Re: BUG: unable to handle kernel paging request in arch_adjust_kprobe_addr

From: Google
Date: Thu Mar 14 2024 - 11:08:10 EST

Next message: Jonathan Cameron: "Re: [PATCH v2 4/6] iio: pressure: Simplify and make more clear temperature readings"
Previous message: Daniel Díaz: "Re: [PATCH 5.10 00/73] 5.10.213-rc1 review"
In reply to: cheung wall: "BUG: unable to handle kernel paging request in arch_adjust_kprobe_addr"
Next in thread: Masami Hiramatsu (Google): "[PATCH] kprobes/x86: Use copy_from_kernel_nofault() to read from unsafe address"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

Hi,

Thanks for reporting the bug. I confirmed it and found a bug.

----
/* If x86 supports IBT (ENDBR) it must be skipped. */
kprobe_opcode_t *arch_adjust_kprobe_addr(unsigned long addr, unsigned long offset,
bool *on_func_entry)
{
if (is_endbr(*(u32 *)addr)) {
^^^^^^^^^^^^^^^^^
----

Actually, arch_adjust_kprobe_addr() is called before safety check of the
address. So we should treat the @addr as unsafe address.

Let me fix that.

Thank you,

On Wed, 13 Mar 2024 10:14:09 +0800
cheung wall <zzqq0103.hey@xxxxxxxxx> wrote:

