linux-kernel - Re: [PATCH v3 6/9] arm64: Recover kretprobe modified return address in stacktrace

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 21 Oct 2021 23:26:30 +0900
From:   Masami Hiramatsu <mhiramat@...nel.org>
To:     Will Deacon <will@...nel.org>
Cc:     Steven Rostedt <rostedt@...dmis.org>,
        "Naveen N . Rao" <naveen.n.rao@...ux.vnet.ibm.com>,
        Ananth N Mavinakayanahalli <ananth@...ux.ibm.com>,
        Ingo Molnar <mingo@...nel.org>, linux-kernel@...r.kernel.org,
        Sven Schnelle <svens@...ux.ibm.com>,
        Catalin Marinas <catalin.marinas@....com>,
        Russell King <linux@...linux.org.uk>,
        Nathan Chancellor <nathan@...nel.org>,
        Nick Desaulniers <ndesaulniers@...gle.com>,
        linux-arm-kernel@...ts.infradead.org
Subject: Re: [PATCH v3 6/9] arm64: Recover kretprobe modified return address
 in stacktrace

On Thu, 21 Oct 2021 11:15:12 +0100
Will Deacon <will@...nel.org> wrote:

> On Thu, Oct 21, 2021 at 09:55:09AM +0900, Masami Hiramatsu wrote:
> > Since the kretprobe replaces the function return address with
> > the kretprobe_trampoline on the stack, stack unwinder shows it
> > instead of the correct return address.
> > 
> > This checks whether the next return address is the
> > __kretprobe_trampoline(), and if so, try to find the correct
> > return address from the kretprobe instance list. For this purpose
> > this adds 'kr_cur' loop cursor to memorize the current kretprobe
> > instance.
> > 
> > With this fix, now arm64 can enable
> > CONFIG_ARCH_CORRECT_STACKTRACE_ON_KRETPROBE, and pass the
> > kprobe self tests.
> > 
> > Signed-off-by: Masami Hiramatsu <mhiramat@...nel.org>
> > ---
> >  Changes in v2:
> >   - Add comment for kr_cur.
> >   - Make the kretprobe related code depends on CONFIG_KRETPROBES.
> >   - Initialize "kr_cur" directly in start_backtrace() instead
> >     of clearing "frame" data structure by memset().
> > ---
> >  arch/arm64/Kconfig                  |    1 +
> >  arch/arm64/include/asm/stacktrace.h |    4 ++++
> >  arch/arm64/kernel/stacktrace.c      |    7 +++++++
> >  3 files changed, 12 insertions(+)
> 
> Acked-by: Will Deacon <will@...nel.org>

Thank you!

> 
> I'm not sure how you're planning to merge this, so please let me know if
> you want me to queue any of the arm64 bits.

Ah, good question. Since this part depends on the first 3 patches and
Steve's tracing tree, these should go through the tracing tree. Is that
OK for you?

(Or, wait for merging the current tracing tree and merge rest of them.
 but this will take a long time.)

Thank you,


-- 
Masami Hiramatsu <mhiramat@...nel.org>