From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from simark.ca by simark.ca with LMTP id nyU3One8IWTzRhsAWB0awg (envelope-from ) for ; Mon, 27 Mar 2023 11:55:35 -0400 Received: by simark.ca (Postfix, from userid 112) id DE0781E4A3; Mon, 27 Mar 2023 11:55:35 -0400 (EDT) Authentication-Results: simark.ca; dkim=pass (2048-bit key; unprotected) header.d=lists.lttng.org header.i=@lists.lttng.org header.a=rsa-sha256 header.s=default header.b=qSloGiWl; dkim-atps=neutral X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on simark.ca X-Spam-Level: X-Spam-Status: No, score=-8.0 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HTML_MESSAGE,MAILING_LIST_MULTI, RCVD_IN_DNSWL_HI,URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.6 Received: from lists.lttng.org (lists.lttng.org [167.114.26.123]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by simark.ca (Postfix) with ESMTPS id AB2C51E110 for ; Mon, 27 Mar 2023 11:55:34 -0400 (EDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=lists.lttng.org; s=default; t=1679932534; bh=Gmwn9UA51u3nf69Q0LaTgheYz2o2wuU9hCijSojrlQM=; h=References:In-Reply-To:Date:To:Subject:List-Id:List-Unsubscribe: List-Archive:List-Post:List-Help:List-Subscribe:From:Reply-To:Cc: From; b=qSloGiWlE43U+i3pCQFyRa2jEiBMD3yREMbAFh8pJFdR6s78HKIyaGVRFw6wosD8U YeZmQL7zzHf1xqEqMmNaTF9JVA9Aj8blDOI0u4xR5mQJUPp65/L57lxSgqt3p2s0Tb HWM8jS8vgkGoUOPeUHsxsBeIeWmJudPBX02aPNK9ZiP13yMLCN0H4bX5oni0xzQtfK kE38+nMpwtgftJ14kOhUmZNNuqaQRPKz3vg7C1KzjZNCYkVk8P94DHYsj14KRnOk0R 4k5+/e+geZ/RbtDIQRlilFA18uVkhgNAVzSNqEQGG+X8p8HIBaiyfXvi/mQcJAM+35 phMy2ZtwyzogQ== Received: from lists-lttng01.efficios.com (localhost [IPv6:::1]) by lists.lttng.org (Postfix) with ESMTP id 4Plcpt0PpFz2Jw9; Mon, 27 Mar 2023 11:55:34 -0400 (EDT) Received: from mail-lf1-f51.google.com (mail-lf1-f51.google.com [209.85.167.51]) by lists.lttng.org (Postfix) with ESMTPS id 4Plcn61yrSz2Jw5 for ; Mon, 27 Mar 2023 11:53:57 -0400 (EDT) Received: by mail-lf1-f51.google.com with SMTP id i13so12069084lfe.9 for ; Mon, 27 Mar 2023 08:53:57 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; t=1679932375; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=g4GohJg+E4LfQx6Zuo4ivb11c4nAF2/0T4H2ESuCtOM=; b=XzUzGeY1MtSwK4EAW5zTWfAzhpxhQugG7qK0ccmedj2t5IObClVtkExSDZ3cxymcQ5 OrOFVKOB1nSJqnhl9luucjHEkP8gfn+cmkQD3my1PwzjC4pBh97pXhVi67W//mgT3kUf HCPRcztUJtEJbX06GdFm2Bgu3rMW0f0HiJY2CFWEWJpOoo0eV3/0xdueylzSlGPqF7YX 2OKveH2fS0c70zE/PrCQwnctPJKA4R02KcE2egGapRcMo465OcX83p6n9oESYEWtENPi 88qZpeZLWwTaTSATmSa2sVQiw3Oj/Sl0dsSqv+Ankh24qIntSLYD471efU/OhM/uWTE3 qlbg== X-Gm-Message-State: AAQBX9fw3lIVM786deof03GEAFRKPty90yRPZoGURIsvMK7O9hh5Bbb2 tpPx3wi/CYeoZmRFom2ETQTQxTqu95H6Pr2Jo/0= X-Google-Smtp-Source: AKy350YJLtjkkoYz/VSxN8rT7EtuyrP07XjBzRdxM7kT0bKGlVmTEKvqDb+4hMxa7ReFQJobUvFkwmbxjs+FP4qpCIM= X-Received: by 2002:ac2:5ed9:0:b0:4e9:a3b7:2369 with SMTP id d25-20020ac25ed9000000b004e9a3b72369mr3551168lfq.7.1679932374512; Mon, 27 Mar 2023 08:52:54 -0700 (PDT) MIME-Version: 1.0 References: <3056c476-0e3a-8cde-39e4-907602d26d76@efficios.com> In-Reply-To: <3056c476-0e3a-8cde-39e4-907602d26d76@efficios.com> Date: Mon, 27 Mar 2023 21:22:41 +0530 Message-ID: To: Mathieu Desnoyers X-Mailman-Approved-At: Mon, 27 Mar 2023 11:55:33 -0400 Subject: Re: [lttng-dev] https://lists.lttng.org/pipermail/lttng-dev/2020-May/029631.html X-BeenThere: lttng-dev@lists.lttng.org X-Mailman-Version: 2.1.39 Precedence: list List-Id: LTTng development list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , From: yashvardhan kukreti via lttng-dev Reply-To: yashvardhan kukreti Cc: lttng-dev@lists.lttng.org Content-Type: multipart/mixed; boundary="===============2085517413830473185==" Errors-To: lttng-dev-bounces@lists.lttng.org Sender: "lttng-dev" --===============2085517413830473185== Content-Type: multipart/alternative; boundary="0000000000006df6b105f7e3bce2" --0000000000006df6b105f7e3bce2 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable 