* [v2 PATCH] arm64: kprobes: call set_memory_rox() for kprobe page
@ 2025-09-18 16:23 Yang Shi
2025-09-18 17:26 ` Will Deacon
0 siblings, 1 reply; 6+ messages in thread
From: Yang Shi @ 2025-09-18 16:23 UTC (permalink / raw)
To: catalin.marinas, will, ryan.roberts
Cc: yang, linux-arm-kernel, linux-kernel, stable
The kprobe page is allocated by execmem allocator with ROX permission.
It needs to call set_memory_rox() to set proper permission for the
direct map too. It was missed.
Fixes: 10d5e97c1bf8 ("arm64: use PAGE_KERNEL_ROX directly in alloc_insn_page")
Cc: <stable@vger.kernel.org>
Signed-off-by: Yang Shi <yang@os.amperecomputing.com>
Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
---
v2: Separated the patch from BBML2 series since it is an orthogonal bug
fix per Ryan.
Fixed the variable name nit per Catalin.
Collected R-bs from Catalin.
arch/arm64/kernel/probes/kprobes.c | 12 ++++++++++++
1 file changed, 12 insertions(+)
diff --git a/arch/arm64/kernel/probes/kprobes.c b/arch/arm64/kernel/probes/kprobes.c
index 0c5d408afd95..8ab6104a4883 100644
--- a/arch/arm64/kernel/probes/kprobes.c
+++ b/arch/arm64/kernel/probes/kprobes.c
@@ -10,6 +10,7 @@
#define pr_fmt(fmt) "kprobes: " fmt
+#include <linux/execmem.h>
#include <linux/extable.h>
#include <linux/kasan.h>
#include <linux/kernel.h>
@@ -41,6 +42,17 @@ DEFINE_PER_CPU(struct kprobe_ctlblk, kprobe_ctlblk);
static void __kprobes
post_kprobe_handler(struct kprobe *, struct kprobe_ctlblk *, struct pt_regs *);
+void *alloc_insn_page(void)
+{
+ void *addr;
+
+ addr = execmem_alloc(EXECMEM_KPROBES, PAGE_SIZE);
+ if (!addr)
+ return NULL;
+ set_memory_rox((unsigned long)addr, 1);
+ return addr;
+}
+
static void __kprobes arch_prepare_ss_slot(struct kprobe *p)
{
kprobe_opcode_t *addr = p->ainsn.xol_insn;
--
2.47.0
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [v2 PATCH] arm64: kprobes: call set_memory_rox() for kprobe page
2025-09-18 16:23 [v2 PATCH] arm64: kprobes: call set_memory_rox() for kprobe page Yang Shi
@ 2025-09-18 17:26 ` Will Deacon
2025-09-18 17:33 ` Yang Shi
2025-09-19 4:01 ` Dev Jain
0 siblings, 2 replies; 6+ messages in thread
From: Will Deacon @ 2025-09-18 17:26 UTC (permalink / raw)
To: Yang Shi
Cc: catalin.marinas, ryan.roberts, linux-arm-kernel, linux-kernel,
stable
On Thu, Sep 18, 2025 at 09:23:49AM -0700, Yang Shi wrote:
> The kprobe page is allocated by execmem allocator with ROX permission.
> It needs to call set_memory_rox() to set proper permission for the
> direct map too. It was missed.
>
> Fixes: 10d5e97c1bf8 ("arm64: use PAGE_KERNEL_ROX directly in alloc_insn_page")
> Cc: <stable@vger.kernel.org>
> Signed-off-by: Yang Shi <yang@os.amperecomputing.com>
> Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
> ---
> v2: Separated the patch from BBML2 series since it is an orthogonal bug
> fix per Ryan.
> Fixed the variable name nit per Catalin.
> Collected R-bs from Catalin.
