From: Oleg Nesterov <oleg@redhat.com>
To: Ingo Molnar <mingo@elte.hu>,
Srikar Dronamraju <srikar@linux.vnet.ibm.com>
Cc: Ananth N Mavinakayanahalli <ananth@in.ibm.com>,
Anton Arapov <aarapov@redhat.com>,
David Long <dave.long@linaro.org>,
Denys Vlasenko <dvlasenk@redhat.com>,
"Frank Ch. Eigler" <fche@redhat.com>,
Jim Keniston <jkenisto@us.ibm.com>,
Jonathan Lebon <jlebon@redhat.com>,
Masami Hiramatsu <masami.hiramatsu.pt@hitachi.com>,
linux-kernel@vger.kernel.org
Subject: [PATCH v3 10/15] uprobes/x86: Introduce sizeof_long(), cleanup adjust_ret_addr() and arch_uretprobe_hijack_return_addr()
Date: Sun, 13 Apr 2014 19:45:56 +0200 [thread overview]
Message-ID: <20140413174556.GA11878@redhat.com> (raw)
In-Reply-To: <20140413174508.GA11811@redhat.com>
1. Add the trivial sizeof_long() helper and change other callers of
is_ia32_task() to use it.
TODO: is_ia32_task() is not what we actually want, TS_COMPAT does
not necessarily mean 32bit. Fortunately syscall-like insns can't be
probed so it actually works, but it would be better to rename and
use is_ia32_frame().
2. As Jim pointed out "ncopied" in arch_uretprobe_hijack_return_addr()
and adjust_ret_addr() should be named "nleft". And in fact only the
last copy_to_user() in arch_uretprobe_hijack_return_addr() actually
needs to inspect the non-zero error code.
TODO: adjust_ret_addr() should die. We can always calculate the value
we need to write into *regs->sp, just UPROBE_FIX_CALL should record
insn->length.
Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Reviewed-by: Jim Keniston <jkenisto@us.ibm.com>
---
arch/x86/kernel/uprobes.c | 37 +++++++++++++++----------------------
1 files changed, 15 insertions(+), 22 deletions(-)
diff --git a/arch/x86/kernel/uprobes.c b/arch/x86/kernel/uprobes.c
index 1ea7e1a..ef59ef9 100644
--- a/arch/x86/kernel/uprobes.c
+++ b/arch/x86/kernel/uprobes.c
@@ -408,6 +408,11 @@ struct uprobe_xol_ops {
int (*post_xol)(struct arch_uprobe *, struct pt_regs *);
};
+static inline int sizeof_long(void)
+{
+ return is_ia32_task() ? 4 : 8;
+}
+
static int default_pre_xol_op(struct arch_uprobe *auprobe, struct pt_regs *regs)
{
pre_xol_rip_insn(auprobe, regs, ¤t->utask->autask);
@@ -419,21 +424,14 @@ static int default_pre_xol_op(struct arch_uprobe *auprobe, struct pt_regs *regs)
*/
static int adjust_ret_addr(unsigned long sp, long correction)
{
- int rasize, ncopied;
- long ra = 0;
-
- if (is_ia32_task())
- rasize = 4;
- else
- rasize = 8;
+ int rasize = sizeof_long();
+ long ra;
- ncopied = copy_from_user(&ra, (void __user *)sp, rasize);
- if (unlikely(ncopied))
+ if (copy_from_user(&ra, (void __user *)sp, rasize))
return -EFAULT;
ra += correction;
- ncopied = copy_to_user((void __user *)sp, &ra, rasize);
- if (unlikely(ncopied))
+ if (copy_to_user((void __user *)sp, &ra, rasize))
return -EFAULT;
return 0;
@@ -450,10 +448,7 @@ static int default_post_xol_op(struct arch_uprobe *auprobe, struct pt_regs *regs
if (auprobe->fixups & UPROBE_FIX_CALL) {
if (adjust_ret_addr(regs->sp, correction)) {
- if (is_ia32_task())
- regs->sp += 4;
- else
- regs->sp += 8;
+ regs->sp += sizeof_long();
return -ERESTART;
}
}
@@ -716,23 +711,21 @@ if (ret) pr_crit("EMULATE: %lx -> %lx\n", ip, regs->ip);
unsigned long
