KPROBE_ENTRY ends up putting code into .fixup
PATCH 1/1 KPROBE_ENTRY ends up putting code into .fixup
KPROBE_ENTRY does a .section .kprobes.text, and expects its users to do a .previous at the end of the function.
Unfortunately, if any code within the function switches sections, for example .fixup, then the .previous ends up putting all subsequent code into .fixup. Worse, any subsequent .fixup code gets intermingled with the code its supposed to be fixing (which is also in .fixup). It's surprising this didn't cause more havok.
The fix is to use .pushsection/.popsection, so this stuff nests properly. A further cleanup would be to get rid of all .section/.previous pairs, since they're inherently fragile.
arch/i386/kernel/entry.S +0 -0
@@ -646,7 +646,7 @@ error_code:
call *%edi
jmp ret_from_exception
CFI_ENDPROC
-.previous
+.popsection
ENTRY(coprocessor_error)
RING0_INT_FRAME
@@ -722,7 +722,7 @@ debug_stack_correct:
call do_debug
jmp ret_from_exception
CFI_ENDPROC
-.previous
+.popsection
/*
* NMI is doubly nasty. It can happen _while_ we're handling
@@ -819,7 +819,7 @@ KPROBE_ENTRY(int3)
call do_int3
jmp ret_from_exception
CFI_ENDPROC
-.previous
+.popsection
ENTRY(overflow)
RING0_INT_FRAME
@@ -884,7 +884,7 @@ KPROBE_ENTRY(general_protection)
CFI_ADJUST_CFA_OFFSET 4
jmp error_code
CFI_ENDPROC
-.previous
+.popsection
ENTRY(alignment_check)
RING0_EC_FRAME
arch/x86_64/kernel/entry.S +0 -0
@@ -904,7 +904,7 @@ error_kernelspace: je error_swapgs
jmp error_stiEND(error_entry)
- .previous
+ .popsection
/* Reload gs selector with exception handling */
/* edi: new selector */ @@ -1024,7 +1024,7 @@ KPROBE_ENTRY(page_fault)KPROBE_ENTRY(page_fault)
errorentry do_page_faultEND(page_fault)
- .previous
+ .popsection
ENTRY(coprocessor_error)
zeroentry do_coprocessor_error
@@ -1046,7 +1046,7 @@ KPROBE_ENTRY(debug)
paranoidentry do_debug, DEBUG_STACK
paranoidexit
END(debug)
- .previous
+ .popsection
/* runs on exception stack */
KPROBE_ENTRY(nmi)
@@ -1061,7 +1061,7 @@ KPROBE_ENTRY(nmi)
CFI_ENDPROC
#endif
END(nmi)
- .previous
+ .popsection
KPROBE_ENTRY(int3)
INTR_FRAME
@@ -1071,7 +1071,7 @@ KPROBE_ENTRY(int3)
jmp paranoid_exit1
CFI_ENDPROC
END(int3)
- .previous
+ .popsection
ENTRY(overflow)
zeroentry do_overflow
@@ -1120,7 +1120,7 @@ KPROBE_ENTRY(general_protection) KPROBE_ENTRY(general_protection)
errorentry do_general_protectionEND(general_protection)
- .previous
+ .popsection
ENTRY(alignment_check)
errorentry do_alignment_check
include/linux/linkage.h +0 -0
@@ -35,7 +35,7 @@
#endif
#define KPROBE_ENTRY(name) \
- .section .kprobes.text, "ax"; \
+ .pushsection .kprobes.text, "ax"; \
ENTRY(name)
#ifndef END
Quoted 9 lines · Jeremy Fitzhardinge
KPROBE_ENTRYdoes a .section .kprobes.text, and expects its users to do a .previous at the end of the function.Unfortunately, if any code within the function switches sections, for example .fixup, then the .previous ends up putting all subsequent code into .fixup. Worse, any subsequent .fixup code gets intermingled with the code its supposed to be fixing (which is also in .fixup). It's surprising this didn't cause more havok.
Quoted 3 lines
The fix is to use .pushsection/.popsection, so this stuff nests properly. A further cleanup would be to get rid of all .section/.previous pairs, since they're inherently fragile.
Added thanks.
-Andi