Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 0b0122fa authored by Masami Hiramatsu's avatar Masami Hiramatsu Committed by Ingo Molnar
Browse files

x86: kprobes bugfix 



Kprobes for x86-64 may cause a kernel crash if it inserted on "iret"
instruction. "call absolute" is invalid on x86-64, so we don't need
treat it.

 - Change the processing order as same as x86-32.
 - Add "iret"(0xcf) case.
 - Remove next_rip local variable.

Signed-off-by: default avatarMasami Hiramatsu <mhiramat@redhat.com>
Signed-off-by: default avatarIngo Molnar <mingo@elte.hu>
Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
parent 29b6cd79

arch/x86/kernel/kprobes_64.c

+18 −23
Original line number Diff line number Diff line
@@ -485,7 +485,6 @@ static void __kprobes resume_execution(struct kprobe *p, 
		struct pt_regs *regs, struct kprobe_ctlblk *kcb)

{

	unsigned long *tos = (unsigned long *)regs->rsp;

	unsigned long next_rip = 0;

	unsigned long copy_rip = (unsigned long)p->ainsn.insn;

	unsigned long orig_rip = (unsigned long)p->addr;

	kprobe_opcode_t *insn = p->ainsn.insn;
@@ -494,46 +493,42 @@ static void __kprobes resume_execution(struct kprobe *p, 
	if (*insn >= 0x40 && *insn <= 0x4f)

		insn++;



	regs->eflags &= ~TF_MASK;

	switch (*insn) {

	case 0x9c:	/* pushfl */

		*tos &= ~(TF_MASK | IF_MASK);

		*tos |= kcb->kprobe_old_rflags;

		break;

	case 0xc3:		/* ret/lret */

	case 0xcb:

	case 0xc2:

	case 0xc2:	/* iret/ret/lret */

	case 0xc3:

	case 0xca:

		regs->eflags &= ~TF_MASK;

		/* rip is already adjusted, no more changes required*/

		return;

	case 0xcb:

	case 0xcf:

	case 0xea:	/* jmp absolute -- ip is correct */

		/* ip is already adjusted, no more changes required */

		goto no_change;

	case 0xe8:	/* call relative - Fix return addr */

		*tos = orig_rip + (*tos - copy_rip);

		break;

	case 0xff:

		if ((insn[1] & 0x30) == 0x10) {

			/* call absolute, indirect */

			/* Fix return addr; rip is correct. */

			next_rip = regs->rip;

			/* Fix return addr; ip is correct. */

			*tos = orig_rip + (*tos - copy_rip);

			goto no_change;

		} else if (((insn[1] & 0x31) == 0x20) ||	/* jmp near, absolute indirect */

			   ((insn[1] & 0x31) == 0x21)) {	/* jmp far, absolute indirect */

			/* rip is correct. */

			next_rip = regs->rip;

			/* ip is correct. */

			goto no_change;

		}

		break;

	case 0xea:		/* jmp absolute -- rip is correct */

		next_rip = regs->rip;

		break;

	default:

		break;

	}



	regs->eflags &= ~TF_MASK;

	if (next_rip) {

		regs->rip = next_rip;

	} else {

	regs->rip = orig_rip + (regs->rip - copy_rip);

	}

no_change:



	return;

}



int __kprobes post_kprobe_handler(struct pt_regs *regs)