[PATCH -tip 0/2] x86/kprobes: Fix 2 issues related to text_poke_bp and optprobe

Masami Hiramatsu
2019-11-27T05:56:49Z

Hi,

Here are the patches which I've faced while testing ftracetest
without function tracer. While investigating I found there were
2 different bugs there.

The 1st bug is a timing bug caused by wrong global variable
update and syncing in text_poke_bp_batch(). This can cause a
kernel panic if we hit int3 in between bp_patching.vec = NULL
and bp_patching.nr_entries = 0. This is actually a wrong order
and no synchronization. Steve suggested we can fix it with
reordering and adding sync_core() between them.

The 2nd bug is in the optprobe, which is caused by wrong flag
update order. Currently kprobes update optimized flag before
unoptimizing code. But if the kprobe is hit unoptimizing
intermediate state, it can go back from int3 to the middle of
modified instruction and cause a kernel panic. This can be
fixed by updating flag after unoptimized code.

Thank you,

---

Masami Hiramatsu (2):
x86/alternative: Sync bp_patching update for avoiding NULL pointer exception
kprobes: Set unoptimized flag after unoptimizing code

arch/x86/kernel/alternative.c | 8 +++++++-
kernel/kprobes.c | 4 +++-
2 files changed, 10 insertions(+), 2 deletions(-)

--
Masami Hiramatsu (Linaro) <mhiramat@kernel.org>