62 #ifdef LTTNG_CONFIG_PPC64_ELF_ABI_V2 63 /* Substract 4 bytes to get what we originally want */ 64 addr =3D (unsigned long)(((char *)probe.addr) - 4); 65 #elif defined*(LTTNG_*CONFIG_PPC64_ELF_ABI_V1) << incorrect MACRO to used in gerrit review. this is the correct one. 66 /* 67 * Build a function descriptor from the address of /lttng-module-2.13.8/src/wrapper/kallsyms.c:72:32: error: invalid use of undefined type 'struct func_desc' | 72 | kallsyms_lookup_name_func_desc.addr =3D (unsigned long)probe.add= r; /lttng-module-2.13.8/src/wrapper/kallsyms.c:73:32: error: invalid use of undefined type 'struct func_desc' | 73 | kallsyms_lookup_name_func_desc.toc =3D ((struct func_desc *) &sprint_symbol)->toc; you either want to use func_descr_t https://elixir.bootlin.com/linux/v5.15.104/source/arch/powerpc/include/asm/= types.h#L30 or struct ppc64_opd_entry https://elixir.bootlin.com/linux/v5.17.15/source/arch/powerpc/include/uapi/= asm/elf.h#L293 both of which are discontinued from 5.18 On Mon, Mar 27, 2023 at 5:56=E2=80=AFPM Mathieu Desnoyers < mathieu.desnoyers@efficios.com> wrote: > On 2023-03-26 11:00, yashvardhan kukreti wrote: > > > > Hi Mathew, > > > > I have a question about this patch for lttng-modules and the use of > > register_kprobe() to fetch the function ptr. > > The question in this regard is especially from PPC64 ELF_ABI_v1 > > perspective. > > > > The functions on PPC64 are accessed via the Function descriptor > > while what register_kprobes returns is the entry point of the > function. > > Hence using the return pointer tends to interpret the addr as the > > address of the function descriptor and dereferences the ppc_inst as > > the function entry point and crashes > > > > [ 4145.483594] kernel tried to execute exec-protected page > > (7c0802a6fb81ffe0) - exploit attempt? (uid: 0) > > here 7c0802a6 is the mfspr instruction from the code text section o= f > > the kallsyms_lookup_name() > > > > note for PPC_ELF_ABI_v1 the register_kprobes() searches for the dot > > variant of the symbol and only in case if cannot find the dot > > variant looks for the normal symbol. > > register_kprobe() -> kprobe_addr() -> kprobe_lookup_name() [arch > > variant replaces weak symbol] > > > https://elixir.bootlin.com/linux/v5.10.174/C/ident/kprobe_lookup_name < > https://elixir.bootlin.com/linux/v5.10.174/C/ident/kprobe_lookup_name> > > > > Please let me know if i make sense or that i may have missed > something. > > > > I have looked at the code of 2.12.8 as well and 2.12.3 verstion of > > lttng-modules. > > Please have a look at commits (from stable-2.12 branch of lttng-modules): > > commit 53772db24facd84f1f3ddcf21a1ef5f162608721 > Author: He Zhe > Date: Tue Sep 27 15:59:42 2022 +0800 > > wrapper: powerpc64: fix kernel crash caused by do_get_kallsyms > > commit 8fe888d86ccad4226b05a536efb73d71bb091062 > Author: Michael Jeanson > Date: Thu Nov 24 14:25:33 2022 -0500 > > fix: kallsyms wrapper on ppc64el > > I suspect you'll also need this change currently in review: > > https://review.lttng.org/c/lttng-modules/+/9113 > > Please let us know if especially this last change fixes things on your > side. > > Thanks, > > Mathieu > > > > > > Regards, > > Shashank > > > > -- > Mathieu Desnoyers > EfficiOS Inc. > https://www.efficios.com > > --0000000000006df6b105f7e3bce2 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
=C2=A062 #ifdef LTTNG_CONFIG_PPC64_ELF_ABI_V2
=C2= =A063 =C2=A0 =C2=A0 =C2=A0 =C2=A0 /* Substract 4 bytes to get what we origi= nally want */
=C2=A064 =C2=A0 =C2=A0 =C2=A0 =C2=A0 addr =3D (unsigned lo= ng)(((char *)probe.addr) - 4);
=C2=A065 #elif defined(LTTNG_CONFI= G_PPC64_ELF_ABI_V1)=C2=A0 =C2=A0<< incorrect MACRO to used=C2=A0in ge= rrit review. this is the correct one.
=C2=A066 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 /*
=C2=A067 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0* Build a function des= criptor from the address of

