x86/kprobes: Fix crash when probing CS CALL instructionsgrafted

When using eBPF to probe CS CALL instructions within a function,
a crash can be triggered.

The eBPF tool probes offset 257 of the __hrtimer_run_queues()
function:

<__hrtimer_run_queues+249>:  nopl   0x0(%rax,%rax,1)
<__hrtimer_run_queues+254>:  mov    %r14,%rdi
<__hrtimer_run_queues+257>:  cs call <__x86_indirect_thunk_r12>
<__hrtimer_run_queues+263>:  mov    %eax,%r12d
<__hrtimer_run_queues+266>:  xchg   %ax,%ax
<__hrtimer_run_queues+268>:  mov    %r13,%rdi

Which triggers this crash:

  BUG: unable to handle page fault for address: 00000000000f41c9
  #PF: supervisor write access in kernel mode
  #PF: error_code(0x0002) - not-present page
  PGD 0 P4D 0
  Oops: 0002 [#1] SMP NOPTI
  CPU: 1 PID: 0 Comm: swapper/1 Kdump: loaded Tainted: P
  RIP: 0010:__hrtimer_run_queues+0x106/0x230

Note that __hrtimer_run_queues+0x106 is __hrtimer_run_queues+262, which is
at the 6th byte of the above CS CALL instruction. Since the CS CALL
instruction occupies 6 bytes, the exception occurred in the middle of that
call instruction.

The root cause is that when using eBPF tools to probe in the middle of a
function, a kprobe with INT3 is used as the underlying implementation.

During single-step emulation of the original CALL instruction,
int3_emulate_call() assumes that the probed CALL instruction is 5 bytes
long. However, the actual CS-prefixed CALL instruction occupies 6 bytes,
so it constructs an incorrect exception return address. When the CPU
returns from the kprobe handler, the next instruction to be executed is at
the address of the last byte of that CS CALL instruction. Coincidentally,
starting from that address, the CPU fetches and decodes a completely
different instruction, which ultimately triggers a kernel crash.

Fix the issue by using the actual instruction length obtained from
the instruction decoder when constructing the exception return
address, rather than relying on the hardcoded CALL_INSN_SIZE macro.

[ mingo: Refined the changelog ]

Fixes: 6256e668b7af ("x86/kprobes: Use int3 instead of debug trap for single-step")
Suggested-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: Jinke Han <jinkehan@didiglobal.com>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Reviewed-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Acked-by: Yafang Shao <laoar.shao@gmail.com>
Acked-by: Borislav Petkov <bp@alien8.de>
Cc: Peter Zijlstra <peterz@infradead.org>
Link: https://patch.msgid.link/20260908073742.GA10517@didi-ThinkCentre-M920t-N000

