Syzkaller reported a BUG on arm64:
Unrecoverable kprobe detected.
Dumping kprobe:
Name: (null)
Offset: 0
Address: 0xffffa00010019000
------------[ cut here ]------------
kernel BUG at arch/arm64/kernel/probes/kprobes.c:235!
Internal error: Oops - BUG: 0 [#1] SMP
Modules linked in:
CPU: 1 PID: 31060 Comm: syz-executor.6 Not tainted 5.10.0 #11
...
Call trace:
reenter_kprobe arch/arm64/kernel/probes/kprobes.c:234 [inline]
kprobe_handler+0x23c/0x26c arch/arm64/kernel/probes/kprobes.c:339
kprobe_breakpoint_handler+0x24/0x34 arch/arm64/kernel/probes/kprobes.c:406
call_break_hook+0xf4/0x13c arch/arm64/kernel/debug-monitors.c:322
brk_handler+0x2c/0xa0 arch/arm64/kernel/debug-monitors.c:329
do_debug_exception+0x140/0x230 arch/arm64/mm/fault.c:867
el1_dbg+0x38/0x50 arch/arm64/kernel/entry-common.c:182
el1_sync_handler+0xf4/0x150 arch/arm64/kernel/entry-common.c:219
el1_sync+0x74/0x100 arch/arm64/kernel/entry.S:665
0xffffa00010019000
do_futex+0x2f4/0x370 kernel/futex.c:3735
__do_sys_futex kernel/futex.c:3798 [inline]
__se_sys_futex kernel/futex.c:3764 [inline]
__arm64_sys_futex+0x168/0x3a0 kernel/futex.c:3764
__invoke_syscall arch/arm64/kernel/syscall.c:36 [inline]
invoke_syscall arch/arm64/kernel/syscall.c:48 [inline]
el0_svc_common.constprop.0+0xf4/0x414 arch/arm64/kernel/syscall.c:155
do_el0_svc+0x50/0x11c arch/arm64/kernel/syscall.c:217
el0_svc+0x20/0x30 arch/arm64/kernel/entry-common.c:353
el0_sync_handler+0xe4/0x1e0 arch/arm64/kernel/entry-common.c:369
el0_sync+0x148/0x180 arch/arm64/kernel/entry.S:683
Code: 91018360 97ff1838 aa1703e0 97ff1fdf (d4210000)
---[ end trace 767503e946e01b15 ]---
Syzbot tried to porbe on a kprobe_insn_slot.
kprobe will replace instruciton with a break and store the origin one
on kprobe_insn_slot. However these slots are not in .kprobes.text and
exported by perf_event_ksymbol so can be probed by perf interface.
Probing these slots will triggers kprobe handler inside single step
process and for some architectures such as arm64 this will causes a
bug().
These slots are kprobe process so they should not be probed anyway.
Add kprobe_insn_slot check when register_kprobe to forbid probing on
these slots.
Signed-off-by: Chen Zhongjin <[email protected]>
---
kernel/kprobes.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/kernel/kprobes.c b/kernel/kprobes.c
index f214f8c088ed..3e798b62db70 100644
--- a/kernel/kprobes.c
+++ b/kernel/kprobes.c
@@ -1562,6 +1562,8 @@ static int check_kprobe_address_safe(struct kprobe *p,
/* Ensure it is not in reserved area nor out of text */
if (!kernel_text_address((unsigned long) p->addr) ||
within_kprobe_blacklist((unsigned long) p->addr) ||
+ is_kprobe_insn_slot((unsigned long) p->addr) ||
+ is_kprobe_optinsn_slot((unsigned long) p->addr) ||
jump_label_text_reserved(p->addr, p->addr) ||
static_call_text_reserved(p->addr, p->addr) ||
find_bug((unsigned long)p->addr)) {
--
2.17.1
On Wed, 27 Jul 2022 11:20:58 +0800
Chen Zhongjin <[email protected]> wrote:
> Syzkaller reported a BUG on arm64:
> Unrecoverable kprobe detected.
> Dumping kprobe:
> Name: (null)
> Offset: 0
> Address: 0xffffa00010019000
> ------------[ cut here ]------------
> kernel BUG at arch/arm64/kernel/probes/kprobes.c:235!
> Internal error: Oops - BUG: 0 [#1] SMP
> Modules linked in:
> CPU: 1 PID: 31060 Comm: syz-executor.6 Not tainted 5.10.0 #11
> ...
