]> git.ipfire.org Git - thirdparty/kernel/stable.git/commitdiff
uprobe: Do not emulate/sstep original instruction when ip is changed
authorJiri Olsa <jolsa@kernel.org>
Tue, 16 Sep 2025 21:52:57 +0000 (23:52 +0200)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 13 Nov 2025 20:36:53 +0000 (15:36 -0500)
[ Upstream commit 4363264111e1297fa37aa39b0598faa19298ecca ]

If uprobe handler changes instruction pointer we still execute single
step) or emulate the original instruction and increment the (new) ip
with its length.

This makes the new instruction pointer bogus and application will
likely crash on illegal instruction execution.

If user decided to take execution elsewhere, it makes little sense
to execute the original instruction, so let's skip it.

Acked-by: Oleg Nesterov <oleg@redhat.com>
Acked-by: Andrii Nakryiko <andrii@kernel.org>
Signed-off-by: Jiri Olsa <jolsa@kernel.org>
Link: https://lore.kernel.org/r/20250916215301.664963-3-jolsa@kernel.org
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
kernel/events/uprobes.c

index 4b97d16f731c1a7ccd33e91d9cc4144635c6c817..109276c68ecbac6e10d433c7f34becee5ab8b2d5 100644 (file)
@@ -2741,6 +2741,13 @@ static void handle_swbp(struct pt_regs *regs)
 
        handler_chain(uprobe, regs);
 
+       /*
+        * If user decided to take execution elsewhere, it makes little sense
+        * to execute the original instruction, so let's skip it.
+        */
+       if (instruction_pointer(regs) != bp_vaddr)
+               goto out;
+
        if (arch_uprobe_skip_sstep(&uprobe->arch, regs))
                goto out;