1 files changed, 222 insertions, 0 deletions

diff --git a/drivers/acpi/acpica/acstruct.h b/drivers/acpi/acpica/acstruct.h
new file mode 100644
index 000000000..5c8c14f55
--- /dev/null
+++ b/drivers/acpi/acpica/acstruct.h
@@ -0,0 +1,222 @@
+/* SPDX-License-Identifier: BSD-3-Clause OR GPL-2.0 */
+/******************************************************************************
+ *
+ * Name: acstruct.h - Internal structs
+ *
+ * Copyright (C) 2000 - 2026, Intel Corp.
+ *
+ *****************************************************************************/
+
+#ifndef __ACSTRUCT_H__
+#define __ACSTRUCT_H__
+
+/* acpisrc:struct_defs -- for acpisrc conversion */
+
+/*****************************************************************************
+ *
+ * Tree walking typedefs and structs
+ *
+ ****************************************************************************/
+
+/*
+ * Walk state - current state of a parse tree walk. Used for both a leisurely
+ * stroll through the tree (for whatever reason), and for control method
+ * execution.
+ */
+#define ACPI_NEXT_OP_DOWNWARD       1
+#define ACPI_NEXT_OP_UPWARD         2
+
+/*
+ * Groups of definitions for walk_type used for different implementations of
+ * walkers (never simultaneously) - flags for interpreter:
+ */
+#define ACPI_WALK_NON_METHOD        0
+#define ACPI_WALK_METHOD            0x01
+#define ACPI_WALK_METHOD_RESTART    0x02
+
+struct acpi_walk_state {
+	struct acpi_walk_state *next;	/* Next walk_state in list */
+	u8 descriptor_type;	/* To differentiate various internal objs */
+	u8 walk_type;
+	u16 opcode;		/* Current AML opcode */
+	u8 next_op_info;	/* Info about next_op */
+	u8 num_operands;	/* Stack pointer for Operands[] array */
+	u8 operand_index;	/* Index into operand stack, to be used by acpi_ds_obj_stack_push */
+	acpi_owner_id owner_id;	/* Owner of objects created during the walk */
+	u8 last_predicate;	/* Result of last predicate */
+	u8 current_result;
+	u8 return_used;
+	u8 scope_depth;
+	u8 pass_number;		/* Parse pass during table load */
+	u8 namespace_override;	/* Override existing objects */
+	u8 result_size;		/* Total elements for the result stack */
+	u8 result_count;	/* Current number of occupied elements of result stack */
+	u8 *aml;
+	u32 arg_types;
+	u32 method_breakpoint;	/* For single stepping */
+	u32 user_breakpoint;	/* User AML breakpoint */
+	u32 parse_flags;
+
+	struct acpi_parse_state parser_state;	/* Current state of parser */
+	u32 prev_arg_types;
+	u32 arg_count;		/* push for fixed or var args */
+	u16 method_nesting_depth;
+	u8 method_is_nested;
+
+	struct acpi_namespace_node arguments[ACPI_METHOD_NUM_ARGS];	/* Control method arguments */
+	struct acpi_namespace_node local_variables[ACPI_METHOD_NUM_LOCALS];	/* Control method locals */
+	union acpi_operand_object *operands[ACPI_OBJ_NUM_OPERANDS + 1];	/* Operands passed to the interpreter (+1 for NULL terminator) */
+	union acpi_operand_object **params;
+
+	u8 *aml_last_while;
+	union acpi_operand_object **caller_return_desc;
+	union acpi_generic_state *control_state;	/* List of control states (nested IFs) */
+	struct acpi_namespace_node *deferred_node;	/* Used when executing deferred opcodes */
+	union acpi_operand_object *implicit_return_obj;
+	struct acpi_namespace_node *method_call_node;	/* Called method Node */
+	union acpi_parse_object *method_call_op;	/* method_call Op if running a method */
+	union acpi_operand_object *method_desc;	/* Method descriptor if running a method */
+	struct acpi_namespace_node *method_node;	/* Method node if running a method */
+	char *method_pathname;	/* Full pathname of running method */
+	union acpi_parse_object *op;	/* Current parser op */
+	const struct acpi_opcode_info *op_info;	/* Info on current opcode */
+	union acpi_parse_object *origin;	/* Start of walk [Obsolete] */
+	union acpi_operand_object *result_obj;
