From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1164421AbdEXW0D (ORCPT ); Wed, 24 May 2017 18:26:03 -0400 Received: from smtprelay0245.hostedemail.com ([216.40.44.245]:45361 "EHLO smtprelay.hostedemail.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1161529AbdEXWZ5 (ORCPT ); Wed, 24 May 2017 18:25:57 -0400 X-Session-Marker: 726F737465647440676F6F646D69732E6F7267 X-Spam-Summary: 2,0,0,,d41d8cd98f00b204,rostedt@goodmis.org,:::::::::::::,RULES_HIT:41:355:379:541:599:800:960:966:973:988:989:1260:1277:1311:1313:1314:1345:1359:1437:1515:1516:1518:1534:1543:1593:1594:1711:1730:1747:1777:1792:2196:2199:2393:2553:2559:2562:3138:3139:3140:3141:3142:3354:3622:3865:3866:3867:3868:3870:3872:3874:4321:4385:4559:5007:6119:6238:6261:7875:7903:8603:8660:9163:10004:10400:10848:10967:11026:11232:11473:11658:11914:12043:12296:12438:12555:12663:12710:12737:12740:12760:12895:12986:13148:13161:13229:13230:13439:13870:13904:14096:14097:14181:14659:14721:21063:21080:21451:21611:21622:30029:30054:30056:30079:30090:30091,0,RBL:none,CacheIP:none,Bayesian:0.5,0.5,0.5,Netcheck:none,DomainCache:0,MSF:not bulk,SPF:,MSBL:0,DNSBL:none,Custom_rules:0:0:0,LFtime:5,LUA_SUMMARY:none X-HE-Tag: size06_6d1e835c71862 X-Filterd-Recvd-Size: 4179 Date: Wed, 24 May 2017 18:25:47 -0400 From: Steven Rostedt To: Thomas Gleixner Cc: Kees Cook , LKML , x86@kernel.org, Masami Hiramatsu , "Luis R. Rodriguez" , Peter Zijlstra Subject: Re: [PATCH] x86/ftrace: Make sure that ftrace trampolines are not RWX Message-ID: <20170524182547.5c085dc7@vmware.local.home> In-Reply-To: References: <20170524134728.61a896c9@vmware.local.home> X-Mailer: Claws Mail 3.14.1 (GTK+ 2.24.31; x86_64-pc-linux-gnu) MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Wed, 24 May 2017 21:13:27 +0200 (CEST) Thomas Gleixner wrote: > > Oops: 0003 [#1] SMP > > Modules linked in: > > CPU: 3 PID: 1 Comm: swapper/0 Not tainted 4.12.0-rc2-test+ #42 > > Hardware name: MSI MS-7823/CSM-H87M-G43 (MS-7823), BIOS V1.6 > > 02/22/2014 task: ffff8802153a8000 task.stack: ffffc90000c74000 > > RIP: 0010:new_slab+0x1e8/0x2b4 > > RSP: 0000:ffffc90000c77b28 EFLAGS: 00010282 > > RAX: 0000000040040000 RBX: ffff880216003f00 RCX: ffff880214f5c058 > > RDX: 0000000000000000 RSI: ffff880214f5c000 RDI: ffff880216003f00 > > RBP: ffffc90000c77b70 R08: 000000000000002a R09: 0000000000000000 > > R10: 00000000000201e2 R11: 0000000000020190 R12: ffff880214f5c000 > > R13: 000000000000002e R14: 0000000000000001 R15: ffffea000853d700 > > FS: 0000000000000000(0000) GS:ffff88021eb80000(0000) > > knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: > > 0000000080050033 CR2: ffff880214f5c000 CR3: 000000000221d000 CR4: > > 00000000001406e0 Call Trace: > > ? interleave_nodes+0x29/0x40 > > ___slab_alloc+0x2e8/0x49e > > That does not make any sense, but I'm digging into it. The trampolines uses the module allocation, and it appears, that needs to become rw before freeing again. I applied this patch, and it appears to fix the bug for me. Signed-off-by: Steven Rostedt (VMware) -- Steve diff --git a/arch/x86/kernel/ftrace.c b/arch/x86/kernel/ftrace.c index 663a35d..5e93a9a 100644 --- a/arch/x86/kernel/ftrace.c +++ b/arch/x86/kernel/ftrace.c @@ -689,8 +689,12 @@ static inline void *alloc_tramp(unsigned long size) { return module_alloc(size); } -static inline void tramp_free(void *tramp) +static inline void tramp_free(void *tramp, int size) { + int npages; + + npages = PAGE_ALIGN(size) >> PAGE_SHIFT; + set_memory_rw((unsigned long)tramp, npages); module_memfree(tramp); } #else @@ -699,7 +703,7 @@ static inline void *alloc_tramp(unsigned long size) { return NULL; } -static inline void tramp_free(void *tramp) { } +static inline void tramp_free(void *tramp, int size) { } #endif /* Defined as markers to the end of the ftrace default trampolines */ @@ -771,7 +775,7 @@ create_trampoline(struct ftrace_ops *ops, unsigned int *tramp_size) /* Copy ftrace_caller onto the trampoline memory */ ret = probe_kernel_read(trampoline, (void *)start_offset, size); if (WARN_ON(ret < 0)) { - tramp_free(trampoline); + tramp_free(trampoline, *tramp_size); return 0; } @@ -797,7 +801,7 @@ create_trampoline(struct ftrace_ops *ops, unsigned int *tramp_size) /* Are we pointing to the reference? */ if (WARN_ON(memcmp(op_ptr.op, op_ref, 3) != 0)) { - tramp_free(trampoline); + tramp_free(trampoline, *tramp_size); return 0; } @@ -943,7 +947,7 @@ void arch_ftrace_trampoline_free(struct ftrace_ops *ops) if (!ops || !(ops->flags & FTRACE_OPS_FL_ALLOC_TRAMP)) return; - tramp_free((void *)ops->trampoline); + tramp_free((void *)ops->trampoline, ops->trampoline_size); ops->trampoline = 0; }