linux-kernel - Re: [PATCH] riscv: Only consider swbp/ss handlers for correct privileged mode

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <CAJF2gTS4XQXDgWhB5SHr4fG3RASwEAtug0jkJcs-BEYhtj4B4w@mail.gmail.com>
Date:   Sun, 27 Aug 2023 06:55:50 -0400
From:   Guo Ren <guoren@...nel.org>
To:     Björn Töpel <bjorn@...nel.org>
Cc:     Paul Walmsley <paul.walmsley@...ive.com>,
        Palmer Dabbelt <palmer@...belt.com>,
        Albert Ou <aou@...s.berkeley.edu>,
        linux-riscv@...ts.infradead.org,
        Björn Töpel <bjorn@...osinc.com>,
        linux-kernel@...r.kernel.org, linux-trace-kernel@...r.kernel.org,
        Nam Cao <namcaov@...il.com>
Subject: Re: [PATCH] riscv: Only consider swbp/ss handlers for correct
 privileged mode

On Sun, Aug 27, 2023 at 4:39 AM Björn Töpel <bjorn@...nel.org> wrote:
>
> From: Björn Töpel <bjorn@...osinc.com>
>
> RISC-V software breakpoint trap handlers are used for {k,u}probes.
>
> When trapping from kernelmode, only the kernelmode handlers should be
> considered. Vice versa, only usermode handlers for usermode
> traps. This is not the case on RISC-V, which can trigger a bug if a
> userspace process uses uprobes, and a WARN() is triggered from
> kernelmode (which is implemented via {c.,}ebreak).
>
> The kernel will trap on the kernelmode {c.,}ebreak, look for uprobes
> handlers, realize incorrectly that uprobes need to be handled, and
> exit the trap handler early. The trap returns to re-executing the
> {c.,}ebreak, and enter an infinite trap-loop.
Thx for the fixup.

Reviewed-by: Guo Ren <guoren@...nel.org>

>
> The issue was found running the BPF selftest [1].
>
> Fix this issue by only considering the swbp/ss handlers for
> kernel/usermode respectively. Also, move CONFIG ifdeffery from traps.c
> to the asm/{k,u}probes.h headers.
>
> Note that linux/uprobes.h only include asm/uprobes.h if CONFIG_UPROBES
> is defined, which is why asm/uprobes.h needs to be unconditionally
> included in traps.c
>
> Link: https://lore.kernel.org/linux-riscv/87v8d19aun.fsf@all.your.base.are.belong.to.us/ # [1]
> Fixes: 74784081aac8 ("riscv: Add uprobes supported")
> Signed-off-by: Björn Töpel <bjorn@...osinc.com>
> ---
>  arch/riscv/include/asm/kprobes.h | 11 ++++++++++-
>  arch/riscv/include/asm/uprobes.h | 13 ++++++++++++-
>  arch/riscv/kernel/traps.c        | 28 ++++++++++++++++++----------
>  3 files changed, 40 insertions(+), 12 deletions(-)
>
> diff --git a/arch/riscv/include/asm/kprobes.h b/arch/riscv/include/asm/kprobes.h
> index e7882ccb0fd4..89fbd90f16a2 100644
> --- a/arch/riscv/include/asm/kprobes.h
> +++ b/arch/riscv/include/asm/kprobes.h
> @@ -40,6 +40,15 @@ void arch_remove_kprobe(struct kprobe *p);
>  int kprobe_fault_handler(struct pt_regs *regs, unsigned int trapnr);
>  bool kprobe_breakpoint_handler(struct pt_regs *regs);
>  bool kprobe_single_step_handler(struct pt_regs *regs);
> -
> +#else
> +static inline bool kprobe_breakpoint_handler(struct pt_regs *)
> +{
> +       return false;
> +}
> +
> +static inline bool kprobe_single_step_handler(struct pt_regs *)
> +{
> +       return false;
> +}
>  #endif /* CONFIG_KPROBES */
>  #endif /* _ASM_RISCV_KPROBES_H */
> diff --git a/arch/riscv/include/asm/uprobes.h b/arch/riscv/include/asm/uprobes.h
> index f2183e00fdd2..3fc7deda9190 100644
> --- a/arch/riscv/include/asm/uprobes.h
> +++ b/arch/riscv/include/asm/uprobes.h
> @@ -34,7 +34,18 @@ struct arch_uprobe {
>         bool simulate;
>  };
>
> +#ifdef CONFIG_UPROBES
>  bool uprobe_breakpoint_handler(struct pt_regs *regs);
>  bool uprobe_single_step_handler(struct pt_regs *regs);
> -
> +#else
> +static inline bool uprobe_breakpoint_handler(struct pt_regs *regs)
> +{
> +       return false;
> +}
> +
> +static inline bool uprobe_single_step_handler(struct pt_regs *regs)
> +{
> +       return false;
> +}
> +#endif /* CONFIG_UPROBES */
>  #endif /* _ASM_RISCV_UPROBES_H */
> diff --git a/arch/riscv/kernel/traps.c b/arch/riscv/kernel/traps.c
> index f798c853bede..cd6f10c73a16 100644
> --- a/arch/riscv/kernel/traps.c
> +++ b/arch/riscv/kernel/traps.c
> @@ -13,6 +13,8 @@
>  #include <linux/kdebug.h>
>  #include <linux/uaccess.h>
>  #include <linux/kprobes.h>
> +#include <linux/uprobes.h>
> +#include <asm/uprobes.h>
>  #include <linux/mm.h>
>  #include <linux/module.h>
>  #include <linux/irq.h>
> @@ -246,22 +248,28 @@ static inline unsigned long get_break_insn_length(unsigned long pc)
>         return GET_INSN_LENGTH(insn);
>  }
>
> +static bool probe_single_step_handler(struct pt_regs *regs)
> +{
> +       bool user = user_mode(regs);
> +
> +       return user ? uprobe_single_step_handler(regs) : kprobe_single_step_handler(regs);
> +}
> +
> +static bool probe_breakpoint_handler(struct pt_regs *regs)
> +{
> +       bool user = user_mode(regs);
> +
> +       return user ? uprobe_breakpoint_handler(regs) : kprobe_breakpoint_handler(regs);
> +}
> +
>  void handle_break(struct pt_regs *regs)
>  {
> -#ifdef CONFIG_KPROBES
> -       if (kprobe_single_step_handler(regs))
> +       if (probe_single_step_handler(regs))
>                 return;
>
> -       if (kprobe_breakpoint_handler(regs))
> -               return;
> -#endif
> -#ifdef CONFIG_UPROBES
> -       if (uprobe_single_step_handler(regs))
> +       if (probe_breakpoint_handler(regs))
>                 return;
>
> -       if (uprobe_breakpoint_handler(regs))
> -               return;
> -#endif
>         current->thread.bad_cause = regs->cause;
>
>         if (user_mode(regs))
>
> base-commit: 7d2f353b2682dcfe5f9bc71e5b61d5b61770d98e
> --
> 2.39.2
>


-- 
Best Regards
 Guo Ren