+	union acpi_generic_state *results;	/* Stack of accumulated results */
+	union acpi_operand_object *return_desc;	/* Return object, if any */
+	union acpi_generic_state *scope_info;	/* Stack of nested scopes */
+	union acpi_parse_object *prev_op;	/* Last op that was processed */
+	union acpi_parse_object *next_op;	/* next op to be processed */
+	struct acpi_thread_state *thread;
+	acpi_parse_downwards descending_callback;
+	acpi_parse_upwards ascending_callback;
+};
+
+/* Info used by acpi_ns_initialize_objects and acpi_ds_initialize_objects */
+
+struct acpi_init_walk_info {
+	u32 table_index;
+	u32 object_count;
+	u32 method_count;
+	u32 serial_method_count;
+	u32 non_serial_method_count;
+	u32 serialized_method_count;
+	u32 device_count;
+	u32 op_region_count;
+	u32 field_count;
+	u32 buffer_count;
+	u32 package_count;
+	u32 op_region_init;
+	u32 field_init;
+	u32 buffer_init;
+	u32 package_init;
+	acpi_owner_id owner_id;
+};
+
+struct acpi_get_devices_info {
+	acpi_walk_callback user_function;
+	void *context;
+	const char *hid;
+};
+
+union acpi_aml_operands {
+	union acpi_operand_object *operands[7];
+
+	struct {
+		struct acpi_object_integer *type;
+		struct acpi_object_integer *code;
+		struct acpi_object_integer *argument;
+
+	} fatal;
+
+	struct {
+		union acpi_operand_object *source;
+		struct acpi_object_integer *index;
+		union acpi_operand_object *target;
+
+	} index;
+
+	struct {
+		union acpi_operand_object *source;
+		struct acpi_object_integer *index;
+		struct acpi_object_integer *length;
+		union acpi_operand_object *target;
+
+	} mid;
+};
+
+/*
+ * Structure used to pass object evaluation information and parameters.
+ * Purpose is to reduce CPU stack use.
+ */
+struct acpi_evaluate_info {
+	/* The first 3 elements are passed by the caller to acpi_ns_evaluate */
+
+	struct acpi_namespace_node *prefix_node;	/* Input: starting node */
+	const char *relative_pathname;	/* Input: path relative to prefix_node */
+	union acpi_operand_object **parameters;	/* Input: argument list */
+
+	struct acpi_namespace_node *node;	/* Resolved node (prefix_node:relative_pathname) */
+	union acpi_operand_object *obj_desc;	/* Object attached to the resolved node */
+	char *full_pathname;	/* Full pathname of the resolved node */
+
+	const union acpi_predefined_info *predefined;	/* Used if Node is a predefined name */
+	union acpi_operand_object *return_object;	/* Object returned from the evaluation */
+	union acpi_operand_object *parent_package;	/* Used if return object is a Package */
+
+	u32 return_flags;	/* Used for return value analysis */
+	u32 return_btype;	/* Bitmapped type of the returned object */
+	u16 param_count;	/* Count of the input argument list */
+	u16 node_flags;		/* Same as Node->Flags */
+	u8 pass_number;		/* Parser pass number */
+	u8 return_object_type;	/* Object type of the returned object */
+	u8 flags;		/* General flags */
+};
+
+/* Values for Flags above */
+
+#define ACPI_IGNORE_RETURN_VALUE    1
+
+/* Defines for return_flags field above */
+
+#define ACPI_OBJECT_REPAIRED        1
+#define ACPI_OBJECT_WRAPPED         2
+
+/* Info used by acpi_ns_initialize_devices */
+
+struct acpi_device_walk_info {
+	struct acpi_table_desc *table_desc;
+	struct acpi_evaluate_info *evaluate_info;
+	u32 device_count;
+	u32 num_STA;
+	u32 num_INI;
+};
+
+/* Info used by Acpi  acpi_db_display_fields */
+
+struct acpi_region_walk_info {
+	u32 debug_level;
+	u32 count;
+	acpi_owner_id owner_id;
+	u8 display_type;
+	u32 address_space_id;
+};
+
+/* TBD: [Restructure] Merge with struct above */
+
+struct acpi_walk_info {
+	u32 debug_level;
+	u32 count;
+	acpi_owner_id owner_id;
+	u8 display_type;
+};
+
+/* Display Types */
+
+#define ACPI_DISPLAY_SUMMARY        (u8) 0
+#define ACPI_DISPLAY_OBJECTS        (u8) 1
+#define ACPI_DISPLAY_MASK           (u8) 1
+
+#define ACPI_DISPLAY_SHORT          (u8) 2
+
+#endif