x86/kprobes: Fix crash when probing CS CALL instructionsgrafted

When using eBPF to probe CS CALL instructions within a function,
a crash can be triggered.

The eBPF tool probes offset 257 of the __hrtimer_run_queues()
function:

<__hrtimer_run_queues+249>:  nopl   0x0(%rax,%rax,1)
<__hrtimer_run_queues+254>:  mov    %r14,%rdi
<__hrtimer_run_queues+257>:  cs call <__x86_indirect_thunk_r12>
<__hrtimer_run_queues+263>:  mov    %eax,%r12d
<__hrtimer_run_queues+266>:  xchg   %ax,%ax
<__hrtimer_run_queues+268>:  mov    %r13,%rdi

Which triggers this crash:

  BUG: unable to handle page fault for address: 00000000000f41c9
  #PF: supervisor write access in kernel mode
  #PF: error_code(0x0002) - not-present page
  PGD 0 P4D 0
  Oops: 0002 [#1] SMP NOPTI
  CPU: 1 PID: 0 Comm: swapper/1 Kdump: loaded Tainted: P
  RIP: 0010:__hrtimer_run_queues+0x106/0x230

Note that __hrtimer_run_queues+0x106 is __hrtimer_run_queues+262, which is
at the 6th byte of the above CS CALL instruction. Since the CS CALL
instruction occupies 6 bytes, the exception occurred in the middle of that
call instruction.

The root cause is that when using eBPF tools to probe in the middle of a
function, a kprobe with INT3 is used as the underlying implementation.

During single-step emulation of the original CALL instruction,
int3_emulate_call() assumes that the probed CALL instruction is 5 bytes
long. However, the actual CS-prefixed CALL instruction occupies 6 bytes,
so it constructs an incorrect exception return address. When the CPU
returns from the kprobe handler, the next instruction to be executed is at
the address of the last byte of that CS CALL instruction. Coincidentally,
starting from that address, the CPU fetches and decodes a completely
different instruction, which ultimately triggers a kernel crash.

Fix the issue by using the actual instruction length obtained from
the instruction decoder when constructing the exception return
address, rather than relying on the hardcoded CALL_INSN_SIZE macro.

[ mingo: Refined the changelog ]

Fixes: 6256e668b7af ("x86/kprobes: Use int3 instead of debug trap for single-step")
Suggested-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: Jinke Han <jinkehan@didiglobal.com>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Reviewed-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Acked-by: Yafang Shao <laoar.shao@gmail.com>
Acked-by: Borislav Petkov <bp@alien8.de>
Cc: Peter Zijlstra <peterz@infradead.org>
Link: https://patch.msgid.link/20260908073742.GA10517@didi-ThinkCentre-M920t-N000