> Call trace:
> reenter_kprobe arch/arm64/kernel/probes/kprobes.c:234 [inline]
> kprobe_handler+0x23c/0x26c arch/arm64/kernel/probes/kprobes.c:339
> kprobe_breakpoint_handler+0x24/0x34 arch/arm64/kernel/probes/kprobes.c:406
> call_break_hook+0xf4/0x13c arch/arm64/kernel/debug-monitors.c:322
> brk_handler+0x2c/0xa0 arch/arm64/kernel/debug-monitors.c:329
> do_debug_exception+0x140/0x230 arch/arm64/mm/fault.c:867
> el1_dbg+0x38/0x50 arch/arm64/kernel/entry-common.c:182
> el1_sync_handler+0xf4/0x150 arch/arm64/kernel/entry-common.c:219
> el1_sync+0x74/0x100 arch/arm64/kernel/entry.S:665
> 0xffffa00010019000
> do_futex+0x2f4/0x370 kernel/futex.c:3735
> __do_sys_futex kernel/futex.c:3798 [inline]
> __se_sys_futex kernel/futex.c:3764 [inline]
> __arm64_sys_futex+0x168/0x3a0 kernel/futex.c:3764
> __invoke_syscall arch/arm64/kernel/syscall.c:36 [inline]
> invoke_syscall arch/arm64/kernel/syscall.c:48 [inline]
> el0_svc_common.constprop.0+0xf4/0x414 arch/arm64/kernel/syscall.c:155
> do_el0_svc+0x50/0x11c arch/arm64/kernel/syscall.c:217
> el0_svc+0x20/0x30 arch/arm64/kernel/entry-common.c:353
> el0_sync_handler+0xe4/0x1e0 arch/arm64/kernel/entry-common.c:369
> el0_sync+0x148/0x180 arch/arm64/kernel/entry.S:683
> Code: 91018360 97ff1838 aa1703e0 97ff1fdf (d4210000)
> ---[ end trace 767503e946e01b15 ]---
>
> Syzbot tried to porbe on a kprobe_insn_slot.
>
> kprobe will replace instruciton with a break and store the origin one
> on kprobe_insn_slot. However these slots are not in .kprobes.text and
> exported by perf_event_ksymbol so can be probed by perf interface.
>
> Probing these slots will triggers kprobe handler inside single step
> process and for some architectures such as arm64 this will causes a
> bug().
>
> These slots are kprobe process so they should not be probed anyway.
> Add kprobe_insn_slot check when register_kprobe to forbid probing on
> these slots.
Oops, good catch!
Previously this was not counted as text area, but now the kernel_text_address()
returns true for these trampoline buffers.
In this case, I think kprobes should be limited to probe only
core_kernel_text and module_text.
Can you use is_module_text_address() and core_kernel_text() instead?
Below can allow kprobes probing on other trampolines like ftrace and
bpf.
Also, you may need this tag;
Fixes: 5b485629ba0d ("kprobes, extable: Identify kprobes trampolines as kernel text area")
Thank you,
>
> Signed-off-by: Chen Zhongjin <[email protected]>
> ---
> kernel/kprobes.c | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff --git a/kernel/kprobes.c b/kernel/kprobes.c
> index f214f8c088ed..3e798b62db70 100644
> --- a/kernel/kprobes.c
> +++ b/kernel/kprobes.c
> @@ -1562,6 +1562,8 @@ static int check_kprobe_address_safe(struct kprobe *p,
> /* Ensure it is not in reserved area nor out of text */
> if (!kernel_text_address((unsigned long) p->addr) ||
> within_kprobe_blacklist((unsigned long) p->addr) ||
> + is_kprobe_insn_slot((unsigned long) p->addr) ||
> + is_kprobe_optinsn_slot((unsigned long) p->addr) ||
> jump_label_text_reserved(p->addr, p->addr) ||
> static_call_text_reserved(p->addr, p->addr) ||
> find_bug((unsigned long)p->addr)) {
> --
> 2.17.1
>
--
Masami Hiramatsu (Google) <[email protected]>
Hi,
On 2022/7/31 23:48, Masami Hiramatsu (Google) wrote:
> On Wed, 27 Jul 2022 11:20:58 +0800
> Chen Zhongjin <[email protected]> wrote:
>
>> Syzkaller reported a BUG on arm64:
>> Unrecoverable kprobe detected.
>> Dumping kprobe:
>> Name: (null)
>> Offset: 0
>> Address: 0xffffa00010019000
>> ------------[ cut here ]------------
>> kernel BUG at arch/arm64/kernel/probes/kprobes.c:235!
