprobe handlers.
> > > > 
> > > > Suggested-by: Josh Poimboeuf <jpoimboe@...hat.com>
> > > > Signed-off-by: Masami Hiramatsu <mhiramat@...nel.org>
> > > > Tested-by: Andrii Nakryik <andrii@...nel.org>
> > > > ---
> > > >  Changes in v3:
> > > >   - Cast the correct_ret_addr to unsigned long.
> > > > ---
> > > >  kernel/kprobes.c |    3 +++
> > > >  1 file changed, 3 insertions(+)
> > > > 
> > > > diff --git a/kernel/kprobes.c b/kernel/kprobes.c
> > > > index 54e5b89aad67..1598aca375c9 100644
> > > > --- a/kernel/kprobes.c
> > > > +++ b/kernel/kprobes.c
> > > > @@ -1914,6 +1914,9 @@ unsigned long __kretprobe_trampoline_handler(struct pt_regs *regs,
> > > >  		BUG_ON(1);
> > > >  	}
> > > >  
> > > > +	/* Set the instruction pointer to the correct address */
> > > > +	instruction_pointer_set(regs, (unsigned long)correct_ret_addr);
> > > > +
> > > >  	/* Run them. */
> > > >  	first = current->kretprobe_instances.first;
> > > >  	while (first) {
> > > > 
> > > 
> > > Hi Masami,
> > > 
> > > I know I suggested this patch, but I believe it would only be useful in
> > > combination with the use of UNWIND_HINT_REGS in SAVE_REGS_STRING.  But I
> > > think that would be tricky to pull off correctly.  Instead, we have
> > > UNWIND_HINT_FUNC, which is working fine.
> > > 
> > > So I'd suggest dropping this patch, as the unwinder isn't actually
> > > reading regs->ip after all.
> > 
> > ... and I guess this means patches 6-8 are no longer necessary.
> 
> OK, I also confirmed that dropping those patche does not make any change
> on the stacktrace. 
> Let me update the series without those. 

Oops, Andrii, can you also test the kernel without this patch?
(you don't need to drop patch 6-8) 
This changes the kretprobe to pass the return address via regs->ip to handler.
Dynamic-event doesn't use it, but I'm not sure bcc is using it or not.

Thank you,

> 
> Thank you,
> 
> > 
> > -- 
> > Josh
> > 
> 
> 
> -- 
> Masami Hiramatsu <mhiramat@...nel.org>


-- 
Masami Hiramatsu <mhiramat@...nel.org>