x86/kprobes: Fix crash when probing CS CALL instructionsgrafted

When using eBPF to probe CS CALL instructions within a function,
a crash can be triggered.

The eBPF tool probes offset 257 of the __hrtimer_run_queues()
function:

<__hrtimer_run_queues+249>:  nopl   0x0(%rax,%rax,1)
<__hrtimer_run_queues+254>:  mov    %r14,%rdi
<__hrtimer_run_queues+257>:  cs call <__x86_indirect_thunk_r12>
<__hrtimer_run_queues+263>:  mov    %eax,%r12d
<__hrtimer_run_queues+266>:  xchg   %ax,%ax
<__hrtimer_run_queues+268>:  mov    %r13,%rdi

Which triggers this crash:

  BUG: unable to handle page fault for address: 00000000000f41c9
  #PF: supervisor write access in kernel mode
  #PF: error_code(0x0002) - not-present page
  PGD 0 P4D 0
  Oops: 0002 [#1] SMP NOPTI
  CPU: 1 PID: 0 Comm: swapper/1 Kdump: loaded Tainted: P
  RIP: 0010:__hrtimer_run_queues+0x106/0x230

Note that __hrtimer_run_queues+0x106 is __hrtimer_run_queues+262, which is
at the 6th byte of the above CS CALL instruction. Since the CS CALL
instruction occupies 6 bytes, the exception occurred in the middle of that
call instruction.

The root cause is that when using eBPF tools to probe in the middle of a
function, a kprobe with INT3 is used as the underlying implementation.

During single-step emulation of the original CALL instruction,
int3_emulate_call() assumes that the probed CALL instruction is 5 bytes
long. However, the actual CS-prefixed CALL instruction occupies 6 bytes,
so it constructs an incorrect exception return address. When the CPU
returns from the kprobe handler, the next instruction to be executed is at
the address of the last byte of that CS CALL instruction. Coincidentally,
starting from that address, the CPU fetches and decodes a completely
different instruction, which ultimately triggers a kernel crash.

Fix the issue by using the actual instruction length obtained from
the instruction decoder when constructing the exception return
address, rather than relying on the hardcoded CALL_INSN_SIZE macro.

[ mingo: Refined the changelog ]

Fixes: 6256e668b7af ("x86/kprobes: Use int3 instead of debug trap for single-step")
Suggested-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: Jinke Han <jinkehan@didiglobal.com>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Reviewed-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Acked-by: Yafang Shao <laoar.shao@gmail.com>
Acked-by: Borislav Petkov <bp@alien8.de>
Cc: Peter Zijlstra <peterz@infradead.org>
Link: https://patch.msgid.link/20260908073742.GA10517@didi-ThinkCentre-M920t-N000

