Re: [PATCH] x86/kprobes: fix incorrect return address calculation in kprobe_emulate_call_indirect
From: Google
Date: Wed Jan 03 2024 - 23:13:25 EST
On Tue, 2 Jan 2024 17:33:45 -0600
Jinghao Jia <jinghao7@xxxxxxxxxxxx> wrote:
> kprobe_emulate_call_indirect currently uses int3_emulate_call to emulate
> indirect calls. However, int3_emulate_call always assumes the size of
> the call to be 5 bytes when calculating the return address. This is
> incorrect for register-based indirect calls in x86, which can be either
> 2 or 3 bytes depending on whether REX prefix is used.
Ah, that's a really good point! Yes, it should handle the shorter
indirect call with registers.
> At kprobe runtime,
> the incorrect return address causes control flow to land onto the wrong
> place after return -- possibly not a valid instruction boundary. This
> can lead to a panic like the following:
>
> [ 7.308204][ C1] BUG: unable to handle page fault for address: 000000000002b4d8
> [ 7.308883][ C1] #PF: supervisor read access in kernel mode
> [ 7.309168][ C1] #PF: error_code(0x0000) - not-present page
> [ 7.309461][ C1] PGD 0 P4D 0
> [ 7.309652][ C1] Oops: 0000 [#1] SMP
> [ 7.309929][ C1] CPU: 1 PID: 0 Comm: swapper/1 Not tainted 6.7.0-rc5-trace-for-next #6
> [ 7.310397][ C1] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.0-20220807_005459-localhost 04/01/2014
> [ 7.311068][ C1] RIP: 0010:__common_interrupt+0x52/0xc0
> [ 7.311349][ C1] Code: 01 00 4d 85 f6 74 39 49 81 fe 00 f0 ff ff 77 30 4c 89 f7 4d 8b 5e 68 41 ba 91 76 d8 42 45 03 53 fc 74 02 0f 0b cc ff d3 65 48 <8b> 05 30 c7 ff 7e 65 4c 89 3d 28 c7 ff 7e 5b 41 5c 41 5e 41 5f c3
> [ 7.312512][ C1] RSP: 0018:ffffc900000e0fd0 EFLAGS: 00010046
> [ 7.312899][ C1] RAX: 0000000000000001 RBX: 0000000000000023 RCX: 0000000000000001
> [ 7.313334][ C1] RDX: 00000000000003cd RSI: 0000000000000001 RDI: ffff888100d302a4
> [ 7.313702][ C1] RBP: 0000000000000001 R08: 0ef439818636191f R09: b1621ff338a3b482
> [ 7.314146][ C1] R10: ffffffff81e5127b R11: ffffffff81059810 R12: 0000000000000023
> [ 7.314509][ C1] R13: 0000000000000000 R14: ffff888100d30200 R15: 0000000000000000
> [ 7.314951][ C1] FS: 0000000000000000(0000) GS:ffff88813bc80000(0000) knlGS:0000000000000000
> [ 7.315396][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [ 7.315691][ C1] CR2: 000000000002b4d8 CR3: 0000000003028003 CR4: 0000000000370ef0
> [ 7.316153][ C1] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> [ 7.316508][ C1] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
> [ 7.316948][ C1] Call Trace:
> [ 7.317123][ C1] <IRQ>
> [ 7.317279][ C1] ? __die_body+0x64/0xb0
> [ 7.317482][ C1] ? page_fault_oops+0x248/0x370
> [ 7.317712][ C1] ? __wake_up+0x96/0xb0
> [ 7.317964][ C1] ? exc_page_fault+0x62/0x130
> [ 7.318211][ C1] ? asm_exc_page_fault+0x22/0x30
> [ 7.318444][ C1] ? __cfi_native_send_call_func_single_ipi+0x10/0x10
> [ 7.318860][ C1] ? default_idle+0xb/0x10
> [ 7.319063][ C1] ? __common_interrupt+0x52/0xc0
> [ 7.319330][ C1] common_interrupt+0x78/0x90
> [ 7.319546][ C1] </IRQ>
> [ 7.319679][ C1] <TASK>
> [ 7.319854][ C1] asm_common_interrupt+0x22/0x40
> [ 7.320082][ C1] RIP: 0010:default_idle+0xb/0x10
> [ 7.320309][ C1] Code: 4c 01 c7 4c 29 c2 e9 72 ff ff ff cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 b8 0c 67 40 a5 66 90 0f 00 2d 09 b9 3b 00 fb f4 <fa> c3 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 b8 0c 67 40 a5 e9
> [ 7.321449][ C1] RSP: 0018:ffffc9000009bee8 EFLAGS: 00000256
> [ 7.321808][ C1] RAX: ffff88813bca8b68 RBX: 0000000000000001 RCX: 000000000001ef0c
> [ 7.322227][ C1] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 000000000001ef0c
> [ 7.322656][ C1] RBP: ffffc9000009bef8 R08: 8000000000000000 R09: 00000000000008c2
