Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
tjh.dev
kernel
os
linux
x86: kprobes bugfix
Kprobes for x86-64 may cause a kernel crash if it inserted on "iret"
instruction. "call absolute" is invalid on x86-64, so we don't need
treat it.
- Change the processing order as same as x86-32.
- Add "iret"(0xcf) case.
- Remove next_rip local variable.
Signed-off-by: Masami Hiramatsu <mhiramat@redhat.com>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
authored by Masami Hiramatsu and committed by Ingo Molnar 0b0122fa 29b6cd79
+18
-23
arch/x86/kernel/kprobes_64.c
+18
-23
arch/x86/kernel/kprobes_64.c
···
485
struct pt_regs *regs, struct kprobe_ctlblk *kcb)
486
{
487
unsigned long *tos = (unsigned long *)regs->rsp;
488
-
unsigned long next_rip = 0;
489
unsigned long copy_rip = (unsigned long)p->ainsn.insn;
490
unsigned long orig_rip = (unsigned long)p->addr;
491
kprobe_opcode_t *insn = p->ainsn.insn;
···
493
if (*insn >= 0x40 && *insn <= 0x4f)
494
insn++;
495
496
switch (*insn) {
497
-
case 0x9c: /* pushfl */
498
*tos &= ~(TF_MASK | IF_MASK);
499
*tos |= kcb->kprobe_old_rflags;
500
break;
501
-
case 0xc3: /* ret/lret */
502
-
case 0xcb:
503
-
case 0xc2:
504
case 0xca:
505
-
regs->eflags &= ~TF_MASK;
506
-
/* rip is already adjusted, no more changes required*/
507
-
return;
508
-
case 0xe8: /* call relative - Fix return addr */
509
*tos = orig_rip + (*tos - copy_rip);
510
break;
511
case 0xff:
512
if ((insn[1] & 0x30) == 0x10) {
513
/* call absolute, indirect */
514
-
/* Fix return addr; rip is correct. */
515
-
next_rip = regs->rip;
516
*tos = orig_rip + (*tos - copy_rip);
517
} else if (((insn[1] & 0x31) == 0x20) || /* jmp near, absolute indirect */
518
((insn[1] & 0x31) == 0x21)) { /* jmp far, absolute indirect */
519
-
/* rip is correct. */
520
-
next_rip = regs->rip;
521
}
522
-
break;
523
-
case 0xea: /* jmp absolute -- rip is correct */
524
-
next_rip = regs->rip;
525
-
break;
526
default:
527
break;
528
}
529
530
-
regs->eflags &= ~TF_MASK;
531
-
if (next_rip) {
532
-
regs->rip = next_rip;
533
-
} else {
534
-
regs->rip = orig_rip + (regs->rip - copy_rip);
535
-
}
536
}
537
538
int __kprobes post_kprobe_handler(struct pt_regs *regs)
···
485
struct pt_regs *regs, struct kprobe_ctlblk *kcb)
486
{
487
unsigned long *tos = (unsigned long *)regs->rsp;
488
unsigned long copy_rip = (unsigned long)p->ainsn.insn;
489
unsigned long orig_rip = (unsigned long)p->addr;
490
kprobe_opcode_t *insn = p->ainsn.insn;
···
494
if (*insn >= 0x40 && *insn <= 0x4f)
495
insn++;
496
497
+
regs->eflags &= ~TF_MASK;
498
switch (*insn) {
499
+
case 0x9c: /* pushfl */
500
*tos &= ~(TF_MASK | IF_MASK);
501
*tos |= kcb->kprobe_old_rflags;
502
break;
503
+
case 0xc2: /* iret/ret/lret */
504
+
case 0xc3:
505
case 0xca:
506
+
case 0xcb:
507
+
case 0xcf:
508
+
case 0xea: /* jmp absolute -- ip is correct */
509
+
/* ip is already adjusted, no more changes required */
510
+
goto no_change;
511
+
case 0xe8: /* call relative - Fix return addr */
512
*tos = orig_rip + (*tos - copy_rip);
513
break;
514
case 0xff:
515
if ((insn[1] & 0x30) == 0x10) {
516
/* call absolute, indirect */
517
+
/* Fix return addr; ip is correct. */
518
*tos = orig_rip + (*tos - copy_rip);
519
+
goto no_change;
520
} else if (((insn[1] & 0x31) == 0x20) || /* jmp near, absolute indirect */
521
((insn[1] & 0x31) == 0x21)) { /* jmp far, absolute indirect */
522
+
/* ip is correct. */
523
+
goto no_change;
524
}
525
default:
526
break;
527
}
528
529
+
regs->rip = orig_rip + (regs->rip - copy_rip);
530
+
no_change:
531
+
532
+
return;
533
}
534
535
int __kprobes post_kprobe_handler(struct pt_regs *regs)