/lttng-module-2.13.8/sr= c/wrapper/kallsyms.c:72:32: error: invalid use of undefined type 'struc= t func_desc'
| =C2=A0 =C2=A072 | =C2=A0kallsyms_lookup_name_func_des= c.addr =3D (unsigned long)probe.addr;
/lttng-module-2.13.8/src/wrap= per/kallsyms.c:73:32: error: invalid use of undefined type 'struct func= _desc'
| =C2=A0 =C2=A073 | =C2=A0kallsyms_lookup_name_func_desc.toc = =3D ((struct func_desc *) &sprint_symbol)->toc;

you either want to use func_descr_t=C2=A0
or
struct ppc64_opd_e= ntry

On Mon, Mar 27, 2023 at 5:56=E2=80=AFPM Mathieu Desnoyers &= lt;mathieu.desnoyers@effi= cios.com> wrote:
On 2023-03-26 11:00, yashvardhan kukreti wrote:
>
>=C2=A0 =C2=A0 =C2=A0Hi Mathew,
>
>=C2=A0 =C2=A0 =C2=A0I have a question about this patch for lttng-module= s and the use of
>=C2=A0 =C2=A0 =C2=A0register_kprobe() to fetch the function ptr.
>=C2=A0 =C2=A0 =C2=A0The question in this regard is especially from PPC6= 4 ELF_ABI_v1
>=C2=A0 =C2=A0 =C2=A0perspective.
>
>=C2=A0 =C2=A0 =C2=A0The functions on PPC64 are accessed via the Functio= n descriptor
>=C2=A0 =C2=A0 =C2=A0while what register_kprobes returns is the entry po= int of the function.
>=C2=A0 =C2=A0 =C2=A0Hence using the return pointer tends to interpret= =C2=A0the addr as the
>=C2=A0 =C2=A0 =C2=A0address of the function descriptor=C2=A0and derefer= ences the ppc_inst as
>=C2=A0 =C2=A0 =C2=A0the function entry=C2=A0point=C2=A0and crashes
>
>=C2=A0 =C2=A0 =C2=A0[ 4145.483594] kernel tried to execute exec-protect= ed page
>=C2=A0 =C2=A0 =C2=A0(7c0802a6fb81ffe0) - exploit attempt? (uid: 0)
>=C2=A0 =C2=A0 =C2=A0here 7c0802a6 is the mfspr instruction from the cod= e text section of
>=C2=A0 =C2=A0 =C2=A0the kallsyms_lookup_name()
>
>=C2=A0 =C2=A0 =C2=A0note for PPC_ELF_ABI_v1 the register_kprobes() sear= ches for the dot
>=C2=A0 =C2=A0 =C2=A0variant of the symbol and only in case if cannot fi= nd the dot
>=C2=A0 =C2=A0 =C2=A0variant looks for the normal symbol.
>=C2=A0 =C2=A0 =C2=A0register_kprobe() -> kprobe_addr() -> kprobe_= lookup_name() [arch
>=C2=A0 =C2=A0 =C2=A0variant replaces weak symbol]
>=C2=A0 =C2=A0 =C2=A0https:/= /elixir.bootlin.com/linux/v5.10.174/C/ident/kprobe_lookup_name <https://elixir.bootlin.com/linux/v5= .10.174/C/ident/kprobe_lookup_name>
>
>=C2=A0 =C2=A0 =C2=A0Please let me know if i make sense or that i may ha= ve missed something.
>
>=C2=A0 =C2=A0 =C2=A0I have looked at the code of 2.12.8 as well and 2.1= 2.3 verstion of
>=C2=A0 =C2=A0 =C2=A0lttng-modules.

Please have a look at commits (from stable-2.12 branch of lttng-modules):
commit 53772db24facd84f1f3ddcf21a1ef5f162608721
Author: He Zhe <zhe.he@windriver.com>
Date:=C2=A0 =C2=A0Tue Sep 27 15:59:42 2022 +0800

=C2=A0 =C2=A0 =C2=A0wrapper: powerpc64: fix kernel crash caused by do_get_k= allsyms

commit 8fe888d86ccad4226b05a536efb73d71bb091062
Author: Michael Jeanson <mjeanson@efficios.com>
Date:=C2=A0 =C2=A0Thu Nov 24 14:25:33 2022 -0500

=C2=A0 =C2=A0 =C2=A0fix: kallsyms wrapper on ppc64el

I suspect you'll also need this change currently in review:

https://review.lttng.org/c/lttng-modules/+/9113
Please let us know if especially this last change fixes things on your side= .

Thanks,

Mathieu


>
>=C2=A0 =C2=A0 =C2=A0Regards,
>=C2=A0 =C2=A0 =C2=A0Shashank
>

--
Mathieu Desnoyers
EfficiOS Inc.
h= ttps://www.efficios.com

--0000000000006df6b105f7e3bce2-- --===============2085517413830473185== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ lttng-dev mailing list lttng-dev@lists.lttng.org https://lists.lttng.org/cgi-bin/mailman/listinfo/lttng-dev --===============2085517413830473185==--