>
> arch/arm64/kernel/probes/kprobes.c | 12 ++++++++++++
> 1 file changed, 12 insertions(+)
>
> diff --git a/arch/arm64/kernel/probes/kprobes.c b/arch/arm64/kernel/probes/kprobes.c
> index 0c5d408afd95..8ab6104a4883 100644
> --- a/arch/arm64/kernel/probes/kprobes.c
> +++ b/arch/arm64/kernel/probes/kprobes.c
> @@ -10,6 +10,7 @@
>
> #define pr_fmt(fmt) "kprobes: " fmt
>
> +#include <linux/execmem.h>
> #include <linux/extable.h>
> #include <linux/kasan.h>
> #include <linux/kernel.h>
> @@ -41,6 +42,17 @@ DEFINE_PER_CPU(struct kprobe_ctlblk, kprobe_ctlblk);
> static void __kprobes
> post_kprobe_handler(struct kprobe *, struct kprobe_ctlblk *, struct pt_regs *);
>
> +void *alloc_insn_page(void)
> +{
> + void *addr;
> +
> + addr = execmem_alloc(EXECMEM_KPROBES, PAGE_SIZE);
> + if (!addr)
> + return NULL;
> + set_memory_rox((unsigned long)addr, 1);
> + return addr;
> +}
Why isn't execmem taking care of this? It looks to me like the
execmem_cache_alloc() path calls set_memory_rox() but the
execmem_vmalloc() path doesn't?
It feels a bit bizarre to me that we have to provide our own wrapper
(which is identical to what s390 does). Also, how does alloc_insn_page()
handle the direct map alias on x86?
Will
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [v2 PATCH] arm64: kprobes: call set_memory_rox() for kprobe page
2025-09-18 17:26 ` Will Deacon
@ 2025-09-18 17:33 ` Yang Shi
2025-09-21 7:36 ` Mike Rapoport
2025-09-19 4:01 ` Dev Jain
1 sibling, 1 reply; 6+ messages in thread
From: Yang Shi @ 2025-09-18 17:33 UTC (permalink / raw)
To: Will Deacon, Mike Rapoport
Cc: catalin.marinas, ryan.roberts, linux-arm-kernel, linux-kernel,
stable
On 9/18/25 10:26 AM, Will Deacon wrote:
> On Thu, Sep 18, 2025 at 09:23:49AM -0700, Yang Shi wrote:
>> The kprobe page is allocated by execmem allocator with ROX permission.
>> It needs to call set_memory_rox() to set proper permission for the
>> direct map too. It was missed.
>>
>> Fixes: 10d5e97c1bf8 ("arm64: use PAGE_KERNEL_ROX directly in alloc_insn_page")
>> Cc: <stable@vger.kernel.org>
>> Signed-off-by: Yang Shi <yang@os.amperecomputing.com>
>> Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
>> ---
>> v2: Separated the patch from BBML2 series since it is an orthogonal bug
>> fix per Ryan.
>> Fixed the variable name nit per Catalin.
>> Collected R-bs from Catalin.
>>
>> arch/arm64/kernel/probes/kprobes.c | 12 ++++++++++++
>> 1 file changed, 12 insertions(+)
>>
>> diff --git a/arch/arm64/kernel/probes/kprobes.c b/arch/arm64/kernel/probes/kprobes.c
>> index 0c5d408afd95..8ab6104a4883 100644
>> --- a/arch/arm64/kernel/probes/kprobes.c
>> +++ b/arch/arm64/kernel/probes/kprobes.c
>> @@ -10,6 +10,7 @@
>>
>> #define pr_fmt(fmt) "kprobes: " fmt
>>
>> +#include <linux/execmem.h>
>> #include <linux/extable.h>
>> #include <linux/kasan.h>
>> #include <linux/kernel.h>
>> @@ -41,6 +42,17 @@ DEFINE_PER_CPU(struct kprobe_ctlblk, kprobe_ctlblk);
>> static void __kprobes
>> post_kprobe_handler(struct kprobe *, struct kprobe_ctlblk *, struct pt_regs *);
>>
>> +void *alloc_insn_page(void)
>> +{
>> + void *addr;
>> +
>> + addr = execmem_alloc(EXECMEM_KPROBES, PAGE_SIZE);
>> + if (!addr)
>> + return NULL;
>> + set_memory_rox((unsigned long)addr, 1);
>> + return addr;
>> +}
> Why isn't execmem taking care of this? It looks to me like the
> execmem_cache_alloc() path calls set_memory_rox() but the
> execmem_vmalloc() path doesn't?
execmem_cache_alloc() is just called if execmem ROX cache is enabled,
but it currently just supported by x86. Included Mike to this thread who
is the author of execmem ROX cache.
