x86/kprobes: Fix crash when probing CS CALL instructionsgrafted

When using eBPF to probe CS CALL instructions within a function,
a crash can be triggered.

The eBPF tool probes offset 257 of the __hrtimer_run_queues()
function:

<__hrtimer_run_queues+249>:  nopl   0x0(%rax,%rax,1)
<__hrtimer_run_queues+254>:  mov    %r14,%rdi
<__hrtimer_run_queues+257>:  cs call <__x86_indirect_thunk_r12>
<__hrtimer_run_queues+263>:  mov    %eax,%r12d
<__hrtimer_run_queues+266>:  xchg   %ax,%ax
<__hrtimer_run_queues+268>:  mov    %r13,%rdi

Which triggers this crash:

  BUG: unable to handle page fault for address: 00000000000f41c9
  #PF: supervisor write access in kernel mode
  #PF: error_code(0x0002) - not-present page
  PGD 0 P4D 0
  Oops: 0002 [#1] SMP NOPTI
  CPU: 1 PID: 0 Comm: swapper/1 Kdump: loaded Tainted: P
  RIP: 0010:__hrtimer_run_queues+0x106/0x230

Note that __hrtimer_run_queues+0x106 is __hrtimer_run_queues+262, which is
at the 6th byte of the above CS CALL instruction. Since the CS CALL
instruction occupies 6 bytes, the exception occurred in the middle of that
call instruction.

The root cause is that when using eBPF tools to probe in the middle of a
function, a kprobe with INT3 is used as the underlying implementation.

During single-step emulation of the original CALL instruction,
int3_emulate_call() assumes that the probed CALL instruction is 5 bytes
long. However, the actual CS-prefixed CALL instruction occupies 6 bytes,
so it constructs an incorrect exception return address. When the CPU
returns from the kprobe handler, the next instruction to be executed is at
the address of the last byte of that CS CALL instruction. Coincidentally,
starting from that address, the CPU fetches and decodes a completely
different instruction, which ultimately triggers a kernel crash.

Fix the issue by using the actual instruction length obtained from
the instruction decoder when constructing the exception return
address, rather than relying on the hardcoded CALL_INSN_SIZE macro.

[ mingo: Refined the changelog ]

Fixes: 6256e668b7af ("x86/kprobes: Use int3 instead of debug trap for single-step")
Suggested-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: Jinke Han <jinkehan@didiglobal.com>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Reviewed-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Acked-by: Yafang Shao <laoar.shao@gmail.com>
Acked-by: Borislav Petkov <bp@alien8.de>
Cc: Peter Zijlstra <peterz@infradead.org>
Link: https://patch.msgid.link/20260908073742.GA10517@didi-ThinkCentre-M920t-N000

