Hi,
Here is a series of kprobes blacklist bugfix and improvements mainly on x86 (since I started testing on qemu-x86).
This has been started from discussion about KPROBE_ENENTS_ON_NOTRACE configuration. I tried to find notrace functions which can cause kernel crash with kprobes using following script.
==== #!/bin/sh
i=0; cat notrace_functions | while read f ; do if echo p:event$i $f >> /sys/kernel/debug/tracing/kprobe_events; then echo "Probing on $f" echo 1 > /sys/kernel/debug/tracing/events/kprobes/event$i/enable fi i=$((i+1)) done ====
And I found several functions which must be blacklisted. - optprobe template code, which is just a template code and never be executed. Moreover, since it can be copied and reused, if we probe it, it modifies the template code and can cause a crash. ([1/9][2/9]) - functions which is called before kprobe_int3_handler() handles kprobes. This can cause a breakpoint recursion. ([3/9]) - IRQ entry text, which should not be probed since register/pagetable status has not been stable at that point. ([4/9]) - Suffixed symbols, like .constprop, .part etc. Those suffixed symbols never be blacklisted even if the non-suffixed version has been blacklisted. ([5/9]) - hardirq tracer also works before int3 handling. ([6/9]) - preempt_check debug function also is involved in int3 handling. ([7/9]) - RCU debug routine is also called before kprobe_int3_handler(). ([8/9]) - Some lockdep functions are also involved in int3 handling. ([9/9])
Of course there still may be some functions which can be called by configuration change, I'll continue to test it.
Thank you,
---
Masami Hiramatsu (9): x86/kprobes: Prohibit probing on optprobe template code x86/kprobes: Move trampoline code into RODATA x86/kprobes: Prohibit probing on functions before kprobe_int3_handler() x86/kprobes: Prohibit probing on IRQ handlers directly kprobes: Search non-suffixed symbol in blacklist kprobes: Prohibit probing on hardirq tracers kprobes: Prohibit probing on preempt_check debug functions kprobes: Prohibit probing on RCU debug routine kprobes: Prohibit probing on lockdep functions
arch/x86/kernel/alternative.c | 3 ++- arch/x86/kernel/ftrace.c | 3 ++- arch/x86/kernel/kprobes/core.c | 7 +++++++ arch/x86/kernel/kprobes/opt.c | 4 ++-- arch/x86/kernel/traps.c | 1 + kernel/kprobes.c | 21 ++++++++++++++++++++- kernel/locking/lockdep.c | 7 ++++++- kernel/rcu/tree.c | 2 ++ kernel/rcu/update.c | 2 ++ kernel/trace/trace_irqsoff.c | 9 +++++++-- kernel/trace/trace_preemptirq.c | 5 +++++ lib/smp_processor_id.c | 7 +++++-- 12 files changed, 61 insertions(+), 10 deletions(-)