linux-kernel - Re: [PATCH v3] riscv: fix kprobe __user string arg print fault issue

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 15 May 2023 19:55:37 +0800
From:   Ruan Jinjie <ruanjinjie@...wei.com>
To:     <paul.walmsley@...ive.com>, <palmer@...belt.com>,
        <aou@...s.berkeley.edu>, <linux-riscv@...ts.infradead.org>,
        <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH v3] riscv: fix kprobe __user string arg print fault issue

Ping.

On 2023/5/4 15:29, Ruan Jinjie wrote:
> On riscv qemu platform, when add kprobe event on do_sys_open() to show
> filename string arg, it just print fault as follow:
> 
> echo 'p:myprobe do_sys_open dfd=$arg1 filename=+0($arg2):string flags=$arg3
> mode=$arg4' > kprobe_events
> 
> bash-166     [000] ...1.   360.195367: myprobe: (do_sys_open+0x0/0x84)
> dfd=0xffffffffffffff9c filename=(fault) flags=0x8241 mode=0x1b6
> 
> bash-166     [000] ...1.   360.219369: myprobe: (do_sys_open+0x0/0x84)
> dfd=0xffffffffffffff9c filename=(fault) flags=0x8241 mode=0x1b6
> 
> bash-191     [000] ...1.   360.378827: myprobe: (do_sys_open+0x0/0x84)
> dfd=0xffffffffffffff9c filename=(fault) flags=0x98800 mode=0x0
> 
> As riscv do not select ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE,
> the +0($arg2) addr is processed as a kernel address though it is a
> userspace address, cause the above filename=(fault) print. So select
> ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE to avoid the issue, after that the
> kprobe trace is ok as below:
> 
> bash-166     [000] ...1.    96.767641: myprobe: (do_sys_open+0x0/0x84)
> dfd=0xffffffffffffff9c filename="/dev/null" flags=0x8241 mode=0x1b6
> 
> bash-166     [000] ...1.    96.793751: myprobe: (do_sys_open+0x0/0x84)
> dfd=0xffffffffffffff9c filename="/dev/null" flags=0x8241 mode=0x1b6
> 
> bash-177     [000] ...1.    96.962354: myprobe: (do_sys_open+0x0/0x84)
> dfd=0xffffffffffffff9c filename="/sys/kernel/debug/tracing/events/kprobes/"
> flags=0x98800 mode=0x0
> 
> Signed-off-by: Ruan Jinjie <ruanjinjie@...wei.com>
> Acked-by: Björn Töpel <bjorn@...osinc.com>
> ---
> v2:
> - add the config in alphabetical order
> ---
> v3:
> - change signed-off-by to use full name
> ---
>  arch/riscv/Kconfig | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/arch/riscv/Kconfig b/arch/riscv/Kconfig
> index d2967fefa1d7..b08ed929e220 100644
> --- a/arch/riscv/Kconfig
> +++ b/arch/riscv/Kconfig
> @@ -26,6 +26,7 @@ config RISCV
>  	select ARCH_HAS_GIGANTIC_PAGE
>  	select ARCH_HAS_KCOV
>  	select ARCH_HAS_MMIOWB
> +	select ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE
>  	select ARCH_HAS_PMEM_API
>  	select ARCH_HAS_PTE_SPECIAL
>  	select ARCH_HAS_SET_DIRECT_MAP if MMU