> Hello,
>
>
>
> when using Healer to fuzz the latest Linux Kernel, the following crash
>
> was triggered on:
>
>
>
> HEAD commit: 0dd3ee31125508cd67f7e7172247f05b7fd1753a (tag: v6.7)
>
> git tree: upstream
>
> console output:
> *https://drive.google.com/file/d/15ygRHkG5dwbVMtPDCBx1FKhTULSlrXki/view?usp=drive_link*
> <https://drive.google.com/file/d/15ygRHkG5dwbVMtPDCBx1FKhTULSlrXki/view?usp=drive_link>
>
> kernel config:
> *https://drive.google.com/file/d/1odoVJXVajqeUhF0bpFlv3ieTNwpgNdAl/view?usp=drive_link*
> <https://drive.google.com/file/d/1odoVJXVajqeUhF0bpFlv3ieTNwpgNdAl/view?usp=drive_link>
>
> C reproducer:
> *https://drive.google.com/file/d/1hYKj4Xanb09-3gsIRq3ZLvEhkno49NtP/view?usp=drive_link*
> <https://drive.google.com/file/d/1hYKj4Xanb09-3gsIRq3ZLvEhkno49NtP/view?usp=drive_link>
>
> Syzlang reproducer:
> https://drive.google.com/file/d/1YIN_c_-kT5De7-Z80nWImXyqW7rT2fPf/view?usp=drive_link
>
>
>
> If you fix this issue, please add the following tag to the commit:
>
> Reported-by: Qiang Zhang <*zzqq0103.hey@xxxxxxxxx* <zzqq0103.hey@xxxxxxxxx>>
>
> *----------------------------------------------------------*
>
>
>
> BUG: unable to handle page fault for address: ffffffff95003e80
> audit: type=1400 audit(1710291918.880:7): avc: denied { open } for
> pid=298 comm="syz-executor372" scontext=system_u:system_r:kernel_t:s0
> tcontext=system_u:system_r:kernel_t:s0 tclass=perf_event permissive=1
> #PF: supervisor read access in kernel mode
> #PF: error_code(0x0000) - not-present page
> PGD 1c4a7067 P4D 1c4a7067 PUD 1c4a8063
> audit: type=1400 audit(1710291918.880:8): avc: denied { kernel } for
> pid=298 comm="syz-executor372" scontext=system_u:system_r:kernel_t:s0
> tcontext=system_u:system_r:kernel_t:s0 tclass=perf_event permissive=1
> PMD 800fffffe29ff062
> Oops: 0000 [#1] PREEMPT SMP KASAN PTI
> CPU: 0 PID: 298 Comm: syz-executor372 Not tainted 6.7.0 #1
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
> 1.13.0-1ubuntu1.1 04/01/2014
> RIP: 0010:arch_adjust_kprobe_addr+0x42/0x180
> arch/x86/kernel/kprobes/core.c:338
> Code: 48 89 ea 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 0f b6 14 02 48 89
> e8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 09 01 00 00 <44> 8b 6d 00 41
> 81 fd 66 0f 1f 00 74 18 e8 3c e5 30 00 41 81 e5 ff
> RSP: 0018:ffff888112af7a68 EFLAGS: 00010246
> RAX: 0000000000000003 RBX: 0000000000000000 RCX: ffffffff902cd938
> RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff95003e80
> RBP: ffffffff95003e80 R08: ffff8881bec62da8 R09: ffffffff930000eb
> R10: ffffffff906e4e58 R11: ffffffff92f009b3 R12: ffff888112af7b70
> R13: ffff888107f5e258 R14: ffff88810124c6f0 R15: 0000000000000001
> FS: 000055555555e880(0000) GS:ffff8881c0000000(0000) knlGS:0000000000000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: ffffffff95003e80 CR3: 00000001036da005 CR4: 0000000000770ef0
> DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
> PKRU: 55555554
> Call Trace:
> <TASK>
> _kprobe_addr+0x10e/0x140 kernel/kprobes.c:1479
> register_kprobe+0xe0/0x15b0 kernel/kprobes.c:1622
> __register_trace_kprobe kernel/trace/trace_kprobe.c:510 [inline]
> __register_trace_kprobe+0x233/0x2a0 kernel/trace/trace_kprobe.c:478
> create_local_trace_kprobe+0x209/0x370 kernel/trace/trace_kprobe.c:1821
> perf_kprobe_init+0xed/0x1b0 kernel/trace/trace_event_perf.c:267
> perf_kprobe_event_init+0xcc/0x180 kernel/events/core.c:10334
> perf_try_init_event+0x10d/0x4e0 kernel/events/core.c:11650
> perf_init_event kernel/events/core.c:11720 [inline]
> perf_event_alloc kernel/events/core.c:12000 [inline]
> perf_event_alloc+0xded/0x3310 kernel/events/core.c:11866
> __do_sys_perf_event_open+0x328/0x1d50 kernel/events/core.c:12507
> do_syscall_x64 arch/x86/entry/common.c:52 [inline]
> do_syscall_64+0x43/0xf0 arch/x86/entry/common.c:83
> entry_SYSCALL_64_after_hwframe+0x6f/0x77
> RIP: 0033:0x7f92060ecb4d
> Code: 28 c3 e8 36 29 00 00 66 0f 1f 44 00 00 f3 0f 1e fa 48 89 f8 48 89 f7
> 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff
> ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
> RSP: 002b:00007fff2df5c268 EFLAGS: 00000246 ORIG_RAX: 000000000000012a
> RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f92060ecb4d
> RDX: 0000000000000000 RSI: 00000000ffffffff RDI: 0000000020001200
> RBP: 00007f92060a6500 R08: 0000000000000000 R09: 0000000000000000
> R10: 00000000ffffffff R11: 0000000000000246 R12: 00007f92060a65a0
> R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
> </TASK>
> Modules linked in:
> CR2: ffffffff95003e80
> ---[ end trace 0000000000000000 ]---
> RIP: 0010:arch_adjust_kprobe_addr+0x42/0x180
> arch/x86/kernel/kprobes/core.c:338
> Code: 48 89 ea 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 0f b6 14 02 48 89
> e8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 09 01 00 00 <44> 8b 6d 00 41
> 81 fd 66 0f 1f 00 74 18 e8 3c e5 30 00 41 81 e5 ff
> RSP: 0018:ffff888112af7a68 EFLAGS: 00010246
> RAX: 0000000000000003 RBX: 0000000000000000 RCX: ffffffff902cd938
> RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff95003e80
> RBP: ffffffff95003e80 R08: ffff8881bec62da8 R09: ffffffff930000eb
> R10: ffffffff906e4e58 R11: ffffffff92f009b3 R12: ffff888112af7b70
> R13: ffff888107f5e258 R14: ffff88810124c6f0 R15: 0000000000000001
> FS: 000055555555e880(0000) GS:ffff8881c0000000(0000) knlGS:0000000000000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: ffffffff95003e80 CR3: 00000001036da005 CR4: 0000000000770ef0
> DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
> PKRU: 55555554
> note: syz-executor372[298] exited with irqs disabled
> ----------------
> Code disassembly (best guess):
> 0: 48 89 ea mov %rbp,%rdx
> 3: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
> a: fc ff df
> d: 48 c1 ea 03 shr $0x3,%rdx
> 11: 0f b6 14 02 movzbl (%rdx,%rax,1),%edx
> 15: 48 89 e8 mov %rbp,%rax
> 18: 83 e0 07 and $0x7,%eax
> 1b: 83 c0 03 add $0x3,%eax
> 1e: 38 d0 cmp %dl,%al
> 20: 7c 08 jl 0x2a
> 22: 84 d2 test %dl,%dl
> 24: 0f 85 09 01 00 00 jne 0x133
> * 2a: 44 8b 6d 00 mov 0x0(%rbp),%r13d <-- trapping instruction
> 2e: 41 81 fd 66 0f 1f 00 cmp $0x1f0f66,%r13d
> 35: 74 18 je 0x4f
> 37: e8 3c e5 30 00 callq 0x30e578
> 3c: 41 rex.B
> 3d: 81 .byte 0x81
> 3e: e5 ff in $0xff,%eax

--
Masami Hiramatsu (Google) <mhiramat@xxxxxxxxxx>

Next message: Jonathan Cameron: "Re: [PATCH v2 4/6] iio: pressure: Simplify and make more clear temperature readings"
Previous message: Daniel Díaz: "Re: [PATCH 5.10 00/73] 5.10.213-rc1 review"
In reply to: cheung wall: "BUG: unable to handle kernel paging request in arch_adjust_kprobe_addr"
Next in thread: Masami Hiramatsu (Google): "[PATCH] kprobes/x86: Use copy_from_kernel_nofault() to read from unsafe address"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]