>
> It feels a bit bizarre to me that we have to provide our own wrapper
> (which is identical to what s390 does). Also, how does alloc_insn_page()
> handle the direct map alias on x86?
x86 handles it via execmem ROX cache.
Thanks,
Yang
>
> Will
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [v2 PATCH] arm64: kprobes: call set_memory_rox() for kprobe page
2025-09-18 17:26 ` Will Deacon
2025-09-18 17:33 ` Yang Shi
@ 2025-09-19 4:01 ` Dev Jain
1 sibling, 0 replies; 6+ messages in thread
From: Dev Jain @ 2025-09-19 4:01 UTC (permalink / raw)
To: Will Deacon, Yang Shi
Cc: catalin.marinas, ryan.roberts, linux-arm-kernel, linux-kernel,
stable
On 18/09/25 10:56 pm, Will Deacon wrote:
> On Thu, Sep 18, 2025 at 09:23:49AM -0700, Yang Shi wrote:
>> The kprobe page is allocated by execmem allocator with ROX permission.
>> It needs to call set_memory_rox() to set proper permission for the
>> direct map too. It was missed.
>>
>> Fixes: 10d5e97c1bf8 ("arm64: use PAGE_KERNEL_ROX directly in alloc_insn_page")
>> Cc: <stable@vger.kernel.org>
>> Signed-off-by: Yang Shi <yang@os.amperecomputing.com>
>> Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
>> ---
>> v2: Separated the patch from BBML2 series since it is an orthogonal bug
>> fix per Ryan.
>> Fixed the variable name nit per Catalin.
>> Collected R-bs from Catalin.
>>
>> arch/arm64/kernel/probes/kprobes.c | 12 ++++++++++++
>> 1 file changed, 12 insertions(+)
>>
>> diff --git a/arch/arm64/kernel/probes/kprobes.c b/arch/arm64/kernel/probes/kprobes.c
>> index 0c5d408afd95..8ab6104a4883 100644
>> --- a/arch/arm64/kernel/probes/kprobes.c
>> +++ b/arch/arm64/kernel/probes/kprobes.c
>> @@ -10,6 +10,7 @@
>>
>> #define pr_fmt(fmt) "kprobes: " fmt
>>
>> +#include <linux/execmem.h>
>> #include <linux/extable.h>
>> #include <linux/kasan.h>
>> #include <linux/kernel.h>
>> @@ -41,6 +42,17 @@ DEFINE_PER_CPU(struct kprobe_ctlblk, kprobe_ctlblk);
>> static void __kprobes
>> post_kprobe_handler(struct kprobe *, struct kprobe_ctlblk *, struct pt_regs *);
>>
>> +void *alloc_insn_page(void)
>> +{
>> + void *addr;
>> +
>> + addr = execmem_alloc(EXECMEM_KPROBES, PAGE_SIZE);
>> + if (!addr)
>> + return NULL;
>> + set_memory_rox((unsigned long)addr, 1);
>> + return addr;
>> +}
> Why isn't execmem taking care of this? It looks to me like the
> execmem_cache_alloc() path calls set_memory_rox() but the
> execmem_vmalloc() path doesn't?
Ryan has raised this issue here -
https://lore.kernel.org/all/d4019be7-e24c-4715-a42a-4f1fc39a9bd4@arm.com/
>
> It feels a bit bizarre to me that we have to provide our own wrapper
> (which is identical to what s390 does). Also, how does alloc_insn_page()
> handle the direct map alias on x86?
>
> Will
>
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [v2 PATCH] arm64: kprobes: call set_memory_rox() for kprobe page
2025-09-18 17:33 ` Yang Shi
@ 2025-09-21 7:36 ` Mike Rapoport
2025-09-23 17:43 ` Yang Shi
0 siblings, 1 reply; 6+ messages in thread
From: Mike Rapoport @ 2025-09-21 7:36 UTC (permalink / raw)
To: Yang Shi
Cc: Will Deacon, catalin.marinas, ryan.roberts, linux-arm-kernel,
linux-kernel, stable
On Thu, Sep 18, 2025 at 10:33:26AM -0700, Yang Shi wrote:
>
>
> On 9/18/25 10:26 AM, Will Deacon wrote:
> > On Thu, Sep 18, 2025 at 09:23:49AM -0700, Yang Shi wrote:
> > > The kprobe page is allocated by execmem allocator with ROX permission.