arch_uretprobe_hijack_return_addr(unsigned long trampoline_vaddr, struct pt_regs *regs)
{
- int rasize, ncopied;
+ int rasize = sizeof_long(), nleft;
unsigned long orig_ret_vaddr = 0; /* clear high bits for 32-bit apps */
- rasize = is_ia32_task() ? 4 : 8;
- ncopied = copy_from_user(&orig_ret_vaddr, (void __user *)regs->sp, rasize);
- if (unlikely(ncopied))
+ if (copy_from_user(&orig_ret_vaddr, (void __user *)regs->sp, rasize))
return -1;
/* check whether address has been already hijacked */
if (orig_ret_vaddr == trampoline_vaddr)
return orig_ret_vaddr;
- ncopied = copy_to_user((void __user *)regs->sp, &trampoline_vaddr, rasize);
- if (likely(!ncopied))
+ nleft = copy_to_user((void __user *)regs->sp, &trampoline_vaddr, rasize);
+ if (likely(!nleft))
return orig_ret_vaddr;
- if (ncopied != rasize) {
+ if (nleft != rasize) {
pr_err("uprobe: return address clobbered: pid=%d, %%sp=%#lx, "
"%%ip=%#lx\n", current->pid, regs->sp, regs->ip);
--
1.5.5.1
next prev parent reply other threads:[~2014-04-13 17:46 UTC|newest]
Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top
2014-04-13 17:45 [PATCH v3 00/15] uprobes/x86: fix the handling of relative jmp's/call's Oleg Nesterov
2014-04-13 17:45 ` [PATCH v3 01/15] uprobes: Kill UPROBE_SKIP_SSTEP and can_skip_sstep() Oleg Nesterov
2014-04-13 17:45 ` [PATCH v3 02/15] uprobes/x86: Fold prepare_fixups() into arch_uprobe_analyze_insn() Oleg Nesterov
2014-04-13 17:45 ` [PATCH v3 03/15] uprobes/x86: Kill the "ia32_compat" check in handle_riprel_insn(), remove "mm" arg Oleg Nesterov
2014-04-13 17:45 ` [PATCH v3 04/15] uprobes/x86: Gather "riprel" functions together Oleg Nesterov
2014-04-13 17:45 ` [PATCH v3 05/15] uprobes/x86: move the UPROBE_FIX_{RIP,IP,CALL} code at the end of pre/post hooks Oleg Nesterov
2014-04-13 17:45 ` [PATCH v3 06/15] uprobes/x86: Introduce uprobe_xol_ops and arch_uprobe->ops Oleg Nesterov
2014-04-13 17:45 ` [PATCH v3 07/15] uprobes/x86: Conditionalize the usage of handle_riprel_insn() Oleg Nesterov
2014-04-13 17:45 ` [PATCH v3 08/15] uprobes/x86: Send SIGILL if arch_uprobe_post_xol() fails Oleg Nesterov
2014-04-13 17:45 ` [PATCH v3 09/15] uprobes/x86: Teach arch_uprobe_post_xol() to restart if possible Oleg Nesterov
2014-04-13 17:45 ` Oleg Nesterov [this message]
2014-04-13 17:46 ` [PATCH v3 11/15] uprobes/x86: Emulate unconditional relative jmp's Oleg Nesterov
2014-04-13 17:46 ` [PATCH v3 12/15] uprobes/x86: Emulate nop's using ops->emulate() Oleg Nesterov
2014-04-13 17:46 ` [PATCH v3 13/15] uprobes/x86: Emulate relative call's Oleg Nesterov
2014-04-13 17:46 ` [PATCH v3 14/15] uprobes/x86: Emulate relative conditional "short" jmp's Oleg Nesterov
2014-04-13 17:46 ` [PATCH v3 15/15] uprobes/x86: Emulate relative conditional "near" jmp's Oleg Nesterov
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20140413174556.GA11878@redhat.com \
--to=oleg@redhat.com \
--cc=aarapov@redhat.com \
--cc=ananth@in.ibm.com \
--cc=dave.long@linaro.org \
--cc=dvlasenk@redhat.com \
--cc=fche@redhat.com \
--cc=jkenisto@us.ibm.com \
--cc=jlebon@redhat.com \
--cc=linux-kernel@vger.kernel.org \
--cc=masami.hiramatsu.pt@hitachi.com \
--cc=mingo@elte.hu \
--cc=srikar@linux.vnet.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.