From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753468AbdDLHlF (ORCPT ); Wed, 12 Apr 2017 03:41:05 -0400 Received: from terminus.zytor.com ([65.50.211.136]:36077 "EHLO terminus.zytor.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752395AbdDLHlB (ORCPT ); Wed, 12 Apr 2017 03:41:01 -0400 Date: Wed, 12 Apr 2017 00:35:06 -0700 From: tip-bot for Masami Hiramatsu Message-ID: Cc: mhiramat@kernel.org, davem@davemloft.net, torvalds@linux-foundation.org, brgerst@gmail.com, mingo@kernel.org, hpa@zytor.com, anil.s.keshavamurthy@intel.com, ananth@linux.vnet.ibm.com, jpoimboe@redhat.com, linux-kernel@vger.kernel.org, peterz@infradead.org, aryabinin@virtuozzo.com, xiaolong.ye@intel.com, dvlasenk@redhat.com, tglx@linutronix.de, bp@alien8.de Reply-To: tglx@linutronix.de, dvlasenk@redhat.com, bp@alien8.de, linux-kernel@vger.kernel.org, peterz@infradead.org, aryabinin@virtuozzo.com, xiaolong.ye@intel.com, hpa@zytor.com, anil.s.keshavamurthy@intel.com, ananth@linux.vnet.ibm.com, jpoimboe@redhat.com, torvalds@linux-foundation.org, davem@davemloft.net, mhiramat@kernel.org, brgerst@gmail.com, mingo@kernel.org In-Reply-To: <149076382624.22469.10091613887942958518.stgit@devbox> References: <149076382624.22469.10091613887942958518.stgit@devbox> To: linux-tip-commits@vger.kernel.org Subject: [tip:perf/core] kprobes/x86: Use probe_kernel_read() instead of memcpy() Git-Commit-ID: ea1e34fc366b84e4449b37d86f2222935e29412d X-Mailer: tip-git-log-daemon Robot-ID: Robot-Unsubscribe: Contact to get blacklisted from these emails MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Content-Type: text/plain; charset=UTF-8 Content-Disposition: inline Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Commit-ID: ea1e34fc366b84e4449b37d86f2222935e29412d Gitweb: http://git.kernel.org/tip/ea1e34fc366b84e4449b37d86f2222935e29412d Author: Masami Hiramatsu AuthorDate: Wed, 29 Mar 2017 14:03:56 +0900 Committer: Ingo Molnar CommitDate: Wed, 12 Apr 2017 09:23:47 +0200 kprobes/x86: Use probe_kernel_read() instead of memcpy() Use probe_kernel_read() for avoiding unexpected faults while copying kernel text in __recover_probed_insn(), __recover_optprobed_insn() and __copy_instruction(). Signed-off-by: Masami Hiramatsu Cc: Ananth N Mavinakayanahalli Cc: Andrey Ryabinin Cc: Anil S Keshavamurthy Cc: Borislav Petkov Cc: Brian Gerst Cc: David S . Miller Cc: Denys Vlasenko Cc: H. Peter Anvin Cc: Josh Poimboeuf Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: Ye Xiaolong Link: http://lkml.kernel.org/r/149076382624.22469.10091613887942958518.stgit@devbox Signed-off-by: Ingo Molnar --- arch/x86/kernel/kprobes/core.c | 12 +++++++++--- arch/x86/kernel/kprobes/opt.c | 5 ++++- 2 files changed, 13 insertions(+), 4 deletions(-) diff --git a/arch/x86/kernel/kprobes/core.c b/arch/x86/kernel/kprobes/core.c index 0dc24e6..722f544 100644 --- a/arch/x86/kernel/kprobes/core.c +++ b/arch/x86/kernel/kprobes/core.c @@ -259,7 +259,10 @@ __recover_probed_insn(kprobe_opcode_t *buf, unsigned long addr) * Fortunately, we know that the original code is the ideal 5-byte * long NOP. */ - memcpy(buf, (void *)addr, MAX_INSN_SIZE * sizeof(kprobe_opcode_t)); + if (probe_kernel_read(buf, (void *)addr, + MAX_INSN_SIZE * sizeof(kprobe_opcode_t))) + return 0UL; + if (faddr) memcpy(buf, ideal_nops[NOP_ATOMIC5], 5); else @@ -271,7 +274,7 @@ __recover_probed_insn(kprobe_opcode_t *buf, unsigned long addr) * Recover the probed instruction at addr for further analysis. * Caller must lock kprobes by kprobe_mutex, or disable preemption * for preventing to release referencing kprobes. - * Returns zero if the instruction can not get recovered. + * Returns zero if the instruction can not get recovered (or access failed). */ unsigned long recover_probed_instruction(kprobe_opcode_t *buf, unsigned long addr) { @@ -365,7 +368,10 @@ int __copy_instruction(u8 *dest, u8 *src) /* Another subsystem puts a breakpoint, failed to recover */ if (insn.opcode.bytes[0] == BREAKPOINT_INSTRUCTION) return 0; - memcpy(dest, insn.kaddr, length); + + /* This can access kernel text if given address is not recovered */ + if (kernel_probe_read(dest, insn.kaddr, length)) + return 0; #ifdef CONFIG_X86_64 /* Only x86_64 has RIP relative instructions */ diff --git a/arch/x86/kernel/kprobes/opt.c b/arch/x86/kernel/kprobes/opt.c index b121037..5b52334 100644 --- a/arch/x86/kernel/kprobes/opt.c +++ b/arch/x86/kernel/kprobes/opt.c @@ -65,7 +65,10 @@ found: * overwritten by jump destination address. In this case, original * bytes must be recovered from op->optinsn.copied_insn buffer. */ - memcpy(buf, (void *)addr, MAX_INSN_SIZE * sizeof(kprobe_opcode_t)); + if (probe_kernel_read(buf, (void *)addr, + MAX_INSN_SIZE * sizeof(kprobe_opcode_t))) + return 0UL; + if (addr == (unsigned long)kp->addr) { buf[0] = kp->opcode; memcpy(buf + 1, op->optinsn.copied_insn, RELATIVE_ADDR_SIZE);