diff options
| author | Masami Hiramatsu (Google) <mhiramat@kernel.org> | 2024-03-15 00:17:30 +0900 |
|---|---|---|
| committer | Ingo Molnar <mingo@kernel.org> | 2024-03-22 11:40:56 +0100 |
| commit | 4e51653d5d871f40f1bd5cf95cc7f2d8b33d063b (patch) | |
| tree | 4b75c36977acabb1b31101b3f58c47f6248235e8 | |
| parent | e3f269ed0accbb22aa8f25d2daffa23c3fccd407 (diff) | |
| download | lwn-4e51653d5d871f40f1bd5cf95cc7f2d8b33d063b.tar.gz lwn-4e51653d5d871f40f1bd5cf95cc7f2d8b33d063b.zip | |
kprobes/x86: Use copy_from_kernel_nofault() to read from unsafe address
Read from an unsafe address with copy_from_kernel_nofault() in
arch_adjust_kprobe_addr() because this function is used before checking
the address is in text or not. Syzcaller bot found a bug and reported
the case if user specifies inaccessible data area,
arch_adjust_kprobe_addr() will cause a kernel panic.
[ mingo: Clarified the comment. ]
Fixes: cc66bb914578 ("x86/ibt,kprobes: Cure sym+0 equals fentry woes")
Reported-by: Qiang Zhang <zzqq0103.hey@gmail.com>
Tested-by: Jinghao Jia <jinghao7@illinois.edu>
Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Link: https://lore.kernel.org/r/171042945004.154897.2221804961882915806.stgit@devnote2
| -rw-r--r-- | arch/x86/kernel/kprobes/core.c | 11 |
1 files changed, 10 insertions, 1 deletions
diff --git a/arch/x86/kernel/kprobes/core.c b/arch/x86/kernel/kprobes/core.c index 091b3ab76a18..d0e49bd7c6f3 100644 --- a/arch/x86/kernel/kprobes/core.c +++ b/arch/x86/kernel/kprobes/core.c @@ -373,7 +373,16 @@ out: kprobe_opcode_t *arch_adjust_kprobe_addr(unsigned long addr, unsigned long offset, bool *on_func_entry) { - if (is_endbr(*(u32 *)addr)) { + u32 insn; + + /* + * Since 'addr' is not guaranteed to be safe to access, use + * copy_from_kernel_nofault() to read the instruction: + */ + if (copy_from_kernel_nofault(&insn, (void *)addr, sizeof(u32))) + return NULL; + + if (is_endbr(insn)) { *on_func_entry = !offset || offset == 4; if (*on_func_entry) offset = 4; |