1 files changed, 201 insertions, 0 deletions

diff --git a/Documentation/ABI/testing/sysfs-bus-rapidio b/Documentation/ABI/testing/sysfs-bus-rapidio
new file mode 100644
index 000000000..f8b6728da
--- /dev/null
+++ b/Documentation/ABI/testing/sysfs-bus-rapidio
@@ -0,0 +1,201 @@
+What:		/sys/bus/rapidio/devices/<nn>:<d>:<iiii>
+Description:
+		For each RapidIO device, the RapidIO subsystem creates files in
+		an individual subdirectory with the following name format of
+		device_name "nn:d:iiii", where:
+
+		====   ========================================================
+		nn     two-digit hexadecimal ID of RapidIO network where the
+		       device resides
+		d      device type: 'e' - for endpoint or 's' - for switch
+		iiii   four-digit device destID for endpoints, or switchID for
+		       switches
+		====   ========================================================
+
+		For example, below is a list of device directories that
+		represents a typical RapidIO network with one switch, one host,
+		and two agent endpoints, as it is seen by the enumerating host
+		(with destID = 1)::
+
+		  /sys/bus/rapidio/devices/00:e:0000
+		  /sys/bus/rapidio/devices/00:e:0002
+		  /sys/bus/rapidio/devices/00:s:0001
+
+		NOTE:
+		  An enumerating or discovering endpoint does not create a
+		  sysfs entry for itself, this is why an endpoint with destID=1
+		  is not shown in the list.
+
+Attributes Common for All RapidIO Devices
+-----------------------------------------
+
+What:		/sys/bus/rapidio/devices/<nn>:<d>:<iiii>/did
+Date:		Nov, 2005
+KernelVersion:	v2.6.15
+Contact:	Matt Porter <mporter@kernel.crashing.org>,
+		Alexandre Bounine <alexandre.bounine@idt.com>
+Description:
+		(RO) returns the device identifier
+
+What:		/sys/bus/rapidio/devices/<nn>:<d>:<iiii>/vid
+Date:		Nov, 2005
+KernelVersion:	v2.6.15
+Contact:	Matt Porter <mporter@kernel.crashing.org>,
+		Alexandre Bounine <alexandre.bounine@idt.com>
+Description:
+		(RO) returns the device vendor identifier
+
+What:		/sys/bus/rapidio/devices/<nn>:<d>:<iiii>/device_rev
+Date:		Nov, 2005
+KernelVersion:	v2.6.15
+Contact:	Matt Porter <mporter@kernel.crashing.org>,
+		Alexandre Bounine <alexandre.bounine@idt.com>
+Description:
+		(RO) returns the device revision level
+
+What:		/sys/bus/rapidio/devices/<nn>:<d>:<iiii>/asm_did
+Date:		Nov, 2005
+KernelVersion:	v2.6.15
+Contact:	Matt Porter <mporter@kernel.crashing.org>,
+		Alexandre Bounine <alexandre.bounine@idt.com>
+Description:
+		(RO) returns identifier for the assembly containing the device
+
+What:		/sys/bus/rapidio/devices/<nn>:<d>:<iiii>/asm_rev
+Date:		Nov, 2005
+KernelVersion:	v2.6.15
+Contact:	Matt Porter <mporter@kernel.crashing.org>,
+		Alexandre Bounine <alexandre.bounine@idt.com>
+Description:
+		(RO) returns revision level of the assembly containing the
+		device
+
+What:		/sys/bus/rapidio/devices/<nn>:<d>:<iiii>/asm_vid
+Date:		Nov, 2005
+KernelVersion:	v2.6.15
+Contact:	Matt Porter <mporter@kernel.crashing.org>,
+		Alexandre Bounine <alexandre.bounine@idt.com>
+Description:
+		(RO) returns vendor identifier of the assembly containing the
+		device
+
+What:		/sys/bus/rapidio/devices/<nn>:<d>:<iiii>/destid
+Date:		Mar, 2011
+KernelVersion:	v2.6.3
+Contact:	Matt Porter <mporter@kernel.crashing.org>,
+		Alexandre Bounine <alexandre.bounine@idt.com>
+Description:
+		(RO) returns device destination ID assigned by the enumeration
+		routine
+
+What:		/sys/bus/rapidio/devices/<nn>:<d>:<iiii>/lprev
+Date:		Mar, 2011
+KernelVersion:	v2.6.39
+Contact:	Matt Porter <mporter@kernel.crashing.org>,
+		Alexandre Bounine <alexandre.bounine@idt.com>
+Description:
+		(RO) returns name of previous device (switch) on the path to the
+		device that that owns this attribute
+
+What:		/sys/bus/rapidio/devices/<nn>:<d>:<iiii>/modalias
+Date:		Jul, 2013
+KernelVersion:	v3.11
