mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-23 09:19:51 +00:00
uprobes: Change handle_trampoline() to flush the frames invalidated by longjmp()
Test-case: #include <stdio.h> #include <setjmp.h> jmp_buf jmp; void func_2(void) { longjmp(jmp, 1); } void func_1(void) { if (setjmp(jmp)) return; func_2(); printf("ERR!! I am running on the caller's stack\n"); } int main(void) { func_1(); return 0; } fails if you probe func_1() and func_2() because handle_trampoline() assumes that the probed function should must return and hit the bp installed be prepare_uretprobe(). But in this case func_2() does not return, so when func_1() returns the kernel uses the no longer valid return_instance of func_2(). Change handle_trampoline() to unwind ->return_instances until we know that the next chain is alive or NULL, this ensures that the current chain is the last we need to report and free. Alternatively, every return_instance could use unique trampoline_vaddr, in this case we could use it as a key. And this could solve the problem with sigaltstack() automatically. But this approach needs more changes, and it puts the "hard" limit on MAX_URETPROBE_DEPTH. Plus it can not solve another problem partially fixed by the next patch. Note: this change has no effect on !x86, the arch-agnostic version of arch_uretprobe_is_alive() just returns "true". TODO: as documented by the previous change, arch_uretprobe_is_alive() can be fooled by sigaltstack/etc. Tested-by: Pratyush Anand <panand@redhat.com> Signed-off-by: Oleg Nesterov <oleg@redhat.com> Acked-by: Srikar Dronamraju <srikar@linux.vnet.ibm.com> Acked-by: Anton Arapov <arapov@gmail.com> Cc: Andy Lutomirski <luto@amacapital.net> Cc: Linus Torvalds <torvalds@linux-foundation.org> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Thomas Gleixner <tglx@linutronix.de> Link: http://lkml.kernel.org/r/20150721134021.GA4773@redhat.com Signed-off-by: Ingo Molnar <mingo@kernel.org>
This commit is contained in:
parent
7b868e4802
commit
5eeb50de42
1 changed files with 18 additions and 11 deletions
|
@ -1774,6 +1774,7 @@ static void handle_trampoline(struct pt_regs *regs)
|
|||
{
|
||||
struct uprobe_task *utask;
|
||||
struct return_instance *ri, *next;
|
||||
bool valid;
|
||||
|
||||
utask = current->utask;
|
||||
if (!utask)
|
||||
|
@ -1783,18 +1784,24 @@ static void handle_trampoline(struct pt_regs *regs)
|
|||
if (!ri)
|
||||
goto sigill;
|
||||
|
||||
next = find_next_ret_chain(ri);
|
||||
/*
|
||||
* TODO: we should throw out return_instance's invalidated by
|
||||
* longjmp(), currently we assume that the probed function always
|
||||
* returns.
|
||||
*/
|
||||
instruction_pointer_set(regs, ri->orig_ret_vaddr);
|
||||
do {
|
||||
handle_uretprobe_chain(ri, regs);
|
||||
ri = free_ret_instance(ri);
|
||||
utask->depth--;
|
||||
} while (ri != next);
|
||||
/*
|
||||
* We should throw out the frames invalidated by longjmp().
|
||||
* If this chain is valid, then the next one should be alive
|
||||
* or NULL; the latter case means that nobody but ri->func
|
||||
* could hit this trampoline on return. TODO: sigaltstack().
|
||||
*/
|
||||
next = find_next_ret_chain(ri);
|
||||
valid = !next || arch_uretprobe_is_alive(next, regs);
|
||||
|
||||
instruction_pointer_set(regs, ri->orig_ret_vaddr);
|
||||
do {
|
||||
if (valid)
|
||||
handle_uretprobe_chain(ri, regs);
|
||||
ri = free_ret_instance(ri);
|
||||
utask->depth--;
|
||||
} while (ri != next);
|
||||
} while (!valid);
|
||||
|
||||
utask->return_instances = ri;
|
||||
return;
|
||||
|
|
Loading…
Reference in a new issue