Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1419980

[PATCH tip/master] [BUGFIX] kprobes/x86: Fix to clear TF bit in fault-on-single-stepping

Show key headers only | View raw

Fix kprobe_fault_handler to clear TF (trap flag) bit of
flags register in the case of fault fixup on single-stepping.

If we put a kprobe on the instruction which can cause a
page fault (e.g. actual mov instructions in copy_user_*),
that fault happens on a single-stepping buffer. In this
case, kprobes resets running instance so that the CPU can
retry execution on the original ip address.
However, current code forgets reset TF bit. Since this
fault happens with TF bit set for enabling single-stepping,
when it retries, it causes a debug exception and kprobes
can not handle it because it already reset itself.

On the most of x86-64 platform, it can be easily reproduced
by using kprobe tracer. E.g.

  # cd /sys/kernel/debug/tracing
  # echo p copy_user_enhanced_fast_string+5 > kprobe_events
  # echo 1 > events/kprobes/enable

And you'll see a kernel panic on do_debug(), since the debug
trap is not handled by kprobes.

To fix this problem, we just need to clear the TF bit when
resetting running kprobe.

Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
---
 arch/x86/kernel/kprobes/core.c |    7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/arch/x86/kernel/kprobes/core.c b/arch/x86/kernel/kprobes/core.c
index 38cf7a7..856df81 100644
--- a/arch/x86/kernel/kprobes/core.c
+++ b/arch/x86/kernel/kprobes/core.c
@@ -961,6 +961,13 @@ int kprobe_fault_handler(struct pt_regs *regs, int trapnr)
 		 * normal page fault.
 		 */
 		regs->ip = (unsigned long)cur->addr;
+		/*
+		 * Trap flag has been set here because this fault happened
+		 * where the single stepping will be done. So clear it with
+		 * resetting current kprobe.
+		 */
+		regs->flags &= ~X86_EFLAGS_TF;
+		/* If the TF was set before the kprobe hit, don't touch it */
 		regs->flags |= kcb->kprobe_old_flags;
 		if (kcb->kprobe_status == KPROBE_REENTER)
 			restore_previous_kprobe(kcb);

Back to linux.kernel | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

[PATCH tip/master] [BUGFIX] kprobes/x86: Fix to clear TF bit in fault-on-single-stepping Masami Hiramatsu <mhiramat@kernel.org> - 2016-06-11 16:10 +0200
  Re: [PATCH tip/master] [BUGFIX] kprobes/x86: Fix to clear TF bit in  fault-on-single-stepping Ananth N Mavinakayanahalli <ananth@linux.vnet.ibm.com> - 2016-06-13 06:40 +0200
  Re: [PATCH tip/master] [BUGFIX] kprobes/x86: Fix to clear TF bit in  fault-on-single-stepping Steven Rostedt <rostedt@goodmis.org> - 2016-06-14 01:20 +0200
    Re: [PATCH tip/master] [BUGFIX] kprobes/x86: Fix to clear TF bit in  fault-on-single-stepping Steven Rostedt <rostedt@goodmis.org> - 2016-06-14 01:30 +0200
      Re: [PATCH tip/master] [BUGFIX] kprobes/x86: Fix to clear TF bit in  fault-on-single-stepping Masami Hiramatsu <mhiramat@kernel.org> - 2016-06-14 03:30 +0200
      Re: [PATCH tip/master] [BUGFIX] kprobes/x86: Fix to clear TF bit in  fault-on-single-stepping Ingo Molnar <mingo@kernel.org> - 2016-06-14 12:00 +0200
  [tip:perf/urgent] kprobes/x86: Clear TF bit in fault on  single-stepping tip-bot for Masami Hiramatsu <tipbot@zytor.com> - 2016-06-14 13:40 +0200

csiph-web