>> Internal error: Oops - BUG: 0 [#1] SMP
>> Modules linked in:
>> CPU: 1 PID: 31060 Comm: syz-executor.6 Not tainted 5.10.0 #11
>> ...
>> Call trace:
>> reenter_kprobe arch/arm64/kernel/probes/kprobes.c:234 [inline]
>> kprobe_handler+0x23c/0x26c arch/arm64/kernel/probes/kprobes.c:339
>> kprobe_breakpoint_handler+0x24/0x34 arch/arm64/kernel/probes/kprobes.c:406
>> call_break_hook+0xf4/0x13c arch/arm64/kernel/debug-monitors.c:322
>> brk_handler+0x2c/0xa0 arch/arm64/kernel/debug-monitors.c:329
>> do_debug_exception+0x140/0x230 arch/arm64/mm/fault.c:867
>> el1_dbg+0x38/0x50 arch/arm64/kernel/entry-common.c:182
>> el1_sync_handler+0xf4/0x150 arch/arm64/kernel/entry-common.c:219
>> el1_sync+0x74/0x100 arch/arm64/kernel/entry.S:665
>> 0xffffa00010019000
>> do_futex+0x2f4/0x370 kernel/futex.c:3735
>> __do_sys_futex kernel/futex.c:3798 [inline]
>> __se_sys_futex kernel/futex.c:3764 [inline]
>> __arm64_sys_futex+0x168/0x3a0 kernel/futex.c:3764
>> __invoke_syscall arch/arm64/kernel/syscall.c:36 [inline]
>> invoke_syscall arch/arm64/kernel/syscall.c:48 [inline]
>> el0_svc_common.constprop.0+0xf4/0x414 arch/arm64/kernel/syscall.c:155
>> do_el0_svc+0x50/0x11c arch/arm64/kernel/syscall.c:217
>> el0_svc+0x20/0x30 arch/arm64/kernel/entry-common.c:353
>> el0_sync_handler+0xe4/0x1e0 arch/arm64/kernel/entry-common.c:369
>> el0_sync+0x148/0x180 arch/arm64/kernel/entry.S:683
>> Code: 91018360 97ff1838 aa1703e0 97ff1fdf (d4210000)
>> ---[ end trace 767503e946e01b15 ]---
>>
>> Syzbot tried to porbe on a kprobe_insn_slot.
>>
>> kprobe will replace instruciton with a break and store the origin one
>> on kprobe_insn_slot. However these slots are not in .kprobes.text and
>> exported by perf_event_ksymbol so can be probed by perf interface.
>>
>> Probing these slots will triggers kprobe handler inside single step
>> process and for some architectures such as arm64 this will causes a
>> bug().
>>
>> These slots are kprobe process so they should not be probed anyway.
>> Add kprobe_insn_slot check when register_kprobe to forbid probing on
>> these slots.
> Oops, good catch!
>
> Previously this was not counted as text area, but now the kernel_text_address()
> returns true for these trampoline buffers.
>
> In this case, I think kprobes should be limited to probe only
> core_kernel_text and module_text.
> Can you use is_module_text_address() and core_kernel_text() instead?
> Below can allow kprobes probing on other trampolines like ftrace and
> bpf.
> Also, you may need this tag;
>
> Fixes: 5b485629ba0d ("kprobes, extable: Identify kprobes trampolines as kernel text area")
>
> Thank you,
Thanks for review!
Please see next version here: https://lkml.org/lkml/2022/7/31/436
[PATCH v3] kprobes: Forbid probing on trampoline and bpf prog
>> Signed-off-by: Chen Zhongjin <[email protected]>
>> ---
>> kernel/kprobes.c | 2 ++
>> 1 file changed, 2 insertions(+)
>>
>> diff --git a/kernel/kprobes.c b/kernel/kprobes.c
>> index f214f8c088ed..3e798b62db70 100644
>> --- a/kernel/kprobes.c
>> +++ b/kernel/kprobes.c
>> @@ -1562,6 +1562,8 @@ static int check_kprobe_address_safe(struct kprobe *p,
>> /* Ensure it is not in reserved area nor out of text */
>> if (!kernel_text_address((unsigned long) p->addr) ||
>> within_kprobe_blacklist((unsigned long) p->addr) ||
>> + is_kprobe_insn_slot((unsigned long) p->addr) ||
>> + is_kprobe_optinsn_slot((unsigned long) p->addr) ||
>> jump_label_text_reserved(p->addr, p->addr) ||
>> static_call_text_reserved(p->addr, p->addr) ||
>> find_bug((unsigned long)p->addr)) {
>> --
>> 2.17.1
>>
Best,
Chen