On 08/07, Linus Torvalds wrote:
>
> Now, I do agree that the debug registers are *much* less likely to
> have those kinds of really subtle issues, so maybe relaxing some of
> the tests might be reasonable. I'd be a bit nervous about it, but if
> it's *only* the length/alignment, and Intel people can be convinced
> that it doesn't result in any nasty undefined behavior (as long as the
> address is in user space), maybe we could make that change just to
> make it easier for Wine.
Oh, I do not know. And again, this way a user can't notice the problem
if the arguments are wrong.
But personally I think it would be nice to cleanup the perf interface,
although probably it is too later.
On x86 execute breakpoints are only a single byte, which has to be
the first byte of the instruction. IOW the hardware requires len = 1
in dr7 or it doesn't work (iirc).
But for some reason perf requires bp_len = sizeof(long), not 1. And
note that it sets info->len = X86_BREAKPOINT_LEN_X. The comment says:
x86 inst breakpoints need to have a specific undefined len
but despite its "special" name LEN_X is simply LEN_1, and other code
relies on this fact.
Now, ptrace correctly requires DR_LEN_1. So arch_bp_generic_fields()
translates this into "gen_len = sizeof(long)" for validation.
arch_build_bp_info() thinks that X86_BREAKPOINT_EXECUTE should have
->bp_len == sizeof(long), so we translate it back into LEN_1 internally.
This looks confusing, imho. And imho X86_BREAKPOINT_LEN_X should die.
> But the kernel address checking definitely needs to stay around for
> security reasons.
Sure. And btw it doesn't look right. I sent the patch below twice (iirc),
perhaps I should resend it again.
Oleg.
Date: Fri, 9 Nov 2012 19:29:43 +0100
Subject: [PATCH] arch_check_bp_in_kernelspace: fix the range check
arch_check_bp_in_kernelspace() tries to avoid the overflow and does 2
TASK_SIZE checks but it needs OR, not AND. Consider va = TASK_SIZE -1
and len = 2 case.
Note: TASK_SIZE doesn't look right at least on x86, I think it should
be replaced by TASK_SIZE_MAX.
Signed-off-by: Oleg Nesterov <o...@redhat.com>
--- x/arch/arm64/kernel/hw_breakpoint.c
+++ x/arch/arm64/kernel/hw_breakpoint.c
@@ -293,7 +293,7 @@ int arch_check_bp_in_kernelspace(struct
va = info->address;
len = get_hbp_len(info->ctrl.len);
- return (va >= TASK_SIZE) && ((va + len - 1) >= TASK_SIZE);
+ return (va >= TASK_SIZE) || ((va + len - 1) >= TASK_SIZE);
}
/*
--- x/arch/arm/kernel/hw_breakpoint.c
+++ x/arch/arm/kernel/hw_breakpoint.c
@@ -464,7 +464,7 @@ int arch_check_bp_in_kernelspace(struct
va = info->address;
len = get_hbp_len(info->ctrl.len);
- return (va >= TASK_SIZE) && ((va + len - 1) >= TASK_SIZE);
+ return (va >= TASK_SIZE) || ((va + len - 1) >= TASK_SIZE);
}
/*
--- x/arch/sh/kernel/hw_breakpoint.c
+++ x/arch/sh/kernel/hw_breakpoint.c
@@ -132,7 +132,7 @@ int arch_check_bp_in_kernelspace(struct
va = info->address;
len = get_hbp_len(info->len);
- return (va >= TASK_SIZE) && ((va + len - 1) >= TASK_SIZE);
+ return (va >= TASK_SIZE) || ((va + len - 1) >= TASK_SIZE);
}
int arch_bp_generic_fields(int sh_len, int sh_type,
--- x/arch/x86/kernel/hw_breakpoint.c
+++ x/arch/x86/kernel/hw_breakpoint.c
@@ -200,7 +200,7 @@ int arch_check_bp_in_kernelspace(struct
va = info->address;
len = get_hbp_len(info->len);
- return (va >= TASK_SIZE) && ((va + len - 1) >= TASK_SIZE);
+ return (va >= TASK_SIZE) || ((va + len - 1) >= TASK_SIZE);
}
int arch_bp_generic_fields(int x86_len, int x86_type,
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