1 files changed, 214 insertions, 0 deletions

diff --git a/drivers/acpi/acpica/psutils.c b/drivers/acpi/acpica/psutils.c
new file mode 100644
index 000000000..789d75dc4
--- /dev/null
+++ b/drivers/acpi/acpica/psutils.c
@@ -0,0 +1,214 @@
+// SPDX-License-Identifier: BSD-3-Clause OR GPL-2.0
+/******************************************************************************
+ *
+ * Module Name: psutils - Parser miscellaneous utilities (Parser only)
+ *
+ * Copyright (C) 2000 - 2026, Intel Corp.
+ *
+ *****************************************************************************/
+
+#include <acpi/acpi.h>
+#include "accommon.h"
+#include "acparser.h"
+#include "amlcode.h"
+#include "acconvert.h"
+
+#define _COMPONENT          ACPI_PARSER
+ACPI_MODULE_NAME("psutils")
+
+/*******************************************************************************
+ *
+ * FUNCTION:    acpi_ps_create_scope_op
+ *
+ * PARAMETERS:  None
+ *
+ * RETURN:      A new Scope object, null on failure
+ *
+ * DESCRIPTION: Create a Scope and associated namepath op with the root name
+ *
+ ******************************************************************************/
+union acpi_parse_object *acpi_ps_create_scope_op(u8 *aml)
+{
+	union acpi_parse_object *scope_op;
+
+	scope_op = acpi_ps_alloc_op(AML_SCOPE_OP, aml);
+	if (!scope_op) {
+		return (NULL);
+	}
+
+	scope_op->named.name = ACPI_ROOT_NAME;
+	return (scope_op);
+}
+
+/*******************************************************************************
+ *
+ * FUNCTION:    acpi_ps_init_op
+ *
+ * PARAMETERS:  op              - A newly allocated Op object
+ *              opcode          - Opcode to store in the Op
+ *
+ * RETURN:      None
+ *
+ * DESCRIPTION: Initialize a parse (Op) object
+ *
+ ******************************************************************************/
+
+void acpi_ps_init_op(union acpi_parse_object *op, u16 opcode)
+{
+	ACPI_FUNCTION_ENTRY();
+
+	op->common.descriptor_type = ACPI_DESC_TYPE_PARSER;
+	op->common.aml_opcode = opcode;
+
+	ACPI_DISASM_ONLY_MEMBERS(acpi_ut_safe_strncpy(op->common.aml_op_name,
+						      (acpi_ps_get_opcode_info
+						       (opcode))->name,
+						      sizeof(op->common.
+							     aml_op_name)));
+}
+
+/*******************************************************************************
+ *
+ * FUNCTION:    acpi_ps_alloc_op
+ *
+ * PARAMETERS:  opcode          - Opcode that will be stored in the new Op
+ *              aml             - Address of the opcode
+ *
+ * RETURN:      Pointer to the new Op, null on failure
+ *
+ * DESCRIPTION: Allocate an acpi_op, choose op type (and thus size) based on
+ *              opcode. A cache of opcodes is available for the pure
+ *              GENERIC_OP, since this is by far the most commonly used.
+ *
+ ******************************************************************************/
+
+union acpi_parse_object *acpi_ps_alloc_op(u16 opcode, u8 *aml)
+{
+	union acpi_parse_object *op;
+	const struct acpi_opcode_info *op_info;
+	u8 flags = ACPI_PARSEOP_GENERIC;
+
+	ACPI_FUNCTION_ENTRY();
+
+	op_info = acpi_ps_get_opcode_info(opcode);
+
+	/* Determine type of parse_op required */
+
+	if (op_info->flags & AML_DEFER) {
+		flags = ACPI_PARSEOP_DEFERRED;
+	} else if (op_info->flags & AML_NAMED) {
+		flags = ACPI_PARSEOP_NAMED_OBJECT;
+	} else if (opcode == AML_INT_BYTELIST_OP) {
+		flags = ACPI_PARSEOP_BYTELIST;
+	}
+
+	/* Allocate the minimum required size object */
+
+	if (flags == ACPI_PARSEOP_GENERIC) {
+
+		/* The generic op (default) is by far the most common (16 to 1) */
+
+		op = acpi_os_acquire_object(acpi_gbl_ps_node_cache);
+	} else {
+		/* Extended parseop */
+
+		op = acpi_os_acquire_object(acpi_gbl_ps_node_ext_cache);
+	}
+
+	/* Initialize the Op */
+
+	if (op) {
+		acpi_ps_init_op(op, opcode);
+		op->common.aml = aml;
+		op->common.flags = flags;
+		ASL_CV_CLEAR_OP_COMMENTS(op);
+
+		if (opcode == AML_SCOPE_OP) {
+			acpi_gbl_current_scope = op;
+		}
+
+		if (acpi_gbl_capture_comments) {
+			ASL_CV_TRANSFER_COMMENTS(op);
+		}
+	}
+
+	return (op);
+}
+
+/*******************************************************************************
+ *
+ * FUNCTION:    acpi_ps_free_op
+ *
+ * PARAMETERS:  op              - Op to be freed
+ *
+ * RETURN:      None.
+ *
+ * DESCRIPTION: Free an Op object. Either put it on the GENERIC_OP cache list
+ *              or actually free it.
+ *
+ ******************************************************************************/
+
+void acpi_ps_free_op(union acpi_parse_object *op)
+{
+	ACPI_FUNCTION_NAME(ps_free_op);
+
+	ASL_CV_CLEAR_OP_COMMENTS(op);
+	if (op->common.aml_opcode == AML_INT_RETURN_VALUE_OP) {
+		ACPI_DEBUG_PRINT((ACPI_DB_ALLOCATIONS,
+				  "Free retval op: %p\n", op));
+	}
+
+	if (op->common.flags & ACPI_PARSEOP_GENERIC) {
+		(void)acpi_os_release_object(acpi_gbl_ps_node_cache, op);
+	} else {
+		(void)acpi_os_release_object(acpi_gbl_ps_node_ext_cache, op);
+	}
+}
+
+/*******************************************************************************
+ *
+ * FUNCTION:    Utility functions
+ *
+ * DESCRIPTION: Low level character and object functions
+ *
+ ******************************************************************************/
+
+/*
+ * Is "c" a namestring lead character?
+ */
+u8 acpi_ps_is_leading_char(u32 c)
+{
+	return ((u8) (c == '_' || (c >= 'A' && c <= 'Z')));
+}
+
+/*
+ * Get op's name (4-byte name segment) or 0 if unnamed
+ */
+u32 acpi_ps_get_name(union acpi_parse_object * op)
+{
+
+	/* The "generic" object has no name associated with it */
+
+	if (op->common.flags & ACPI_PARSEOP_GENERIC) {
+		return (0);
+	}
+
+	/* Only the "Extended" parse objects have a name */
+
+	return (op->named.name);
+}
+
+/*
+ * Set op's name
+ */
+void acpi_ps_set_name(union acpi_parse_object *op, u32 name)
+{
+
+	/* The "generic" object has no name associated with it */
+
+	if (op->common.flags & ACPI_PARSEOP_GENERIC) {
+		return;
+	}
+
+	op->named.name = name;
+}