> [ 7.323083][ C1] R10: 0000000000000000 R11: ffffffff81058e70 R12: 0000000000000000
> [ 7.323530][ C1] R13: ffff8881002b30c0 R14: 0000000000000000 R15: 0000000000000000
> [ 7.323948][ C1] ? __cfi_lapic_next_deadline+0x10/0x10
> [ 7.324239][ C1] default_idle_call+0x31/0x50
> [ 7.324464][ C1] do_idle+0xd3/0x240
> [ 7.324690][ C1] cpu_startup_entry+0x25/0x30
> [ 7.324983][ C1] start_secondary+0xb4/0xc0
> [ 7.325217][ C1] secondary_startup_64_no_verify+0x179/0x17b
> [ 7.325498][ C1] </TASK>
> [ 7.325641][ C1] Modules linked in:
> [ 7.325906][ C1] CR2: 000000000002b4d8
> [ 7.326104][ C1] ---[ end trace 0000000000000000 ]---
> [ 7.326354][ C1] RIP: 0010:__common_interrupt+0x52/0xc0
> [ 7.326614][ C1] Code: 01 00 4d 85 f6 74 39 49 81 fe 00 f0 ff ff 77 30 4c 89 f7 4d 8b 5e 68 41 ba 91 76 d8 42 45 03 53 fc 74 02 0f 0b cc ff d3 65 48 <8b> 05 30 c7 ff 7e 65 4c 89 3d 28 c7 ff 7e 5b 41 5c 41 5e 41 5f c3
> [ 7.327570][ C1] RSP: 0018:ffffc900000e0fd0 EFLAGS: 00010046
> [ 7.327910][ C1] RAX: 0000000000000001 RBX: 0000000000000023 RCX: 0000000000000001
> [ 7.328273][ C1] RDX: 00000000000003cd RSI: 0000000000000001 RDI: ffff888100d302a4
> [ 7.328632][ C1] RBP: 0000000000000001 R08: 0ef439818636191f R09: b1621ff338a3b482
> [ 7.329223][ C1] R10: ffffffff81e5127b R11: ffffffff81059810 R12: 0000000000000023
> [ 7.329780][ C1] R13: 0000000000000000 R14: ffff888100d30200 R15: 0000000000000000
> [ 7.330193][ C1] FS: 0000000000000000(0000) GS:ffff88813bc80000(0000) knlGS:0000000000000000
> [ 7.330632][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [ 7.331050][ C1] CR2: 000000000002b4d8 CR3: 0000000003028003 CR4: 0000000000370ef0
> [ 7.331454][ C1] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> [ 7.331854][ C1] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
> [ 7.332236][ C1] Kernel panic - not syncing: Fatal exception in interrupt
> [ 7.332730][ C1] Kernel Offset: disabled
> [ 7.333044][ C1] ---[ end Kernel panic - not syncing: Fatal exception in interrupt ]---
>
> The relevant assembly code is (from objdump, faulting address
> highlighted):
>
> ffffffff8102ed9d: 41 ff d3 call *%r11
> ffffffff8102eda0: 65 48 <8b> 05 30 c7 ff mov %gs:0x7effc730(%rip),%rax
>
> The emulation incorrectly sets the return address to be ffffffff8102ed9d
> + 0x5 = ffffffff8102eda2, which is the 8b byte in the middle of the next
> mov. This in turn causes incorrect subsequent instruction decoding and
> eventually triggers the page fault above.
>
> Instead of invoking int3_emulate_call, perform push and jmp emulation
> directly in kprobe_emulate_call_indirect. At this point we can obtain
> the instruction size from p->ainsn.size so that we can calculate the
> correct return address.
This looks good to me, because 'p->ainsn.size = insn->length' so the
'regs->ip - INT3_INSN_SIZE + p->ainsn.size' will point the next instruction
correctly.
Let me pick it.
Thanks!
>
> Fixes: 6256e668b7af ("x86/kprobes: Use int3 instead of debug trap for single-step")
> Signed-off-by: Jinghao Jia <jinghao7@xxxxxxxxxxxx>
> ---
> arch/x86/kernel/kprobes/core.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/arch/x86/kernel/kprobes/core.c b/arch/x86/kernel/kprobes/core.c
> index e8babebad7b8..a0ce46c0a2d8 100644
> --- a/arch/x86/kernel/kprobes/core.c
> +++ b/arch/x86/kernel/kprobes/core.c
> @@ -576,7 +576,8 @@ static void kprobe_emulate_call_indirect(struct kprobe *p, struct pt_regs *regs)
> {
> unsigned long offs = addrmode_regoffs[p->ainsn.indirect.reg];
>
> - int3_emulate_call(regs, regs_get_register(regs, offs));
> + int3_emulate_push(regs, regs->ip - INT3_INSN_SIZE + p->ainsn.size);
> + int3_emulate_jmp(regs, regs_get_register(regs, offs));
> }
> NOKPROBE_SYMBOL(kprobe_emulate_call_indirect);
>
> --
> 2.43.0
>
--
Masami Hiramatsu (Google) <mhiramat@xxxxxxxxxx>