linux-kernel - CONFIG_RETHUNK int3 filling prevents kprobes in function body

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20220904230713.a461f8fe85329663226c755f@kernel.org>
Date:   Sun, 4 Sep 2022 23:07:13 +0900
From:   Masami Hiramatsu (Google) <mhiramat@...nel.org>
To:     Peter Zijlstra <peterz@...radead.org>
Cc:     Borislav Petkov <bp@...e.de>, Josh Poimboeuf <jpoimboe@...nel.org>,
        linux-kernel@...r.kernel.org, Steven Rostedt <rostedt@...dmis.org>,
        Ingo Molnar <mingo@...nel.org>
Subject: CONFIG_RETHUNK int3 filling prevents kprobes in function body

Hi Peter,

I found that the CONFIG_RETHUNK code (path_return) fills the unused bytes
with int3 for padding. Unfortunately, this prevents kprobes on the function
body after the return code (e.g. branch blocks placed behind the return.)

This is because kprobes decodes function body to ensure the probed address
is an instruction boundary, and if it finds the 0xcc (int3), it stops
decoding and reject probing because the int3 is usually used for a
software breakpoint and is replacing some other instruction. Without
recovering the instruction, it can not continue decoding safely.

Can we use another instruction for padding instead of INT3? (e.g. NOP or UD2)

Or, can I expect the instruction length in __return_sites[] are always 5?
If so, I can just skip 5 bytes if the address is in __return_sites[].

Thank you,

-- 
Masami Hiramatsu (Google) <mhiramat@...nel.org>