Re: [RFC PATCH 2/2] kprobes/x86: Exit single-stepping before trying fixup_exception

[Masami Hiramatsu]

On Tue, 28 Feb 2017 01:14:38 +0900
Masami Hiramatsu <mhiramat@xxxxxxxxxx> wrote:

> Exit single-stepping out of line and get back regs->ip to original
> (probed) address before trying fixup_exception() if the exception
> happened on the singlestep buffer, since the fixup_exception()
> depends on regs->ip to search an entry on __ex_table.
> 
> Signed-off-by: Masami Hiramatsu <mhiramat@xxxxxxxxxx>
> ---
>  arch/x86/include/asm/kprobes.h |    1 
>  arch/x86/kernel/kprobes/core.c |   83 +++++++++++++++++++++++++---------------
>  arch/x86/kernel/traps.c        |   19 +++++++++
>  3 files changed, 71 insertions(+), 32 deletions(-)
> 
> diff --git a/arch/x86/include/asm/kprobes.h b/arch/x86/include/asm/kprobes.h
> index d1d1e50..79e121a 100644
> --- a/arch/x86/include/asm/kprobes.h
> +++ b/arch/x86/include/asm/kprobes.h
> @@ -111,6 +111,7 @@ struct kprobe_ctlblk {
>  	struct prev_kprobe prev_kprobe;
>  };
>  
> +extern int kprobe_exit_singlestep(struct pt_regs *regs);
>  extern int kprobe_fault_handler(struct pt_regs *regs, int trapnr);
>  extern int kprobe_exceptions_notify(struct notifier_block *self,
>  				    unsigned long val, void *data);
> diff --git a/arch/x86/kernel/kprobes/core.c b/arch/x86/kernel/kprobes/core.c
> index 34d3a52..f2a3f3b 100644
> --- a/arch/x86/kernel/kprobes/core.c
> +++ b/arch/x86/kernel/kprobes/core.c
> @@ -949,43 +949,62 @@ int kprobe_debug_handler(struct pt_regs *regs)
>  }
>  NOKPROBE_SYMBOL(kprobe_debug_handler);
>  
> -int kprobe_fault_handler(struct pt_regs *regs, int trapnr)
> +/* Fixup current ip register and reset current kprobe, if needed. */
> +int kprobe_exit_singlestep(struct pt_regs *regs)
>  {
> -	struct kprobe *cur = kprobe_running();
>  	struct kprobe_ctlblk *kcb = get_kprobe_ctlblk();
> +	struct kprobe *cur = kprobe_running();
>  
> -	if (unlikely(regs->ip == (unsigned long)cur->ainsn.insn)) {
> -		/* This must happen on single-stepping */
> -		WARN_ON(kcb->kprobe_status != KPROBE_HIT_SS &&
> -			kcb->kprobe_status != KPROBE_REENTER);
> -		/*
> -		 * We are here because the instruction being single
> -		 * stepped caused a page fault. We reset the current
> -		 * kprobe and the ip points back to the probe address
> -		 * and allow the page fault handler to continue as a
> -		 * normal page fault.
> -		 */
> -		regs->ip = (unsigned long)cur->addr;
> -		/*
> -		 * Trap flag (TF) has been set here because this fault
> -		 * happened where the single stepping will be done.
> -		 * So clear it by resetting the current kprobe:
> -		 */
> -		regs->flags &= ~X86_EFLAGS_TF;
> +	if (unlikely(regs->ip != (unsigned long)cur->ainsn.insn))

Oops, this is not unlikely, this is likely case (since I inverted the condition).

Thanks,


-- 
Masami Hiramatsu <mhiramat@xxxxxxxxxx>