From patchwork Tue Aug 28 20:14:17 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jann Horn X-Patchwork-Id: 10579169 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 80B7214BD for ; Tue, 28 Aug 2018 21:08:19 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 788BD2A961 for ; Tue, 28 Aug 2018 21:08:19 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 6AC072A964; Tue, 28 Aug 2018 21:08:19 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-12.8 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,MAILING_LIST_MULTI,RCVD_IN_DNSWL_MED, USER_IN_DEF_DKIM_WL autolearn=ham version=3.3.1 Received: from mother.openwall.net (mother.openwall.net [195.42.179.200]) by mail.wl.linuxfoundation.org (Postfix) with SMTP id 8D7432A961 for ; Tue, 28 Aug 2018 21:08:18 +0000 (UTC) Received: (qmail 24304 invoked by uid 550); 28 Aug 2018 21:08:16 -0000 Mailing-List: contact kernel-hardening-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-ID: Delivered-To: mailing list kernel-hardening@lists.openwall.com Delivered-To: moderator for kernel-hardening@lists.openwall.com Received: (qmail 1581 invoked from network); 28 Aug 2018 20:15:00 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=date:in-reply-to:message-id:mime-version:references:subject:from:to :cc; bh=03TAXzBIbK9qSPjls82pb6bVgK3cZq6BxaYmPeOzPNA=; b=k9MstZk0c2zdNTFSvMTX0jVj6F0t2QStibNqEXye6Ey7CN7GTPilMG/QNGEft9wwy7 7z3CUVCrnrHtFjQjnkrsiBgHyXu+V4ix9rOiV4ZhUDLlcDEls7cQ49zmOUuIeITJ89J+ BBYyvErOgZn9brmOZMbBKpii+A8kEqmhE6h7D25Hru6B1N7gwxHGU+60IbF6vnTz/DUF 8eJg1VRws24//e00HOVbKSAPVB5SIPxY1rTRctGFQWg7LZDxNcVr9KHesDp/YyZOqnVd S4e9L3Tt7fufL0H57G4qQL0Kd9YsY1Wb0/g0gCfLQ0RoCOiCmnpeQbkLBeXym0aCP8mS ZUew== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:date:in-reply-to:message-id:mime-version :references:subject:from:to:cc; bh=03TAXzBIbK9qSPjls82pb6bVgK3cZq6BxaYmPeOzPNA=; b=IcpuXlDJ0UC0yDT66wRE0jZlWdwUl9Y9HUWXnA3ZG0xIqqj3xywIevoLWRaQMj/R1m p0U6rcpRruBCO7ugmC5WHD11poMuVw/HzM5VpIFAAsQVKfin/bbUl7PZLNN0B0VNPcpd m+9FFaprTlg+1/oKem5wbwuWfdwDRSX3q8rk79Pini8fNYNfl8BEbXjwuv7zdT4hAFL1 vSEIvW6CF16wJpn5RfduKFVa1aNVDk6yjnO1ftPo4hxQYkBhLWHaa8VTT0VNmj4TTr1P +R0O/gjKiEKtax1ynBE8FGY8QFoch9/uzCKQL2PV3n9z4qVh65RDBHk9wkp8u+ykBBbr hJWA== X-Gm-Message-State: APzg51B0p7eU+NMyAqAbFmFL7/n9dZschAeTPiZOCndGEP9zUWYBkPmb 2broALYr+nO0jUcHtpCk8gbH9eup3A== X-Google-Smtp-Source: ANB0VdYgWZ5VfYWaGnKLfkPsMkmQJLzGAuQC5FQ4qD+JPJXy209W/KyIRBpY8ob3Rf+BctOyZwDckr/9yw== X-Received: by 2002:a63:4406:: with SMTP id r6-v6mr853725pga.64.1535487288321; Tue, 28 Aug 2018 13:14:48 -0700 (PDT) Date: Tue, 28 Aug 2018 22:14:17 +0200 In-Reply-To: <20180828201421.157735-1-jannh@google.com> Message-Id: <20180828201421.157735-4-jannh@google.com> Mime-Version: 1.0 References: <20180828201421.157735-1-jannh@google.com> X-Mailer: git-send-email 2.19.0.rc0.228.g281dcd1b4d0-goog Subject: [PATCH v3 3/7] x86: stop calling fixup_exception() from kprobe_fault_handler() From: Jann Horn To: Kees Cook , Thomas Gleixner , Ingo Molnar , x86@kernel.org, Andy Lutomirski , kernel-hardening@lists.openwall.com, jannh@google.com Cc: linux-kernel@vger.kernel.org, dvyukov@google.com, Masami Hiramatsu , "Naveen N. Rao" , Anil S Keshavamurthy , "David S. Miller" , Alexander Viro , linux-fsdevel@vger.kernel.org, Borislav Petkov X-Virus-Scanned: ClamAV using ClamSMTP This removes the call into exception fixup that was added in commit c28f896634f2 ("[PATCH] kprobes: fix broken fault handling for x86_64"). On X86, kprobe_fault_handler() is called from two places: do_general_protection() (for #GP) and kprobes_fault() (for #PF). In both paths, the fixup_exception() call in the kprobe fault handler is redundant. For #GP, fixup_exception() is called immediately before kprobe_fault_handler() is invoked - if someone wanted to fix up our #GP, they've already done so, no need to try again. (This assumes that the kprobe's fault handler isn't going to do something crazy like changing RIP so that it suddenly points to an instruction that does userspace access.) For #PF on a kernel address from kernel space, after the kprobe fault handler has run, we'll go into no_context(), which calls fixup_exception(). Acked-by: Masami Hiramatsu Signed-off-by: Jann Horn --- arch/x86/kernel/kprobes/core.c | 7 ------- 1 file changed, 7 deletions(-) diff --git a/arch/x86/kernel/kprobes/core.c b/arch/x86/kernel/kprobes/core.c index 467ac22691b0..7315ac202aad 100644 --- a/arch/x86/kernel/kprobes/core.c +++ b/arch/x86/kernel/kprobes/core.c @@ -1021,13 +1021,6 @@ int kprobe_fault_handler(struct pt_regs *regs, int trapnr) if (cur->fault_handler && cur->fault_handler(cur, regs, trapnr)) return 1; - /* - * In case the user-specified fault handler returned - * zero, try to fix up. - */ - if (fixup_exception(regs, trapnr)) - return 1; - /* fixup routine could not handle it. */ }