H.J. reported that post 5.7 a segfault of a user space task does not longer dump the Code bytes when /proc/sys/debug/exception-trace is enabled. It prints 'Code: Bad RIP value.' instead. This was broken by a recent change which made probe_kernel_read() reject non-kernel addresses. Update show_opcodes() so it retrieves user space opcodes via copy_from_user_nmi().
Unified · Split
| @@ -71,6 +71,22 @@ static void printk_stack_address(unsigned long address, int reliable, · 70 unmodified lines | ||
| 71 | 71 | printk("%s %s%pB\n", log_lvl, reliable ? "" : "? ", (void *)address); |
| 72 | 72 | } |
| 73 | 73 | |
| 74 | +static int copy_code(struct pt_regs *regs, u8 *buf, unsigned long src, | |
| 75 | + unsigned int nbytes) | |
| 76 | +{ | |
| 77 | + if (!user_mode(regs)) | |
| 78 | + return copy_from_kernel_nofault(buf, (u8 *)src, nbytes); | |
| 79 | + | |
| 80 | + /* | |
| 81 | + * Make sure userspace isn't trying to trick us into dumping kernel | |
| 82 | + * memory by pointing the userspace instruction pointer at it. | |
| 83 | + */ | |
| 84 | + if (__chk_range_not_ok(src, nbytes, TASK_SIZE_MAX)) | |
| 85 | + return -EINVAL; | |
| 86 | + | |
| 87 | + return copy_from_user_nmi(buf, (void __user *)src, nbytes); | |
| 88 | +} | |
| 89 | + | |
| 74 | 90 | /* |
| 75 | 91 | * There are a couple of reasons for the 2/3rd prologue, courtesy of Linus: |
| 76 | 92 | * |
| @@ -97,17 +113,8 @@ void show_opcodes(struct pt_regs *regs, const char *loglvl) · 20 unmodified lines | ||
| 97 | 113 | #define OPCODE_BUFSIZE (PROLOGUE_SIZE + 1 + EPILOGUE_SIZE) |
| 98 | 114 | u8 opcodes[OPCODE_BUFSIZE]; |
| 99 | 115 | unsigned long prologue = regs->ip - PROLOGUE_SIZE; |
| 100 | − bool bad_ip; | |
| 101 | − | |
| 102 | − /* | |
| 103 | − * Make sure userspace isn't trying to trick us into dumping kernel | |
| 104 | − * memory by pointing the userspace instruction pointer at it. | |
| 105 | − */ | |
| 106 | − bad_ip = user_mode(regs) && | |
| 107 | − __chk_range_not_ok(prologue, OPCODE_BUFSIZE, TASK_SIZE_MAX); | |
| 108 | 116 | |
| 109 | − if (bad_ip || copy_from_kernel_nofault(opcodes, (u8 *)prologue, | |
| 110 | − OPCODE_BUFSIZE)) { | |
| 117 | + if (copy_code(regs, opcodes, prologue, sizeof(opcodes))) { | |
| 111 | 118 | printk("%sCode: Bad RIP value.\n", loglvl); |
| 112 | 119 | } else { |
| 113 | 120 | printk("%sCode: %" __stringify(PROLOGUE_SIZE) "ph <%02x> %" |