History

x86/dumpstack: Dump user space code correctly again

H.J. reported that post 5.7 a segfault of a user space task does not longer dump the Code bytes when /proc/sys/debug/exception-trace is enabled. It prints 'Code: Bad RIP value.' instead. This was broken by a recent change which made probe_kernel_read() reject non-kernel addresses. Update show_opcodes() so it retrieves user space opcodes via copy_from_user_nmi().

Thomas Gleixner committed 6 years ago

Commit d181d2d1 parent 039a7a31 file · +17 −10Browse files

Unified · Split

arch/x86/kernel/dumpstack.c+17−10
@@ -71,6 +71,22 @@ static void printk_stack_address(unsigned long address, int reliable, · 70 unmodified lines
71 printk("%s %s%pB\n", log_lvl, reliable ? "" : "? ", (void *)address);71 printk("%s %s%pB\n", log_lvl, reliable ? "" : "? ", (void *)address);
72}72}
73 73
74static int copy_code(struct pt_regs *regs, u8 *buf, unsigned long src,
75 unsigned int nbytes)
76{
77 if (!user_mode(regs))
78 return copy_from_kernel_nofault(buf, (u8 *)src, nbytes);
79
80 /*
81 * Make sure userspace isn't trying to trick us into dumping kernel
82 * memory by pointing the userspace instruction pointer at it.
83 */
84 if (__chk_range_not_ok(src, nbytes, TASK_SIZE_MAX))
85 return -EINVAL;
86
87 return copy_from_user_nmi(buf, (void __user *)src, nbytes);
88}
89
74/*90/*
75 * There are a couple of reasons for the 2/3rd prologue, courtesy of Linus:91 * There are a couple of reasons for the 2/3rd prologue, courtesy of Linus:
76 *92 *
@@ -97,17 +113,8 @@ void show_opcodes(struct pt_regs *regs, const char *loglvl) · 20 unmodified lines
97#define OPCODE_BUFSIZE (PROLOGUE_SIZE + 1 + EPILOGUE_SIZE)113#define OPCODE_BUFSIZE (PROLOGUE_SIZE + 1 + EPILOGUE_SIZE)
98 u8 opcodes[OPCODE_BUFSIZE];114 u8 opcodes[OPCODE_BUFSIZE];
99 unsigned long prologue = regs->ip - PROLOGUE_SIZE;115 unsigned long prologue = regs->ip - PROLOGUE_SIZE;
100 bool bad_ip;
101
102 /*
103 * Make sure userspace isn't trying to trick us into dumping kernel
104 * memory by pointing the userspace instruction pointer at it.
105 */
106 bad_ip = user_mode(regs) &&
107 __chk_range_not_ok(prologue, OPCODE_BUFSIZE, TASK_SIZE_MAX);
108 116
109 if (bad_ip || copy_from_kernel_nofault(opcodes, (u8 *)prologue,117 if (copy_code(regs, opcodes, prologue, sizeof(opcodes))) {
110 OPCODE_BUFSIZE)) {
111 printk("%sCode: Bad RIP value.\n", loglvl);118 printk("%sCode: Bad RIP value.\n", loglvl);
112 } else {119 } else {
113 printk("%sCode: %" __stringify(PROLOGUE_SIZE) "ph <%02x> %"120 printk("%sCode: %" __stringify(PROLOGUE_SIZE) "ph <%02x> %"