tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

x86/uprobes: Fix XOL allocation failure for 32-bit tasks

This script

#!/usr/bin/bash

echo 0 > /proc/sys/kernel/randomize_va_space

echo 'void main(void) {}' > TEST.c

# -fcf-protection to ensure that the 1st endbr32 insn can't be emulated
gcc -m32 -fcf-protection=branch TEST.c -o test

bpftrace -e 'uprobe:./test:main {}' -c ./test

"hangs", the probed ./test task enters an endless loop.

The problem is that with randomize_va_space == 0
get_unmapped_area(TASK_SIZE - PAGE_SIZE) called by xol_add_vma() can not
just return the "addr == TASK_SIZE - PAGE_SIZE" hint, this addr is used
by the stack vma.

arch_get_unmapped_area_topdown() doesn't take TIF_ADDR32 into account and
in_32bit_syscall() is false, this leads to info.high_limit > TASK_SIZE.
vm_unmapped_area() happily returns the high address > TASK_SIZE and then
get_unmapped_area() returns -ENOMEM after the "if (addr > TASK_SIZE - len)"
check.

handle_swbp() doesn't report this failure (probably it should) and silently
restarts the probed insn. Endless loop.

I think that the right fix should change the x86 get_unmapped_area() paths
to rely on TIF_ADDR32 rather than in_32bit_syscall(). Note also that if
CONFIG_X86_X32_ABI=y, in_x32_syscall() falsely returns true in this case
because ->orig_ax = -1.

But we need a simple fix for -stable, so this patch just sets TS_COMPAT if
the probed task is 32-bit to make in_ia32_syscall() true.

Fixes: 1b028f784e8c ("x86/mm: Introduce mmap_compat_base() for 32-bit mmap()")
Reported-by: Paulo Andrade <pandrade@redhat.com>
Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://lore.kernel.org/all/aV5uldEvV7pb4RA8@redhat.com/
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/aWO7Fdxn39piQnxu@redhat.com

authored by

Oleg Nesterov and committed by
Peter Zijlstra d55c571e 10d6d241

+32 -3
+24
arch/x86/kernel/uprobes.c
··· 1823 1823 1824 1824 return false; 1825 1825 } 1826 + 1827 + #ifdef CONFIG_IA32_EMULATION 1828 + unsigned long arch_uprobe_get_xol_area(void) 1829 + { 1830 + struct thread_info *ti = current_thread_info(); 1831 + unsigned long vaddr; 1832 + 1833 + /* 1834 + * HACK: we are not in a syscall, but x86 get_unmapped_area() paths 1835 + * ignore TIF_ADDR32 and rely on in_32bit_syscall() to calculate 1836 + * vm_unmapped_area_info.high_limit. 1837 + * 1838 + * The #ifdef above doesn't cover the CONFIG_X86_X32_ABI=y case, 1839 + * but in this case in_32bit_syscall() -> in_x32_syscall() always 1840 + * (falsely) returns true because ->orig_ax == -1. 1841 + */ 1842 + if (test_thread_flag(TIF_ADDR32)) 1843 + ti->status |= TS_COMPAT; 1844 + vaddr = get_unmapped_area(NULL, TASK_SIZE - PAGE_SIZE, PAGE_SIZE, 0, 0); 1845 + ti->status &= ~TS_COMPAT; 1846 + 1847 + return vaddr; 1848 + } 1849 + #endif
+1
include/linux/uprobes.h
··· 242 242 extern void arch_uprobe_init_state(struct mm_struct *mm); 243 243 extern void handle_syscall_uprobe(struct pt_regs *regs, unsigned long bp_vaddr); 244 244 extern void arch_uprobe_optimize(struct arch_uprobe *auprobe, unsigned long vaddr); 245 + extern unsigned long arch_uprobe_get_xol_area(void); 245 246 #else /* !CONFIG_UPROBES */ 246 247 struct uprobes_state { 247 248 };
+7 -3
kernel/events/uprobes.c
··· 1694 1694 .mremap = xol_mremap, 1695 1695 }; 1696 1696 1697 + unsigned long __weak arch_uprobe_get_xol_area(void) 1698 + { 1699 + /* Try to map as high as possible, this is only a hint. */ 1700 + return get_unmapped_area(NULL, TASK_SIZE - PAGE_SIZE, PAGE_SIZE, 0, 0); 1701 + } 1702 + 1697 1703 /* Slot allocation for XOL */ 1698 1704 static int xol_add_vma(struct mm_struct *mm, struct xol_area *area) 1699 1705 { ··· 1715 1709 } 1716 1710 1717 1711 if (!area->vaddr) { 1718 - /* Try to map as high as possible, this is only a hint. */ 1719 - area->vaddr = get_unmapped_area(NULL, TASK_SIZE - PAGE_SIZE, 1720 - PAGE_SIZE, 0, 0); 1712 + area->vaddr = arch_uprobe_get_xol_area(); 1721 1713 if (IS_ERR_VALUE(area->vaddr)) { 1722 1714 ret = area->vaddr; 1723 1715 goto fail;