Re: [PATCH] x86/kprobes: Fix optprobe to detect padding int3 correctly

[Adam Zabrocki <pi3@pi3.com.pl>]

Hi,

I've applied this patch on the top of kernel 5.9.7 and verified it works 
fine:

ffffffff813050e0 <ftrace_enable_sysctl>:
...
...
ffffffff813052f1:       e9 fe fe ff ff          jmpq   ffffffff813051f4 <ftrace_enable_sysctl+0x114>
ffffffff813052f6:       cc                      int3
ffffffff813052f7:       cc                      int3
ffffffff813052f8:       cc                      int3
ffffffff813052f9:       cc                      int3
ffffffff813052fa:       cc                      int3
ffffffff813052fb:       cc                      int3
ffffffff813052fc:       cc                      int3
ffffffff813052fd:       cc                      int3
ffffffff813052fe:       cc                      int3
ffffffff813052ff:       cc                      int3

When I install KRETPROBE on this function, it is correctly optimized:

root@pi3:~/off-debug/git/lkrg# cat /sys/kernel/debug/kprobes/list|grep ftrace_enable_sysctl
ffffffff813050e0  r  ftrace_enable_sysctl+0x0    [OPTIMIZED]
root@pi3:~/off-debug/git/lkrg# 

gef➤  x/2i ftrace_enable_sysctl
   0xffffffff813050e0 <ftrace_enable_sysctl>:   jmp    0xffffffffc062807a
   0xffffffff813050e5 <ftrace_enable_sysctl+5>: push   r14

Thanks,
Adam

On Fri, Dec 11, 2020 at 11:39:15AM -0800, Kees Cook wrote:
> On Fri, Dec 11, 2020 at 04:04:17PM +0900, Masami Hiramatsu wrote:
> > Fix optprobe to detect padding int3 correctly.
> > 
> > Since commit 7705dc855797 ("x86/vmlinux: Use INT3 instead of NOP
> > for linker fill bytes") changed the padding bytes between functions
> > from nop to int3, when optprobe decodes a target function it finds
> > int3 and gives up the jump optimization.
> > 
> > Instead of giving up any int3 detection, this checks whether the
> > rest of bytes to the end of the function are int3 or not. If all
> > of those are int3, those come from the linker. In that case,
> > optprobe continues jump optimization.
> > 
> > Fixes: 7705dc855797 ("x86/vmlinux: Use INT3 instead of NOP for linker fill bytes")
> > Cc: stable@vger.kernel.org
> > Reported-by: Adam Zabrocki <pi3@pi3.com.pl>
> > Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
> 
> Reviewed-by: Kees Cook <keescook@chromium.org>
> 
> -- 
> Kees Cook

-- 
pi3 (pi3ki31ny) - pi3 (at) itsec pl
http://pi3.com.pl