CONFIG_RETHUNK int3 filling prevents kprobes in function body

From: Google
Date: Sun Sep 04 2022 - 10:07:26 EST


Hi Peter,

I found that the CONFIG_RETHUNK code (path_return) fills the unused bytes
with int3 for padding. Unfortunately, this prevents kprobes on the function
body after the return code (e.g. branch blocks placed behind the return.)

This is because kprobes decodes function body to ensure the probed address
is an instruction boundary, and if it finds the 0xcc (int3), it stops
decoding and reject probing because the int3 is usually used for a
software breakpoint and is replacing some other instruction. Without
recovering the instruction, it can not continue decoding safely.

Can we use another instruction for padding instead of INT3? (e.g. NOP or UD2)

Or, can I expect the instruction length in __return_sites[] are always 5?
If so, I can just skip 5 bytes if the address is in __return_sites[].

Thank you,

--
Masami Hiramatsu (Google) <mhiramat@xxxxxxxxxx>