On book3s/32, a kprobe on an instruction that can't be emulated and has
to be single stepped out of line, crashes the kernel. For e.g. with the
following cmds...
~> echo 9 > /proc/sys/kernel/printk
~> mount -t debugfs debugfs /sys/kernel/debug
~> echo 'p:wx filldir64+0xb8' > /sys/kernel/debug/tracing/kprobe_events
~> echo 1 > /sys/kernel/debug/tracing/events/kprobes/wx/enable
~> echo 1 > /sys/kernel/debug/tracing/events/kprobes/enable
...we can see the following crash:
kernel tried to execute exec-protected page (f101a008) - exploit attempt?
(uid: 0)
BUG: Unable to handle kernel instruction fetch
Faulting instruction address: 0xc02b919c
Vector: 400 (Instruction Access) at [f19a9d60]
pc: c02b919c: filldir64+0xb8/0x2dc
lr: c02b9148: filldir64+0x64/0x2dc
sp: f19a9e20
msr: 10029032
current = 0xc112e900
pid = 102, comm = ls
enter ? for help
[f19a9e20] c1a8d420 (unreliable)
[f19a9e50] c02e4074 dcache_readdir+0x208/0x2a8
[f19a9e90] c02b8c5c iterate_dir+0x88/0x1fc
[f19a9ec0] c02b96e0 sys_getdents64+0x88/0x198
[f19a9f10] c0014400 system_call_exception+0xf8/0x20c
[f19a9f30] c00191ac ret_from_syscall+0x0/0x2c
---- Exception: c00 (System Call) at a7596164
SP (af802310) is in userspace
This happens because on book3s/32 the exec permission is per segment
(256MB), not per page. The page tables have no hardware exec bit, only
the segment registers have a no-execute (N) bit. mmu_mark_initmem_nx()
sets N on all the kernel segments except the ones of the modules area.
So nothing in the vmalloc area can be executed, even when the page is
mapped with PAGE_KERNEL_ROX or PAGE_KERNEL_EXEC, because _PAGE_EXEC is
a software only bit there and the segment's N bit is what the MMU
enforces.
Before commit 1b750c2fbf82 ("powerpc: extend execmem_params for kprobes
allocations"), the kprobes insn pages came from module_alloc(). That
commit moved them to the whole of the vmalloc space, on the grounds
that kprobes use a breakpoint and don't need to be near the kernel
text. That is fine on platforms where the exec permission is per page,
as PAGE_KERNEL_ROX is then enough to make a vmalloc page executable.
It is not on book3s/32, where the modules area is not only close to
the kernel text but is also the only page-mapped area whose segment is
left executable. So the insn pages must keep coming from there.
Hence, use the modules area for EXECMEM_KPROBES on book3s/32.
Fixes: 1b750c2fbf82 ("powerpc: extend execmem_params for kprobes allocations")
Signed-off-by: Ritesh Harjani (IBM) <[email protected]>
---
arch/powerpc/mm/mem.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/arch/powerpc/mm/mem.c b/arch/powerpc/mm/mem.c
index 77b63b52d8f2..ae1bc7359353 100644
--- a/arch/powerpc/mm/mem.c
+++ b/arch/powerpc/mm/mem.c
@@ -391,6 +391,7 @@ struct execmem_info __init *execmem_arch_setup(void)
pgprot_t kprobes_prot = strict_kernel_rwx_enabled() ? PAGE_KERNEL_ROX :
PAGE_KERNEL_EXEC;
pgprot_t prot = strict_module_rwx_enabled() ? PAGE_KERNEL :
PAGE_KERNEL_EXEC;
unsigned long fallback_start = 0, fallback_end = 0;
+ unsigned long kprobes_start = VMALLOC_START, kprobes_end = VMALLOC_END;
unsigned long start, end;
/*
@@ -410,6 +411,11 @@ struct execmem_info __init *execmem_arch_setup(void)
}
end = MODULES_END;
+
+ if (IS_ENABLED(CONFIG_PPC_BOOK3S_32)) {
+ kprobes_start = MODULES_VADDR;
+ kprobes_end = MODULES_END;
+ }
#else
start = VMALLOC_START;
end = VMALLOC_END;
@@ -428,8 +434,8 @@ struct execmem_info __init *execmem_arch_setup(void)
.fallback_end = fallback_end,
},
[EXECMEM_KPROBES] = {
- .start = VMALLOC_START,
- .end = VMALLOC_END,
+ .start = kprobes_start,
+ .end = kprobes_end,
.pgprot = kprobes_prot,
.alignment = 1,
},
--
2.39.5
