From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (qmail 12682 invoked by alias); 18 May 2006 21:32:28 -0000 Received: (qmail 12673 invoked by uid 22791); 18 May 2006 21:32:27 -0000 X-Spam-Status: No, hits=-2.8 required=5.0 tests=AWL,BAYES_00,SPF_HELO_PASS,SPF_PASS,TW_XF X-Spam-Check-By: sourceware.org Received: from mx1.redhat.com (HELO mx1.redhat.com) (66.187.233.31) by sourceware.org (qpsmtpd/0.31) with ESMTP; Thu, 18 May 2006 21:32:23 +0000 Received: from int-mx1.corp.redhat.com (int-mx1.corp.redhat.com [172.16.52.254]) by mx1.redhat.com (8.12.11.20060308/8.12.11) with ESMTP id k4ILWK6R003777; Thu, 18 May 2006 17:32:20 -0400 Received: from mail.boston.redhat.com (mail.boston.redhat.com [172.16.76.12]) by int-mx1.corp.redhat.com (8.12.11.20060308/8.12.11) with ESMTP id k4ILWKn4024602; Thu, 18 May 2006 17:32:20 -0400 Received: from [172.16.83.45] (dhcp83-45.boston.redhat.com [172.16.83.45]) by mail.boston.redhat.com (8.12.8/8.12.8) with ESMTP id k4ILWIcV009249; Thu, 18 May 2006 17:32:19 -0400 Message-ID: <446CE7E2.8050302@redhat.com> Date: Thu, 18 May 2006 21:32:00 -0000 From: Satoshi Oshima User-Agent: Thunderbird 1.5.0.2 (X11/20060501) MIME-Version: 1.0 To: Andi Kleen , Andrew Morton CC: linux-kernel@vger.kernel.org, systemtap@sources.redhat.com, "Keshavamurthy, Anil S" , Ananth N Mavinakayanahalli , Jim Keniston , Prasanna S Panchamukhi , "Hideo AOKI@redhat" , Masami Hiramatsu , sugita Subject: [PATCH] kprobes: bad manupilation of 2 byte opcode on x86_64 Content-Type: text/plain; charset=ISO-2022-JP Content-Transfer-Encoding: 7bit X-IsSubscribed: yes Mailing-List: contact systemtap-help@sourceware.org; run by ezmlm Precedence: bulk List-Subscribe: List-Post: List-Help: , Sender: systemtap-owner@sourceware.org X-SW-Source: 2006-q2/txt/msg00445.txt.bz2 Hi Andi and Andrew, I found a bug of kprobes on x86_64. I attached the fix of this bug. Problem: If we put a probe onto a callq instruction and the probe is executed, kernel panic of Bad RIP value occurs. Root cause: If resume_execution() found 0xff at first byte of p->ainsn.insn, it must check the _second_ byte. But current resume_execution check _first_ byte again. I changed it checks second byte of p->ainsn.insn. Kprobes on i386 don't have this problem, because the implementation is a little bit different from x86_64. Regards, Satoshi Oshima Hitachi Computer Product (America) Inc. ---------------------------------------------- diff -Narup linux-2.6.17-rc3-mm1.orig/arch/x86_64/kernel/kprobes.c x86_64_bugifx/arch/x86_64/kernel/kprobes.c --- linux-2.6.17-rc3-mm1.orig/arch/x86_64/kernel/kprobes.c 2006-05-04 12:34:44.000000000 -0400 +++ x86_64_bugifx/arch/x86_64/kernel/kprobes.c 2006-05-12 16:02:35.000000000 -0400 @@ -514,13 +514,13 @@ static void __kprobes resume_execution(s *tos = orig_rip + (*tos - copy_rip); break; case 0xff: - if ((*insn & 0x30) == 0x10) { + if ((insn[1] & 0x30) == 0x10) { /* call absolute, indirect */ /* Fix return addr; rip is correct. */ next_rip = regs->rip; *tos = orig_rip + (*tos - copy_rip); - } else if (((*insn & 0x31) == 0x20) || /* jmp near, absolute indirect */ - ((*insn & 0x31) == 0x21)) { /* jmp far, absolute indirect */ + } else if (((insn[1] & 0x31) == 0x20) || /* jmp near, absolute indirect */ + ((insn[1] & 0x31) == 0x21)) { /* jmp far, absolute indirect */ /* rip is correct. */ next_rip = regs->rip; }