linux-kernel - Re: [PATCH -tip v2] x86/kprobes: Drop removed INT3 handling code

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Sun, 21 Jan 2024 10:42:49 -0500
From: Steven Rostedt <rostedt@...dmis.org>
To: "Masami Hiramatsu (Google)" <mhiramat@...nel.org>
Cc: Matthieu Baerts <matttbe@...nel.org>, x86@...nel.org, Thomas Gleixner
 <tglx@...utronix.de>, Ingo Molnar <mingo@...hat.com>, Borislav Petkov
 <bp@...en8.de>, Peter Zijlstra <peterz@...radead.org>,
 linux-kernel@...r.kernel.org, Huacai Chen <chenhuacai@...ngson.cn>, Jinyang
 He <hejinyang@...ngson.cn>, Tiezhu Yang <yangtiezhu@...ngson.cn>, "Naveen N
 . Rao" <naveen.n.rao@...ux.ibm.com>
Subject: Re: [PATCH -tip v2] x86/kprobes: Drop removed INT3 handling code

On Sun, 21 Jan 2024 18:05:44 +0900
Masami Hiramatsu (Google) <mhiramat@...nel.org> wrote:

> However, if the I-cache entry servives text_poke() and sync_core(), this
> problem may happen.
> The text_poke() flushes TLB but for the local (!global) PTE, and sync_core()
> just serialize (!= cache flushing?). Thus the other CPUs can still see the

Yes, the purpose of the IPIs are for cache flushing, including icache.

> INT3 after text_poke_sync()? If so, on such CPU, removed INT3 is still
> alive on the I-cache and hit it after text_poke_sync().
> This will be a ghost INT3...

An interrupt is a full memory barrier and it looks like qemu is not
honoring that. Thus the bug is in qemu and not the kernel.

-- Steve