linux-kernel - Re: [PATCH v12 0/5] Add kprobe and kretprobe support for LoongArch

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 7 Feb 2023 11:14:36 +0800
From:   Tiezhu Yang <yangtiezhu@...ngson.cn>
To:     Jeff Xie <xiehuan09@...il.com>, Huacai Chen <chenhuacai@...nel.org>
Cc:     WANG Xuerui <kernel@...0n.name>,
        Masami Hiramatsu <mhiramat@...nel.org>,
        loongarch@...ts.linux.dev, linux-kernel@...r.kernel.org
Subject: Re: [PATCH v12 0/5] Add kprobe and kretprobe support for LoongArch



On 02/06/2023 08:48 PM, Jeff Xie wrote:
> On Mon, Feb 6, 2023 at 8:13 PM Huacai Chen <chenhuacai@...nel.org> wrote:
>>
>> Hi, Jeff,
>>
>> Now I add kprobes on ftrace support in
>> https://github.com/loongson/linux/commits/loongarch-next, please test
>> again. Thank you.
>>
>
> When using the kprobe example module kprobe_example.ko, I haven't seen
> any errors.
>
> But when using the ftrace to probe the symbol + offset, the kernel will panic:
> e.g. probe the scheduler_tick+4 is fine, but when probe the
> scheduler_tick+5, the kernel will panic.
>

Thanks for your test.

We can see that the instruction address is 4-byte alignment,
this is because the instruction length is 32-bit on LoongArch.

$ objdump -d vmlinux > dump.txt
$ grep -A 20 scheduler_tick dump.txt | head -21
9000000000279fc8 <scheduler_tick>:
9000000000279fc8:	03400000 	andi        	$zero, $zero, 0x0
9000000000279fcc:	03400000 	andi        	$zero, $zero, 0x0
9000000000279fd0:	02ff4063 	addi.d      	$sp, $sp, -48(0xfd0)
9000000000279fd4:	29c08077 	st.d        	$s0, $sp, 32(0x20)
9000000000279fd8:	29c06078 	st.d        	$s1, $sp, 24(0x18)
9000000000279fdc:	29c04079 	st.d        	$s2, $sp, 16(0x10)
9000000000279fe0:	29c0207a 	st.d        	$s3, $sp, 8(0x8)
9000000000279fe4:	29c0a061 	st.d        	$ra, $sp, 40(0x28)
9000000000279fe8:	2700007b 	stptr.d     	$s4, $sp, 0
9000000000279fec:	24001844 	ldptr.w     	$a0, $tp, 24(0x18)
9000000000279ff0:	1a02edd9 	pcalau12i   	$s2, 5998(0x176e)
9000000000279ff4:	1a034bac 	pcalau12i   	$t0, 6749(0x1a5d)
9000000000279ff8:	02f56339 	addi.d      	$s2, $s2, -680(0xd58)
9000000000279ffc:	00410c9a 	slli.d      	$s3, $a0, 0x3
900000000027a000:	28aae18d 	ld.w        	$t1, $t0, -1352(0xab8)
900000000027a004:	380c6b2e 	ldx.d       	$t2, $s2, $s3
900000000027a008:	1a022fcc 	pcalau12i   	$t0, 4478(0x117e)
900000000027a00c:	02f20198 	addi.d      	$s1, $t0, -896(0xc80)
900000000027a010:	00150317 	move        	$s0, $s1
900000000027a014:	004081ac 	slli.w      	$t0, $t1, 0x0

So we should check the probe address at the beginning of
arch_prepare_kprobe(), some other archs do the same thing.

$ git diff
diff --git a/arch/loongarch/kernel/kprobes.c 
b/arch/loongarch/kernel/kprobes.c
index bdab707b6edf..56c8c4b09a42 100644
--- a/arch/loongarch/kernel/kprobes.c
+++ b/arch/loongarch/kernel/kprobes.c
@@ -79,6 +79,9 @@ NOKPROBE_SYMBOL(arch_prepare_simulate);

  int arch_prepare_kprobe(struct kprobe *p)
  {
+       if ((unsigned long)p->addr & 0x3)
+               return -EILSEQ;
+
         /* copy instruction */
         p->opcode = *p->addr;


Thanks,
Tiezhu