+Contact:	Matt Porter <mporter@kernel.crashing.org>,
+		Alexandre Bounine <alexandre.bounine@idt.com>
+Description:
+		(RO) returns the device modalias
+
+What:		/sys/bus/rapidio/devices/<nn>:<d>:<iiii>/config
+Date:		Nov, 2005
+KernelVersion:	v2.6.15
+Contact:	Matt Porter <mporter@kernel.crashing.org>,
+		Alexandre Bounine <alexandre.bounine@idt.com>
+Description:
+		(RW) Binary attribute to read from and write to the device
+		configuration registers using the RapidIO maintenance
+		transactions. This attribute is similar in behaviour to the
+		"config" attribute of PCI devices and provides an access to the
+		RapidIO device registers using standard file read and write
+		operations.
+
+RapidIO Switch Device Attributes
+--------------------------------
+
+RapidIO switches have additional attributes in sysfs. RapidIO subsystem supports
+common and device-specific sysfs attributes for switches. Because switches are
+integrated into the RapidIO subsystem, it offers a method to create
+device-specific sysfs attributes by specifying a callback function that may be
+set by the switch initialization routine during enumeration or discovery
+process.
+
+What:		/sys/bus/rapidio/devices/<nn>:<s>:<iiii>/routes
+Date:		Nov, 2005
+KernelVersion:	v2.6.15
+Contact:	Matt Porter <mporter@kernel.crashing.org>,
+		Alexandre Bounine <alexandre.bounine@idt.com>
+Description:
+		(RO) reports switch routing information in "destID port" format.
+		This attribute reports only valid routing table entries, one
+		line for each entry.
+
+What:		/sys/bus/rapidio/devices/<nn>:<s>:<iiii>/destid
+Date:		Mar, 2011
+KernelVersion:	v2.6.3
+Contact:	Matt Porter <mporter@kernel.crashing.org>,
+		Alexandre Bounine <alexandre.bounine@idt.com>
+Description:
+		(RO) device destination ID of the associated device that defines
+		a route to the switch
+
+What:		/sys/bus/rapidio/devices/<nn>:<s>:<iiii>/hopcount
+Date:		Mar, 2011
+KernelVersion:	v2.6.39
+Contact:	Matt Porter <mporter@kernel.crashing.org>,
+		Alexandre Bounine <alexandre.bounine@idt.com>
+Description:
+		(RO) number of hops on the path to the switch
+
+What:		/sys/bus/rapidio/devices/<nn>:<s>:<iiii>/lnext
+Date:		Mar, 2011
+KernelVersion:	v2.6.39
+Contact:	Matt Porter <mporter@kernel.crashing.org>,
+		Alexandre Bounine <alexandre.bounine@idt.com>
+Description:
+		(RO) returns names of devices linked to the switch except one of
+		a device linked to the ingress port (reported as "lprev"). This
+		is an array names with number of lines equal to number of ports
+		in switch. If a switch port has no attached device, returns
+		"null" instead of a device name.
+
+Device-specific Switch Attributes
+---------------------------------
+
+IDT_GEN2-
+
+What:		/sys/bus/rapidio/devices/<nn>:<s>:<iiii>/errlog
+Date:		Oct, 2010
+KernelVersion:	v2.6.37
+Contact:	Matt Porter <mporter@kernel.crashing.org>,
+		Alexandre Bounine <alexandre.bounine@idt.com>
+Description:
+		(RO) reads contents of device error log until it is empty.
+
+RapidIO Bus Attributes
+----------------------
+
+What:		/sys/bus/rapidio/scan
+Date:		May, 2013
+KernelVersion:	v3.11
+Contact:	Matt Porter <mporter@kernel.crashing.org>,
+		Alexandre Bounine <alexandre.bounine@idt.com>
+Description:
+		(WO) Allows to trigger enumeration discovery process from user
+		space. To initiate an enumeration or discovery process on
+		specific mport device, a user needs to write mport_ID (not
+		RapidIO destination ID) into this file. The mport_ID is a
+		sequential number (0 ...  RIO_MAX_MPORTS) assigned to the mport
+		device. For example, for a machine with a single RapidIO
+		controller, mport_ID for that controller always will be 0. To
+		initiate RapidIO enumeration/discovery on all available mports a
+		user must write '-1' (or RIO_MPORT_ANY) into this attribute
+		file.