lkml.org 
[lkml]   [2021]   [Sep]   [14]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH -tip v11 24/27] x86/kprobes: Push a fake return address at kretprobe_trampoline
    Date
    Change __kretprobe_trampoline() to push the address of the
    __kretprobe_trampoline() as a fake return address at the bottom
    of the stack frame. This fake return address will be replaced
    with the correct return address in the trampoline_handler().

    With this change, the ORC unwinder can check whether the return
    address is modified by kretprobes or not.

    Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
    Suggested-by: Josh Poimboeuf <jpoimboe@redhat.com>
    Tested-by: Andrii Nakryiko <andrii@kernel.org>
    Acked-by: Josh Poimboeuf <jpoimboe@redhat.com>
    ---
    Changes in v9:
    - Update changelog and comment.
    - Remove unneeded type casting.
    ---
    arch/x86/kernel/kprobes/core.c | 34 +++++++++++++++++++++++++---------
    1 file changed, 25 insertions(+), 9 deletions(-)

    diff --git a/arch/x86/kernel/kprobes/core.c b/arch/x86/kernel/kprobes/core.c
    index d1436d7463fd..7e1111c19605 100644
    --- a/arch/x86/kernel/kprobes/core.c
    +++ b/arch/x86/kernel/kprobes/core.c
    @@ -1022,28 +1022,33 @@ asm(
    ".global __kretprobe_trampoline\n"
    ".type __kretprobe_trampoline, @function\n"
    "__kretprobe_trampoline:\n"
    - /* We don't bother saving the ss register */
    #ifdef CONFIG_X86_64
    - " pushq %rsp\n"
    + /* Push a fake return address to tell the unwinder it's a kretprobe. */
    + " pushq $__kretprobe_trampoline\n"
    UNWIND_HINT_FUNC
    + /* Save the 'sp - 8', this will be fixed later. */
    + " pushq %rsp\n"
    " pushfq\n"
    SAVE_REGS_STRING
    " movq %rsp, %rdi\n"
    " call trampoline_handler\n"
    - /* Replace saved sp with true return address. */
    - " movq %rax, 19*8(%rsp)\n"
    RESTORE_REGS_STRING
    + /* In trampoline_handler(), 'regs->flags' is copied to 'regs->sp'. */
    + " addq $8, %rsp\n"
    " popfq\n"
    #else
    - " pushl %esp\n"
    + /* Push a fake return address to tell the unwinder it's a kretprobe. */
    + " pushl $__kretprobe_trampoline\n"
    UNWIND_HINT_FUNC
    + /* Save the 'sp - 4', this will be fixed later. */
    + " pushl %esp\n"
    " pushfl\n"
    SAVE_REGS_STRING
    " movl %esp, %eax\n"
    " call trampoline_handler\n"
    - /* Replace saved sp with true return address. */
    - " movl %eax, 15*4(%esp)\n"
    RESTORE_REGS_STRING
    + /* In trampoline_handler(), 'regs->flags' is copied to 'regs->sp'. */
    + " addl $4, %esp\n"
    " popfl\n"
    #endif
    " ret\n"
    @@ -1063,8 +1068,10 @@ STACK_FRAME_NON_STANDARD_FP(__kretprobe_trampoline);
    /*
    * Called from __kretprobe_trampoline
    */
    -__used __visible void *trampoline_handler(struct pt_regs *regs)
    +__used __visible void trampoline_handler(struct pt_regs *regs)
    {
    + unsigned long *frame_pointer;
    +
    /* fixup registers */
    regs->cs = __KERNEL_CS;
    #ifdef CONFIG_X86_32
    @@ -1072,8 +1079,17 @@ __used __visible void *trampoline_handler(struct pt_regs *regs)
    #endif
    regs->ip = (unsigned long)&__kretprobe_trampoline;
    regs->orig_ax = ~0UL;
    + regs->sp += sizeof(long);
    + frame_pointer = &regs->sp + 1;
    +
    + /* Replace fake return address with real one. */
    + *frame_pointer = kretprobe_trampoline_handler(regs, frame_pointer);

    - return (void *)kretprobe_trampoline_handler(regs, &regs->sp);
    + /*
    + * Copy FLAGS to 'pt_regs::sp' so that __kretprobe_trapmoline()
    + * can do RET right after POPF.
    + */
    + regs->sp = regs->flags;
    }
    NOKPROBE_SYMBOL(trampoline_handler);

    \
     
     \ /
      Last update: 2021-09-14 16:43    [W:4.072 / U:0.292 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site