linux-kernel - [PATCH bpf-next] uprobes: Fix the xol slots reserved for uretprobe trampoline

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Wed, 19 Jun 2024 01:34:11 +0000
From: Liao Chang <liaochang1@...wei.com>
To: <jolsa@...nel.org>, <rostedt@...dmis.org>, <mhiramat@...nel.org>,
	<oleg@...hat.com>, <ast@...nel.org>, <daniel@...earbox.net>,
	<andrii@...nel.org>, <nathan@...nel.org>, <peterz@...radead.org>,
	<mingo@...hat.com>, <mark.rutland@....com>
CC: <linux-perf-users@...r.kernel.org>, <linux-kernel@...r.kernel.org>,
	<bpf@...r.kernel.org>
Subject: [PATCH bpf-next] uprobes: Fix the xol slots reserved for uretprobe trampoline

When the new uretprobe system call was added [1], the xol slots reserved
for the uretprobe trampoline might be insufficient on some architecture.
For example, on arm64, the trampoline is consist of three instructions
at least. So it should mark enough bits in area->bitmaps and
and area->slot_count for the reserved slots.

[1] https://lore.kernel.org/all/20240611112158.40795-4-jolsa@kernel.org/

Signed-off-by: Liao Chang <liaochang1@...wei.com>
---
 kernel/events/uprobes.c | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c
index 2816e65729ac..efd2d7f56622 100644
--- a/kernel/events/uprobes.c
+++ b/kernel/events/uprobes.c
@@ -1485,7 +1485,7 @@ void * __weak arch_uprobe_trampoline(unsigned long *psize)
 static struct xol_area *__create_xol_area(unsigned long vaddr)
 {
 	struct mm_struct *mm = current->mm;
-	unsigned long insns_size;
+	unsigned long insns_size, slot_nr;
 	struct xol_area *area;
 	void *insns;
 
@@ -1508,10 +1508,13 @@ static struct xol_area *__create_xol_area(unsigned long vaddr)
 
 	area->vaddr = vaddr;
 	init_waitqueue_head(&area->wq);
-	/* Reserve the 1st slot for get_trampoline_vaddr() */
-	set_bit(0, area->bitmap);
-	atomic_set(&area->slot_count, 1);
 	insns = arch_uprobe_trampoline(&insns_size);
+	/* Reserve enough slots for the uretprobe trampoline */
+	for (slot_nr = 0;
+	     slot_nr < max((insns_size / UPROBE_XOL_SLOT_BYTES), 1);
+	     slot_nr++)
+		set_bit(slot_nr, area->bitmap);
+	atomic_set(&area->slot_count, slot_nr);
 	arch_uprobe_copy_ixol(area->pages[0], 0, insns, insns_size);
 
 	if (!xol_add_vma(mm, area))
-- 
2.34.1