Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753740AbdDJPV2 (ORCPT ); Mon, 10 Apr 2017 11:21:28 -0400 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]:45226 "EHLO mx0a-001b2d01.pphosted.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1753211AbdDJPV1 (ORCPT ); Mon, 10 Apr 2017 11:21:27 -0400 From: Ravi Bangoria To: mpe@ellerman.id.au Cc: benh@kernel.crashing.org, paulus@samba.org, npiggin@gmail.com, aneesh.kumar@linux.vnet.ibm.com, bsingharora@gmail.com, chris@distroguy.com, viro@zeniv.linux.org.uk, christophe.leroy@c-s.fr, linuxppc-dev@lists.ozlabs.org, linux-kernel@vger.kernel.org, Ravi Bangoria Subject: [PATCH] ppc64/kprobe: Fix oops when kprobed on 'stdu' instruction Date: Mon, 10 Apr 2017 20:50:57 +0530 X-Mailer: git-send-email 2.1.4 X-TM-AS-MML: disable x-cbid: 17041015-0008-0000-0000-00000552CE21 X-IBM-AV-DETECTION: SAVI=unused REMOTE=unused XFE=unused x-cbparentid: 17041015-0009-0000-0000-0000135F3AC9 Message-Id: <1491837657-4918-1-git-send-email-ravi.bangoria@linux.vnet.ibm.com> X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:,, definitions=2017-04-10_12:,, signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 suspectscore=1 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1702020001 definitions=main-1704100124 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 2438 Lines: 64 If we set a kprobe on a 'stdu' instruction on powerpc64, we see a kernel OOPS: [ 1275.165932] Bad kernel stack pointer cd93c840 at c000000000009868 [ 1275.166378] Oops: Bad kernel stack pointer, sig: 6 [#1] ... GPR00: c000001fcd93cb30 00000000cd93c840 c0000000015c5e00 00000000cd93c840 ... [ 1275.178305] NIP [c000000000009868] resume_kernel+0x2c/0x58 [ 1275.178594] LR [c000000000006208] program_check_common+0x108/0x180 Basically, on 64 bit system, when user probes on 'stdu' instruction, kernel does not emulate actual store in emulate_step itself because it may corrupt exception frame. So kernel does actual store operation in exception return code i.e. resume_kernel(). resume_kernel() loads the saved stack pointer from memory using lwz, effectively loading a corrupt (32bit) address, causing the kernel crash. Fix this by loading the 64bit value instead. Fixes: 8e9f69371536 ("powerpc/kprobe: Don't emulate store when kprobe stwu r1") Signed-off-by: Ravi Bangoria --- History: Commit 8e9f69371536 ("powerpc/kprobe: Don't emulate store when kprobe stwu r1") fixed exception frame corruption for 32 bit system which uses 'stwu' instruction for stack frame allocation. This commit also added code for 64 bit system but did not enabled it for 'stdu' instruction. So 'stdu' instruction on 64 bit machine was emulating actual store in emulate_step() itself until... Commit be96f63375a1 ("powerpc: Split out instruction analysis part of emulate_step()"), enabled it for 'stdu' instruction on 64 bit machine. Since then it's broken. So this should also go into stable. arch/powerpc/kernel/entry_64.S | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/arch/powerpc/kernel/entry_64.S b/arch/powerpc/kernel/entry_64.S index 6432d4b..530f6e9 100644 --- a/arch/powerpc/kernel/entry_64.S +++ b/arch/powerpc/kernel/entry_64.S @@ -689,7 +689,7 @@ resume_kernel: addi r8,r1,INT_FRAME_SIZE /* Get the kprobed function entry */ - lwz r3,GPR1(r1) + ld r3,GPR1(r1) subi r3,r3,INT_FRAME_SIZE /* dst: Allocate a trampoline exception frame */ mr r4,r1 /* src: current exception frame */ mr r1,r3 /* Reroute the trampoline frame to r1 */ @@ -704,7 +704,7 @@ resume_kernel: bdnz 2b /* Do real store operation to complete stwu */ - lwz r5,GPR1(r1) + ld r5,GPR1(r1) std r8,0(r5) /* Clear _TIF_EMULATE_STACK_STORE flag */ -- 1.9.3