Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752948AbbFEVlB (ORCPT ); Fri, 5 Jun 2015 17:41:01 -0400 Received: from mx1.redhat.com ([209.132.183.28]:60123 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751972AbbFEVlA (ORCPT ); Fri, 5 Jun 2015 17:41:00 -0400 Date: Fri, 5 Jun 2015 23:40:03 +0200 From: Oleg Nesterov To: Ananth N Mavinakayanahalli , Anton Arapov , David Long , Denys Vlasenko , "Frank Ch. Eigler" , Ingo Molnar , Jan Willeke , Jim Keniston , Mark Wielaard , Pratyush Anand , Srikar Dronamraju Cc: linux-kernel@vger.kernel.org Subject: Re: [PATCH 09/10] uprobes: Change prepare_uretprobe() to (try to) flush the dead frames Message-ID: <20150605214003.GA26264@redhat.com> References: <20150504124835.GA22462@redhat.com> <20150504124922.GA22522@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20150504124922.GA22522@redhat.com> User-Agent: Mutt/1.5.18 (2008-05-17) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1885 Lines: 59 On 05/04, Oleg Nesterov wrote: > > --- a/kernel/events/uprobes.c > +++ b/kernel/events/uprobes.c > @@ -1522,6 +1522,16 @@ static unsigned long get_trampoline_vaddr(void) > return trampoline_vaddr; > } > > +static void cleanup_return_instances(struct uprobe_task *utask, struct pt_regs *regs) > +{ > + struct return_instance *ri = utask->return_instances; > + while (ri && !arch_uretprobe_is_alive(&ri->auret, regs)) { > + ri = free_ret_instance(ri); > + utask->depth--; > + } > + utask->return_instances = ri; > +} > + > static void prepare_uretprobe(struct uprobe *uprobe, struct pt_regs *regs) > { > struct return_instance *ri; > @@ -1576,6 +1586,9 @@ static void prepare_uretprobe(struct uprobe *uprobe, struct pt_regs *regs) > ri->orig_ret_vaddr = orig_ret_vaddr; > ri->chained = chained; > > + if (utask->depth) /* drop the entries invalidated by longjmp() */ > + cleanup_return_instances(utask, regs); > + Self nack ;) Note that that prepare_uretprobe() does if (orig_ret_vaddr == trampoline_vaddr) { if (!utask->return_instances) { /* * This situation is not possible. Likely we have an * attack from user-space. */ pr_warn("uprobe: unable to set uretprobe pid/tgid=%d/%d\n", current->pid, current->tgid); goto fail; _before_ we do cleanup_return_instances(). This is actually fine in a sense that ->return_instances == NULL after cleanup_return_instances() is not possible if chained, there should be another _alive() frame. But malicious user can obviously fool the kernel. Easy to fix. But after discussion with Srikar and Pratyush (thanks!) I decided to update 6-10. Oleg. -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/