From patchwork Thu Jul 16 15:19:41 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Daniel Thompson X-Patchwork-Id: 235648 Delivered-To: patches@linaro.org Received: by 2002:a92:d244:0:0:0:0:0 with SMTP id v4csp888587ilg; Thu, 16 Jul 2020 08:20:06 -0700 (PDT) X-Received: by 2002:a1c:c38a:: with SMTP id t132mr4728091wmf.1.1594912806298; Thu, 16 Jul 2020 08:20:06 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1594912806; cv=none; d=google.com; s=arc-20160816; b=dTLLmXhK9wJfNz590vRRatB9DEypWMhERFIS+JN0IUs7pjlUMKIO475yziVtpY87mt ST5JN35XEdxRRzX54Y0hHMYJDYuT9q67CH/SmiJVyV8Wtws/NYXc4KzFEO0RPDfGXg4a oE8RUxIhiaiwxG7UCkY1DkLYzsqOqRcOFMHzJ11X8+U8K9y7FI7FDAAw3v/PdlkT2kXB F4awFR5CKt+ZCkmkcEppY4ioAZL6rgDA+INOt+vccZFgr9hGyaepOsHE1bDeBUWc1nfF gPzX3P0E/yQJ1cgbPm3Wmo8dkD0Zv9/+6ejtV7R/uI0YcOOY9DpoenYnv9mG75GrGgra GBNw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:dkim-signature; bh=Bt894HzKEOa1juEk1zUwT+0wI2k83kLqjbCs4ktmwwU=; b=zboj8hsuobHyrxUIM5oXe2+zZvJ4+Sja8wGd9DaocDEKGI+Uf7Eef3bf8bf/+qudsB PAix4UawOK/DbkmuFic32BZSHBGr1mT71f98rpg3qijs+iJ3NJEGyFmLFvOBzCbjm2rA tRm/UBfMGQ5tV2L4G2NdAH/AeL2rC2jvkehB26fN4DdVXtcVh7Shjdv0hhFnMqwMeazq 7ifHWhtZTyrT0H4RHmaC+hjyzijSwOxbUVjZpM7xrMVwZTsaFi7tEQLPctMOqvWssSOb IBE9d5MFn3oXkln8tzzzyO8/HyYtM1IquBq4DzeF67zyNwaKuUd2oTFIw3w3T2qGsUdC hVqg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=fxPQnWz5; spf=pass (google.com: domain of daniel.thompson@linaro.org designates 209.85.220.65 as permitted sender) smtp.mailfrom=daniel.thompson@linaro.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Return-Path: Received: from mail-sor-f65.google.com (mail-sor-f65.google.com. [209.85.220.65]) by mx.google.com with SMTPS id r1sor3486140wrw.16.2020.07.16.08.20.06 for (Google Transport Security); Thu, 16 Jul 2020 08:20:06 -0700 (PDT) Received-SPF: pass (google.com: domain of daniel.thompson@linaro.org designates 209.85.220.65 as permitted sender) client-ip=209.85.220.65; Authentication-Results: mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=fxPQnWz5; spf=pass (google.com: domain of daniel.thompson@linaro.org designates 209.85.220.65 as permitted sender) smtp.mailfrom=daniel.thompson@linaro.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=Bt894HzKEOa1juEk1zUwT+0wI2k83kLqjbCs4ktmwwU=; b=fxPQnWz59Up3zrl0RzjlzsOI92Vi4xDMdkMXTsmF5eF0O69S/9QxQx9W5N0gO6uQYd KMdRrpjWnQyRnQJhnI6HgyildgntrisyLJWqjKqgeKOSYhViY94se2D0JSclNyQnA7db /fQRmh33E3YqGzdcKag+knbWwqpO2rA1HbbXG8iZ20YU/Zz9EcyhlYo/iDnsTKFSEgz8 +BRuUnqW73/9iSuxSWWRFjGUnIRJA12dw1cdtZODQbLbyaGOD2jj2/KVPM8esB70T8Xm 8d31C4aC+oKfEyti14BQW7FsyMfy65bFrwItW48j94uqHi2wA1eBpeyR9pj7QXhoSVIG 5u8g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=Bt894HzKEOa1juEk1zUwT+0wI2k83kLqjbCs4ktmwwU=; b=bVCFZOKbxbc8SkP5Kwv7M5eE4mvURtqd6vYepSHSmCNFT8aEdWGOBVpDBvfgm0a1R4 xo4qBqKW25mEaJYaBsTIGbZohazBrA5ticdm2YJ5WmLSmyM3ke9mw11iwNtYRmxSHVea 6gBKA1Vsoln4wxaKCuO42kiLFlEEVsDpFA6GccNRISqrNqHRPE9+MXr72f2CoL0c6UbW bppSSrRb92ELAOdpXvx6Gz8eTuo04l+iUp8dmSbfIK9iSMIO7Bobi8wl/fwyCFL8NUx7 nFrpp3a2jbE8/e1yj5YTZ81DuAS54vUnZI+YjIN/l6RfncAvAUVDU0en09sqloJF5uJF DBqA== X-Gm-Message-State: AOAM531+B/vZ9cCHOaZdc9tjLu/j6hBOPvmU2lFPDyeqYXiKAnb0lVdA zxpewC6bs2aqlXZBLUzbE7UDc+fz X-Google-Smtp-Source: ABdhPJxL8ueR/OcnC3ZDGghtoI6P4Ks6MOUOjDetInyQZqPmjy2evPI+PENXwSQ2/p8MNK4GuK8RpA== X-Received: by 2002:adf:f14c:: with SMTP id y12mr5460591wro.30.1594912805876; Thu, 16 Jul 2020 08:20:05 -0700 (PDT) Return-Path: Received: from wychelm.lan (cpc141214-aztw34-2-0-cust773.18-1.cable.virginm.net. [86.9.19.6]) by smtp.gmail.com with ESMTPSA id u17sm9877687wrp.70.2020.07.16.08.20.04 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 16 Jul 2020 08:20:05 -0700 (PDT) From: Daniel Thompson To: Jason Wessel , Douglas Anderson Cc: Daniel Thompson , Peter Zijlstra , sumit.garg@linaro.org, pmladek@suse.com, sergey.senozhatsky@gmail.com, will@kernel.org, Masami Hiramatsu , kgdb-bugreport@lists.sourceforge.net, linux-kernel@vger.kernel.org, patches@linaro.org Subject: [PATCH v2 1/3] kgdb: Honour the kprobe blocklist when setting breakpoints Date: Thu, 16 Jul 2020 16:19:41 +0100 Message-Id: <20200716151943.2167652-2-daniel.thompson@linaro.org> X-Mailer: git-send-email 2.25.4 In-Reply-To: <20200716151943.2167652-1-daniel.thompson@linaro.org> References: <20200716151943.2167652-1-daniel.thompson@linaro.org> MIME-Version: 1.0 Currently kgdb has absolutely no safety rails in place to discourage or prevent a user from placing a breakpoint in dangerous places such as the debugger's own trap entry/exit and other places where it is not safe to take synchronous traps. Introduce a new config symbol KGDB_HONOUR_BLOCKLIST and modify the default implementation of kgdb_validate_break_address() so that we use the kprobe blocklist to prohibit instrumentation of critical functions if the config symbol is set. The config symbol dependencies are set to ensure that the blocklist will be enabled by default if we enable KGDB and are compiling for an architecture where we HAVE_KPROBES. Suggested-by: Peter Zijlstra Signed-off-by: Daniel Thompson --- include/linux/kgdb.h | 18 ++++++++++++++++++ kernel/debug/debug_core.c | 4 ++++ kernel/debug/kdb/kdb_bp.c | 9 +++++++++ lib/Kconfig.kgdb | 14 ++++++++++++++ 4 files changed, 45 insertions(+) -- 2.25.4 Reviewed-by: Douglas Anderson diff --git a/include/linux/kgdb.h b/include/linux/kgdb.h index 529116b0cabe..7caba4604edc 100644 --- a/include/linux/kgdb.h +++ b/include/linux/kgdb.h @@ -16,6 +16,7 @@ #include #include #include +#include #ifdef CONFIG_HAVE_ARCH_KGDB #include #endif @@ -323,6 +324,23 @@ extern int kgdb_nmicallin(int cpu, int trapnr, void *regs, int err_code, atomic_t *snd_rdy); extern void gdbstub_exit(int status); +/* + * kgdb and kprobes both use the same (kprobe) blocklist (which makes sense + * given they are both typically hooked up to the same trap meaning on most + * architectures one cannot be used to debug the other) + * + * However on architectures where kprobes is not (yet) implemented we permit + * breakpoints everywhere rather than blocking everything by default. + */ +static inline bool kgdb_within_blocklist(unsigned long addr) +{ +#ifdef CONFIG_KGDB_HONOUR_BLOCKLIST + return within_kprobe_blacklist(addr); +#else + return false; +#endif +} + extern int kgdb_single_step; extern atomic_t kgdb_active; #define in_dbg_master() \ diff --git a/kernel/debug/debug_core.c b/kernel/debug/debug_core.c index 9e5934780f41..133a361578dc 100644 --- a/kernel/debug/debug_core.c +++ b/kernel/debug/debug_core.c @@ -188,6 +188,10 @@ int __weak kgdb_validate_break_address(unsigned long addr) { struct kgdb_bkpt tmp; int err; + + if (kgdb_within_blocklist(addr)) + return -EINVAL; + /* Validate setting the breakpoint and then removing it. If the * remove fails, the kernel needs to emit a bad message because we * are deep trouble not being able to put things back the way we diff --git a/kernel/debug/kdb/kdb_bp.c b/kernel/debug/kdb/kdb_bp.c index d7ebb2c79cb8..ec4940146612 100644 --- a/kernel/debug/kdb/kdb_bp.c +++ b/kernel/debug/kdb/kdb_bp.c @@ -306,6 +306,15 @@ static int kdb_bp(int argc, const char **argv) if (!template.bp_addr) return KDB_BADINT; + /* + * This check is redundant (since the breakpoint machinery should + * be doing the same check during kdb_bp_install) but gives the + * user immediate feedback. + */ + diag = kgdb_validate_break_address(template.bp_addr); + if (diag) + return diag; + /* * Find an empty bp structure to allocate */ diff --git a/lib/Kconfig.kgdb b/lib/Kconfig.kgdb index ffa7a76de086..9d0d408f81b1 100644 --- a/lib/Kconfig.kgdb +++ b/lib/Kconfig.kgdb @@ -19,6 +19,20 @@ menuconfig KGDB if KGDB +config KGDB_HONOUR_BLOCKLIST + bool "KGDB: use kprobe blocklist to prohibit unsafe breakpoints" + depends on HAVE_KPROBES + select KPROBES + default y + help + If set to Y the debug core will use the kprobe blocklist to + identify symbols where it is unsafe to set breakpoints. + In particular this disallows instrumentation of functions + called during debug trap handling and thus makes it very + difficult to inadvertently provoke recursive trap handling. + + If unsure, say Y. + config KGDB_SERIAL_CONSOLE tristate "KGDB: use kgdb over the serial console" select CONSOLE_POLL