diff options
| author | Masami Hiramatsu <mhiramat@kernel.org> | 2017-02-28 17:23:24 +0100 |
|---|---|---|
| committer | Ingo Molnar <mingo@kernel.org> | 2017-03-01 09:56:13 +0100 |
| commit | 75013fb16f8484898eaa8d0b08fed942d790f029 (patch) | |
| tree | b787566a2c4347d2e6ee04ad299393aa3a43282b /arch/x86/kernel/kprobes/opt.c | |
| parent | Merge tag 'for-linus-4.11' of git://git.code.sf.net/p/openipmi/linux-ipmi (diff) | |
| download | linux-75013fb16f8484898eaa8d0b08fed942d790f029.tar.xz linux-75013fb16f8484898eaa8d0b08fed942d790f029.zip | |
kprobes/x86: Fix kernel panic when certain exception-handling addresses are probed
Fix to the exception table entry check by using probed address
instead of the address of copied instruction.
This bug may cause unexpected kernel panic if user probe an address
where an exception can happen which should be fixup by __ex_table
(e.g. copy_from_user.)
Unless user puts a kprobe on such address, this doesn't
cause any problem.
This bug has been introduced years ago, by commit:
464846888d9a ("x86/kprobes: Fix a bug which can modify kernel code permanently").
Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Fixes: 464846888d9a ("x86/kprobes: Fix a bug which can modify kernel code permanently")
Link: http://lkml.kernel.org/r/148829899399.28855.12581062400757221722.stgit@devbox
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Diffstat (limited to '')
| -rw-r--r-- | arch/x86/kernel/kprobes/opt.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/arch/x86/kernel/kprobes/opt.c b/arch/x86/kernel/kprobes/opt.c index 3d1bee9d6a72..3e7c6e5a08ff 100644 --- a/arch/x86/kernel/kprobes/opt.c +++ b/arch/x86/kernel/kprobes/opt.c @@ -178,7 +178,7 @@ static int copy_optimized_instructions(u8 *dest, u8 *src) while (len < RELATIVEJUMP_SIZE) { ret = __copy_instruction(dest + len, src + len); - if (!ret || !can_boost(dest + len)) + if (!ret || !can_boost(dest + len, src + len)) return -EINVAL; len += ret; } |