1 files changed, 173 insertions, 0 deletions

diff --git a/Documentation/ABI/testing/sysfs-bus-rbd b/Documentation/ABI/testing/sysfs-bus-rbd
new file mode 100644
index 000000000..417a2fe21
--- /dev/null
+++ b/Documentation/ABI/testing/sysfs-bus-rbd
@@ -0,0 +1,173 @@
+What:		/sys/bus/rbd/add
+Date:		Oct, 2010
+KernelVersion:	v2.6.37
+Contact:	Sage Weil <sage@newdream.net>
+Description:
+		(WO) Add rbd block device.
+
+		Usage: <mon ip addr> <options> <pool name> <rbd image name> [<snap name>]
+
+		Example::
+
+		 $ echo "192.168.0.1 name=admin rbd foo" > /sys/bus/rbd/add
+
+		The snapshot name can be "-" or omitted to map the image
+		read/write. A <dev-id> will be assigned for any registered block
+		device. If snapshot is used, it will be mapped read-only.
+
+
+What:		/sys/bus/rbd/remove
+Date:		Oct, 2010
+KernelVersion:	v2.6.37
+Contact:	Sage Weil <sage@newdream.net>
+Description:
+		(WO) Remove rbd block device.
+
+		Usage: <dev-id> [force]
+
+		Example::
+
+		 $ echo 2 > /sys/bus/rbd/remove
+
+		Optional "force" argument which when passed will wait for
+		running requests and then unmap the image. Requests sent to the
+		driver after initiating the removal will be failed. (August
+		2016, since 4.9.)
+
+
+What:		/sys/bus/rbd/add_single_major
+Date:		Dec, 2013
+KernelVersion:	v3.14
+Contact:	Sage Weil <sage@newdream.net>
+Description:
+		(WO) Available only if rbd module is inserted with single_major
+		parameter set to true.
+
+		Usage is the same as for /sys/bus/rbd/add. If present, this
+		should be used instead of the latter: any attempts to use
+		/sys/bus/rbd/add if /sys/bus/rbd/add_single_major is available
+		will fail for backwards compatibility reasons.
+
+
+What:		/sys/bus/rbd/remove_single_major
+Date:		Dec, 2013
+KernelVersion:	v3.14
+Contact:	Sage Weil <sage@newdream.net>
+Description:
+		(WO) Available only if rbd module is inserted with single_major
+		parameter set to true.
+
+		Usage is the same as for /sys/bus/rbd/remove. If present, this
+		should be used instead of the latter: any attempts to use
+		/sys/bus/rbd/remove if /sys/bus/rbd/remove_single_major is
+		available will fail for backwards compatibility reasons.
+
+
+What:		/sys/bus/rbd/supported_features
+Date:		Mar, 2017
+KernelVersion:	v4.11
+Contact:	Sage Weil <sage@newdream.net>
+Description:
+		(RO) Displays the features supported by the rbd module so that
+		userspace can generate meaningful error messages and spell out
+		unsupported features that need to be disabled.
+
+
+What:		/sys/bus/rbd/devices/<dev-id>/size
+What:		/sys/bus/rbd/devices/<dev-id>/major
+What:		/sys/bus/rbd/devices/<dev-id>/client_id
+What:		/sys/bus/rbd/devices/<dev-id>/pool
+What:		/sys/bus/rbd/devices/<dev-id>/name
+What:		/sys/bus/rbd/devices/<dev-id>/refresh
+What:		/sys/bus/rbd/devices/<dev-id>/current_snap
+Date:		Oct, 2010
+KernelVersion:	v2.6.37
+Contact:	Sage Weil <sage@newdream.net>
+Description:
+
+		==============	================================================
+		size		(RO) The size (in bytes) of the mapped block
+				device.
+
+		major		(RO) The block device major number.
+
+		client_id	(RO) The ceph unique client id that was assigned
+				for this specific session.
+
+		pool		(RO) The name of the storage pool where this rbd
+				image resides. An rbd image name is unique
+				within its pool.
+
+		name		(RO) The name of the rbd image.
+
+		refresh		(WO) Writing to this file will reread the image
+				header data and set all relevant data structures
+				accordingly.
+
+		current_snap	(RO) The current snapshot for which the device
+				is mapped.
+		==============	================================================
+
+
+What:		/sys/bus/rbd/devices/<dev-id>/pool_id
+Date:		Jul, 2012
+KernelVersion:	v3.6
+Contact:	Sage Weil <sage@newdream.net>
+Description:
+		(RO) The unique identifier for the rbd image's pool. This is a
+		permanent attribute of the pool. A pool's id will never change.
+
+
+What:		/sys/bus/rbd/devices/<dev-id>/image_id
+What:		/sys/bus/rbd/devices/<dev-id>/features
+Date:		Oct, 2012
+KernelVersion:	v3.7
+Contact:	Sage Weil <sage@newdream.net>
+Description:
+		=========	===============================================
+		image_id	(RO) The unique id for the rbd image. (For rbd
+				image format 1 this is empty.)
+
+		features	(RO) A hexadecimal encoding of the feature bits
+				for this image.
+		=========	===============================================
+
+
+What:		/sys/bus/rbd/devices/<dev-id>/parent
+Date:		Nov, 2012
+KernelVersion:	v3.8
+Contact:	Sage Weil <sage@newdream.net>
+Description:
+		(RO) Information identifying the chain of parent images in a
+		layered rbd image. Entries are separated by empty lines.
+
+
+What:		/sys/bus/rbd/devices/<dev-id>/minor
+Date:		Dec, 2013
+KernelVersion:	v3.14
+Contact:	Sage Weil <sage@newdream.net>
+Description:
+		(RO) The block device minor number.
+
+
+What:		/sys/bus/rbd/devices/<dev-id>/snap_id
+What:		/sys/bus/rbd/devices/<dev-id>/config_info
+What:		/sys/bus/rbd/devices/<dev-id>/cluster_fsid
+What:		/sys/bus/rbd/devices/<dev-id>/client_addr
+Date:		Aug, 2016
+KernelVersion:	v4.9
+Contact:	Sage Weil <sage@newdream.net>
+Description:
+		============	================================================
+		snap_id		(RO) The current snapshot's id.
+
+		config_info	(RO) The string written into
+				/sys/bus/rbd/add{,_single_major}.
+
+		cluster_fsid	(RO) The ceph cluster UUID.
+
+		client_addr	(RO) The ceph unique client
+				entity_addr_t (address + nonce). The format is
+				<address>:<port>/<nonce>: '1.2.3.4:1234/5678' or
+				'[1:2:3:4:5:6:7:8]:1234/5678'.
+		============	================================================