[lkml]   [2017]   [Jul]   [14]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
Subject[PATCH 0/2] kprobe: Fix: add symbols to kprobe blacklist
Hi all,

While fuzzing the Perf kprobe and kretprobe interfaces, I found some inputs
that trigger crashes of a 4.12 kernel(6f7da290413ba713f0cdd9ff1a2a9bb129ef4f6c)
on a x86-64 VM. I know that K(ret)probes can crash the kernel in multiple ways
but should Perf be allowed to do it?

To do this analysis, I used the symbols reported by /proc/kallsyms in
conjonction with the Perf debugfs interface. Using this technique, I was able
to find two instrumentation configurations that could crash the kernel. I am
suggesting changes that fixed both issues for me by blacklisting the symbols in

Kprobe on apic_timer_interrupt:
I believe that this is caused by the fact that kprobe adds a INT3 in a apic
interrupt routine.
How to reproduce:
echo 'p:event1 apic_timer_interrupt ' > kprobe_events
<Generate kernel activity. e.g. launch bash>
Crash log:[1]

This can be fixed by blacklisting the apicinterrupt3 symbols directly in the
assembly macro. See patch[1/2]. I am not sure that blacklisting all
apicinterrupt symbols is the right solution.

Kretprobe on ftrace_ops_assist_func and another function:
Those crashes are triggered when hooking a kretprobe on the
ftrace_ops_assist_func symbol and some other functions to make the this first
function reacheable. From my understanding, ftrace_ops_assist_func is the
function called directly when the kprobe is hit. Thus it should be marked

Here are some configurations that can easily reproduce this bug. Those other
functions are called during the fork of a process so they are easy to control.
Enable the following kprobes and launch a process to trigger a fork to see the
kernel crash.

Conf #1
echo 'r:event1 ftrace_ops_assist_func' > kprobe_events
echo 'r:event2 clear_all_latency_tracing' > kprobe_events
Crash log:[2]

Conf #2
echo 'r:event1 ftrace_ops_assist_func' > kprobe_events
echo 'r:event2 acct_clear_integrals' > kprobe_events
Crash log:[3]

Conf #3
echo 'r:event1 ftrace_ops_assist_func' > kprobe_events
echo 'r:event2 arch_dup_task_struct' > kprobe_events
Crash log:[4]

The ftrace_ops_assist_func should be included in the kprobe blacklist using
NOKPROBE_SYMBOL. See patch [2/2].

Since those were found using fuzzing, it's not an exhaustive analysis.
Here is the .config I am using[5].


Francis Deslauriers
EfficiOS inc.


Francis Deslauriers (2):
kprobe: fix: Add _ASM_NOKPROBE to x86 apic interrupt macro
kprobe: fix: Add ftrace_ops_assist_func to kprobe blacklist

arch/x86/entry/entry_64.S | 1 +
kernel/trace/ftrace.c | 2 ++
2 files changed, 3 insertions(+)


 \ /
  Last update: 2017-07-14 17:10    [W:0.136 / U:3.032 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site