From patchwork Wed Jul 27 03:20:58 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Chen Zhongjin X-Patchwork-Id: 12930003 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id E6D92C19F2B for ; Wed, 27 Jul 2022 03:25:00 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:MIME-Version:Message-ID:Date:Subject:CC :To:From:Reply-To:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References: List-Owner; bh=YbyD6L7jjUkMZ6+NnnbFU+/bgo5x0BH22/tztywazmw=; b=QNhuNuq1XBZGUL hXi9uCVolkPdt3L8pe2de7e1lNLqBQ3iaJOV6G36RR9524Go0vfHwWbNYth5Z9WfIhQG4hUy66+Qt 6pQXXm7ypaln97PWkaNYXd8VqN7AhYBlsuEvBp/LVv5AZTkjHe1YpOOvP++uFH3kLlB0pw6IJj1Cv 1cLHVmV0fGIuUJwyrhqqTzEB8ommdZnkW16zOhYn2Gm8F8TICyRUc06p95FF75cJFBNWrfdwFJDuG HgZ773ysR7DuIhB9HpY6E34HkDohje/f06G9Z4Ft0r8s1NjjQW7mcmsYNeTD/La8t27UvpT90FOv8 Pzy8yQHp+o9BwkUkKrCA==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.94.2 #2 (Red Hat Linux)) id 1oGXeL-008IPQ-Vf; Wed, 27 Jul 2022 03:23:54 +0000 Received: from szxga03-in.huawei.com ([45.249.212.189]) by bombadil.infradead.org with esmtps (Exim 4.94.2 #2 (Red Hat Linux)) id 1oGXeH-008IKl-U1 for linux-arm-kernel@lists.infradead.org; Wed, 27 Jul 2022 03:23:52 +0000 Received: from dggpemm500024.china.huawei.com (unknown [172.30.72.55]) by szxga03-in.huawei.com (SkyGuard) with ESMTP id 4Lszc901VYz9ssr; Wed, 27 Jul 2022 11:22:33 +0800 (CST) Received: from dggpemm500013.china.huawei.com (7.185.36.172) by dggpemm500024.china.huawei.com (7.185.36.203) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2375.24; Wed, 27 Jul 2022 11:23:42 +0800 Received: from ubuntu1804.huawei.com (10.67.175.36) by dggpemm500013.china.huawei.com (7.185.36.172) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2375.24; Wed, 27 Jul 2022 11:23:42 +0800 From: Chen Zhongjin To: , , CC: , , , , Subject: [PATCH] kprobes: Forbid probing on kprobe_insn_slot Date: Wed, 27 Jul 2022 11:20:58 +0800 Message-ID: <20220727032058.60444-1-chenzhongjin@huawei.com> X-Mailer: git-send-email 2.17.1 MIME-Version: 1.0 X-Originating-IP: [10.67.175.36] X-ClientProxiedBy: dggems703-chm.china.huawei.com (10.3.19.180) To dggpemm500013.china.huawei.com (7.185.36.172) X-CFilter-Loop: Reflected X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20220726_202350_329325_39F01A6F X-CRM114-Status: UNSURE ( 9.53 ) X-CRM114-Notice: Please train this message. X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org Syzkaller reported a BUG on arm64: Unrecoverable kprobe detected. Dumping kprobe: Name: (null) Offset: 0 Address: 0xffffa00010019000 ------------[ cut here ]------------ kernel BUG at arch/arm64/kernel/probes/kprobes.c:235! Internal error: Oops - BUG: 0 [#1] SMP Modules linked in: CPU: 1 PID: 31060 Comm: syz-executor.6 Not tainted 5.10.0 #11 ... Call trace:  reenter_kprobe arch/arm64/kernel/probes/kprobes.c:234 [inline]  kprobe_handler+0x23c/0x26c arch/arm64/kernel/probes/kprobes.c:339  kprobe_breakpoint_handler+0x24/0x34 arch/arm64/kernel/probes/kprobes.c:406  call_break_hook+0xf4/0x13c arch/arm64/kernel/debug-monitors.c:322  brk_handler+0x2c/0xa0 arch/arm64/kernel/debug-monitors.c:329  do_debug_exception+0x140/0x230 arch/arm64/mm/fault.c:867  el1_dbg+0x38/0x50 arch/arm64/kernel/entry-common.c:182  el1_sync_handler+0xf4/0x150 arch/arm64/kernel/entry-common.c:219  el1_sync+0x74/0x100 arch/arm64/kernel/entry.S:665  0xffffa00010019000  do_futex+0x2f4/0x370 kernel/futex.c:3735  __do_sys_futex kernel/futex.c:3798 [inline]  __se_sys_futex kernel/futex.c:3764 [inline]  __arm64_sys_futex+0x168/0x3a0 kernel/futex.c:3764  __invoke_syscall arch/arm64/kernel/syscall.c:36 [inline]  invoke_syscall arch/arm64/kernel/syscall.c:48 [inline]  el0_svc_common.constprop.0+0xf4/0x414 arch/arm64/kernel/syscall.c:155  do_el0_svc+0x50/0x11c arch/arm64/kernel/syscall.c:217  el0_svc+0x20/0x30 arch/arm64/kernel/entry-common.c:353  el0_sync_handler+0xe4/0x1e0 arch/arm64/kernel/entry-common.c:369  el0_sync+0x148/0x180 arch/arm64/kernel/entry.S:683 Code: 91018360 97ff1838 aa1703e0 97ff1fdf (d4210000) ---[ end trace 767503e946e01b15 ]--- Syzbot tried to porbe on a kprobe_insn_slot. kprobe will replace instruciton with a break and store the origin one on kprobe_insn_slot. However these slots are not in .kprobes.text and exported by perf_event_ksymbol so can be probed by perf interface. Probing these slots will triggers kprobe handler inside single step process and for some architectures such as arm64 this will causes a bug(). These slots are kprobe process so they should not be probed anyway. Add kprobe_insn_slot check when register_kprobe to forbid probing on these slots. Signed-off-by: Chen Zhongjin --- kernel/kprobes.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/kernel/kprobes.c b/kernel/kprobes.c index f214f8c088ed..3e798b62db70 100644 --- a/kernel/kprobes.c +++ b/kernel/kprobes.c @@ -1562,6 +1562,8 @@ static int check_kprobe_address_safe(struct kprobe *p, /* Ensure it is not in reserved area nor out of text */ if (!kernel_text_address((unsigned long) p->addr) || within_kprobe_blacklist((unsigned long) p->addr) || + is_kprobe_insn_slot((unsigned long) p->addr) || + is_kprobe_optinsn_slot((unsigned long) p->addr) || jump_label_text_reserved(p->addr, p->addr) || static_call_text_reserved(p->addr, p->addr) || find_bug((unsigned long)p->addr)) {