> > > It needs to call set_memory_rox() to set proper permission for the
> > > direct map too. It was missed.
> > >
> > > Fixes: 10d5e97c1bf8 ("arm64: use PAGE_KERNEL_ROX directly in alloc_insn_page")
> > > Cc: <stable@vger.kernel.org>
> > > Signed-off-by: Yang Shi <yang@os.amperecomputing.com>
> > > Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
> > > ---
> > > v2: Separated the patch from BBML2 series since it is an orthogonal bug
> > > fix per Ryan.
> > > Fixed the variable name nit per Catalin.
> > > Collected R-bs from Catalin.
> > >
> > > arch/arm64/kernel/probes/kprobes.c | 12 ++++++++++++
> > > 1 file changed, 12 insertions(+)
> > >
> > > diff --git a/arch/arm64/kernel/probes/kprobes.c b/arch/arm64/kernel/probes/kprobes.c
> > > index 0c5d408afd95..8ab6104a4883 100644
> > > --- a/arch/arm64/kernel/probes/kprobes.c
> > > +++ b/arch/arm64/kernel/probes/kprobes.c
> > > @@ -10,6 +10,7 @@
> > > #define pr_fmt(fmt) "kprobes: " fmt
> > > +#include <linux/execmem.h>
> > > #include <linux/extable.h>
> > > #include <linux/kasan.h>
> > > #include <linux/kernel.h>
> > > @@ -41,6 +42,17 @@ DEFINE_PER_CPU(struct kprobe_ctlblk, kprobe_ctlblk);
> > > static void __kprobes
> > > post_kprobe_handler(struct kprobe *, struct kprobe_ctlblk *, struct pt_regs *);
> > > +void *alloc_insn_page(void)
> > > +{
> > > + void *addr;
> > > +
> > > + addr = execmem_alloc(EXECMEM_KPROBES, PAGE_SIZE);
> > > + if (!addr)
> > > + return NULL;
> > > + set_memory_rox((unsigned long)addr, 1);
> > > + return addr;
> > > +}
> > Why isn't execmem taking care of this? It looks to me like the
> > execmem_cache_alloc() path calls set_memory_rox() but the
> > execmem_vmalloc() path doesn't?
execmem_alloc() -> execmem_vmalloc() consolidated __vmalloc_node_range()
for executable allocations. Those also didn't update the linear map alias.
It could be added to execmem_vmalloc(), but as of now we don't have a way
for generic code to tell which set_memory method to call based on pgprot,
so making execmem_vmalloc() to deal with direct map alias is quite
involved.
It would be easier to just remove the direct map alias. It works on x86 so
I don't see what can possibly go wrong :)
> execmem_cache_alloc() is just called if execmem ROX cache is enabled, but it
> currently just supported by x86. Included Mike to this thread who is the
> author of execmem ROX cache.
>
> >
> > It feels a bit bizarre to me that we have to provide our own wrapper
> > (which is identical to what s390 does). Also, how does alloc_insn_page()
> > handle the direct map alias on x86?
s390 had its version of alloc_insn_page() long before execmem so there I
just replaced module_alloc() with exemem_alloc().
arm64 version of alloc_insn_page() didn't update the direct map before
execmem, so I overlooked this issue when I was converting arm64 to execmem.
> x86 handles it via execmem ROX cache.
>
> Thanks,
> Yang
>
> >
> > Will
>
--
Sincerely yours,
Mike.
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [v2 PATCH] arm64: kprobes: call set_memory_rox() for kprobe page
2025-09-21 7:36 ` Mike Rapoport
@ 2025-09-23 17:43 ` Yang Shi
0 siblings, 0 replies; 6+ messages in thread
From: Yang Shi @ 2025-09-23 17:43 UTC (permalink / raw)
To: Mike Rapoport
Cc: Will Deacon, catalin.marinas, ryan.roberts, linux-arm-kernel,
linux-kernel, stable
On 9/21/25 12:36 AM, Mike Rapoport wrote:
> On Thu, Sep 18, 2025 at 10:33:26AM -0700, Yang Shi wrote:
>>
>> On 9/18/25 10:26 AM, Will Deacon wrote:
>>> On Thu, Sep 18, 2025 at 09:23:49AM -0700, Yang Shi wrote:
>>>> The kprobe page is allocated by execmem allocator with ROX permission.
