Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 57526050 authored by Masami Hiramatsu's avatar Masami Hiramatsu Committed by Greg Kroah-Hartman
Browse files

x86/kprobes: Avoid kretprobe recursion bug 



[ Upstream commit b191fa96ea6dc00d331dcc28c1f7db5e075693a0 ]

Avoid kretprobe recursion loop bg by setting a dummy
kprobes to current_kprobe per-CPU variable.

This bug has been introduced with the asm-coded trampoline
code, since previously it used another kprobe for hooking
the function return placeholder (which only has a nop) and
trampoline handler was called from that kprobe.

This revives the old lost kprobe again.

With this fix, we don't see deadlock anymore.

And you can see that all inner-called kretprobe are skipped.

  event_1                                  235               0
  event_2                                19375           19612

The 1st column is recorded count and the 2nd is missed count.
Above shows (event_1 rec) + (event_2 rec) ~= (event_2 missed)
(some difference are here because the counter is racy)

Reported-by: default avatarAndrea Righi <righi.andrea@gmail.com>
Tested-by: default avatarAndrea Righi <righi.andrea@gmail.com>
Signed-off-by: default avatarMasami Hiramatsu <mhiramat@kernel.org>
Acked-by: default avatarSteven Rostedt <rostedt@goodmis.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: stable@vger.kernel.org
Fixes: c9becf58 ("[PATCH] kretprobe: kretprobe-booster")
Link: http://lkml.kernel.org/r/155094064889.6137.972160690963039.stgit@devbox


Signed-off-by: default avatarIngo Molnar <mingo@kernel.org>
Signed-off-by: default avatarSasha Levin <alexander.levin@microsoft.com>
parent 322a5755

arch/x86/kernel/kprobes/core.c

+20 −2
Original line number Diff line number Diff line
@@ -749,11 +749,16 @@ asm( 
NOKPROBE_SYMBOL(kretprobe_trampoline);

STACK_FRAME_NON_STANDARD(kretprobe_trampoline);



static struct kprobe kretprobe_kprobe = {

	.addr = (void *)kretprobe_trampoline,

};



/*

 * Called from kretprobe_trampoline

 */

__visible __used void *trampoline_handler(struct pt_regs *regs)

{

	struct kprobe_ctlblk *kcb;

	struct kretprobe_instance *ri = NULL;

	struct hlist_head *head, empty_rp;

	struct hlist_node *tmp;
@@ -763,6 +768,17 @@ __visible __used void *trampoline_handler(struct pt_regs *regs) 
	void *frame_pointer;

	bool skipped = false;



	preempt_disable();



	/*

	 * Set a dummy kprobe for avoiding kretprobe recursion.

	 * Since kretprobe never run in kprobe handler, kprobe must not

	 * be running at this point.

	 */

	kcb = get_kprobe_ctlblk();

	__this_cpu_write(current_kprobe, &kretprobe_kprobe);

	kcb->kprobe_status = KPROBE_HIT_ACTIVE;



	INIT_HLIST_HEAD(&empty_rp);

	kretprobe_hash_lock(current, &head, &flags);

	/* fixup registers */
@@ -838,10 +854,9 @@ __visible __used void *trampoline_handler(struct pt_regs *regs) 
		orig_ret_address = (unsigned long)ri->ret_addr;

		if (ri->rp && ri->rp->handler) {

			__this_cpu_write(current_kprobe, &ri->rp->kp);

			get_kprobe_ctlblk()->kprobe_status = KPROBE_HIT_ACTIVE;

			ri->ret_addr = correct_ret_addr;

			ri->rp->handler(ri, regs);

			__this_cpu_write(current_kprobe, NULL);

			__this_cpu_write(current_kprobe, &kretprobe_kprobe);

		}



		recycle_rp_inst(ri, &empty_rp);
@@ -857,6 +872,9 @@ __visible __used void *trampoline_handler(struct pt_regs *regs) 


	kretprobe_hash_unlock(current, &flags);



	__this_cpu_write(current_kprobe, NULL);

	preempt_enable();



	hlist_for_each_entry_safe(ri, tmp, &empty_rp, hlist) {

		hlist_del(&ri->hlist);

		kfree(ri);