>>>> It needs to call set_memory_rox() to set proper permission for the
>>>> direct map too. It was missed.
>>>>
>>>> Fixes: 10d5e97c1bf8 ("arm64: use PAGE_KERNEL_ROX directly in alloc_insn_page")
>>>> Cc: <stable@vger.kernel.org>
>>>> Signed-off-by: Yang Shi <yang@os.amperecomputing.com>
>>>> Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
>>>> ---
>>>> v2: Separated the patch from BBML2 series since it is an orthogonal bug
>>>> fix per Ryan.
>>>> Fixed the variable name nit per Catalin.
>>>> Collected R-bs from Catalin.
>>>>
>>>> arch/arm64/kernel/probes/kprobes.c | 12 ++++++++++++
>>>> 1 file changed, 12 insertions(+)
>>>>
>>>> diff --git a/arch/arm64/kernel/probes/kprobes.c b/arch/arm64/kernel/probes/kprobes.c
>>>> index 0c5d408afd95..8ab6104a4883 100644
>>>> --- a/arch/arm64/kernel/probes/kprobes.c
>>>> +++ b/arch/arm64/kernel/probes/kprobes.c
>>>> @@ -10,6 +10,7 @@
>>>> #define pr_fmt(fmt) "kprobes: " fmt
>>>> +#include <linux/execmem.h>
>>>> #include <linux/extable.h>
>>>> #include <linux/kasan.h>
>>>> #include <linux/kernel.h>
>>>> @@ -41,6 +42,17 @@ DEFINE_PER_CPU(struct kprobe_ctlblk, kprobe_ctlblk);
>>>> static void __kprobes
>>>> post_kprobe_handler(struct kprobe *, struct kprobe_ctlblk *, struct pt_regs *);
>>>> +void *alloc_insn_page(void)
>>>> +{
>>>> + void *addr;
>>>> +
>>>> + addr = execmem_alloc(EXECMEM_KPROBES, PAGE_SIZE);
>>>> + if (!addr)
>>>> + return NULL;
>>>> + set_memory_rox((unsigned long)addr, 1);
>>>> + return addr;
>>>> +}
>>> Why isn't execmem taking care of this? It looks to me like the
>>> execmem_cache_alloc() path calls set_memory_rox() but the
>>> execmem_vmalloc() path doesn't?
> execmem_alloc() -> execmem_vmalloc() consolidated __vmalloc_node_range()
> for executable allocations. Those also didn't update the linear map alias.
>
> It could be added to execmem_vmalloc(), but as of now we don't have a way
> for generic code to tell which set_memory method to call based on pgprot,
> so making execmem_vmalloc() to deal with direct map alias is quite
> involved.
>
> It would be easier to just remove the direct map alias. It works on x86 so
> I don't see what can possibly go wrong :)
>
>> execmem_cache_alloc() is just called if execmem ROX cache is enabled, but it
>> currently just supported by x86. Included Mike to this thread who is the
>> author of execmem ROX cache.
>>
>>> It feels a bit bizarre to me that we have to provide our own wrapper
>>> (which is identical to what s390 does). Also, how does alloc_insn_page()
>>> handle the direct map alias on x86?
> s390 had its version of alloc_insn_page() long before execmem so there I
> just replaced module_alloc() with exemem_alloc().
>
> arm64 version of alloc_insn_page() didn't update the direct map before
> execmem, so I overlooked this issue when I was converting arm64 to execmem.
Thanks, Mike. It is not your fault. The set_memory_rox() was called in
arm64's alloc_insn_page() before, but it was mistakenly removed by
commit 10d5e97c1bf8 ("arm64: use PAGE_KERNEL_ROX directly in
alloc_insn_page") before execmem.
Yang
>
>> x86 handles it via execmem ROX cache.
>>
>> Thanks,
>> Yang
>>
>>> Will
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2025-09-23 17:43 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-09-18 16:23 [v2 PATCH] arm64: kprobes: call set_memory_rox() for kprobe page Yang Shi
2025-09-18 17:26 ` Will Deacon
2025-09-18 17:33 ` Yang Shi
2025-09-21 7:36 ` Mike Rapoport
2025-09-23 17:43 ` Yang Shi
2025-09-19 4:01 ` Dev Jain
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox