x86/kprobes: Fix crash when probing CS CALL instructionsgrafted

When using eBPF to probe CS CALL instructions within a function,
a crash can be triggered.

The eBPF tool probes offset 257 of the __hrtimer_run_queues()
function:

<__hrtimer_run_queues+249>:  nopl   0x0(%rax,%rax,1)
<__hrtimer_run_queues+254>:  mov    %r14,%rdi
<__hrtimer_run_queues+257>:  cs call <__x86_indirect_thunk_r12>
<__hrtimer_run_queues+263>:  mov    %eax,%r12d
<__hrtimer_run_queues+266>:  xchg   %ax,%ax
<__hrtimer_run_queues+268>:  mov    %r13,%rdi

Which triggers this crash:

  BUG: unable to handle page fault for address: 00000000000f41c9
  #PF: supervisor write access in kernel mode
  #PF: error_code(0x0002) - not-present page
  PGD 0 P4D 0
  Oops: 0002 [#1] SMP NOPTI
  CPU: 1 PID: 0 Comm: swapper/1 Kdump: loaded Tainted: P
  RIP: 0010:__hrtimer_run_queues+0x106/0x230

Note that __hrtimer_run_queues+0x106 is __hrtimer_run_queues+262, which is
at the 6th byte of the above CS CALL instruction. Since the CS CALL
instruction occupies 6 bytes, the exception occurred in the middle of that
call instruction.

The root cause is that when using eBPF tools to probe in the middle of a
function, a kprobe with INT3 is used as the underlying implementation.

During single-step emulation of the original CALL instruction,
int3_emulate_call() assumes that the probed CALL instruction is 5 bytes
long. However, the actual CS-prefixed CALL instruction occupies 6 bytes,
so it constructs an incorrect exception return address. When the CPU
returns from the kprobe handler, the next instruction to be executed is at
the address of the last byte of that CS CALL instruction. Coincidentally,
starting from that address, the CPU fetches and decodes a completely
different instruction, which ultimately triggers a kernel crash.

Fix the issue by using the actual instruction length obtained from
the instruction decoder when constructing the exception return
address, rather than relying on the hardcoded CALL_INSN_SIZE macro.

[ mingo: Refined the changelog ]

Fixes: 6256e668b7af ("x86/kprobes: Use int3 instead of debug trap for single-step")
Suggested-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: Jinke Han <jinkehan@didiglobal.com>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Reviewed-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Acked-by: Yafang Shao <laoar.shao@gmail.com>
Acked-by: Borislav Petkov <bp@alien8.de>
Cc: Peter Zijlstra <peterz@infradead.org>
Link: https://patch.msgid.link/20260908073742.GA10517@didi-ThinkCentre-M920t-N000

1 files changed, 346 insertions, 0 deletions

diff --git a/drivers/char/bsr.c b/drivers/char/bsr.c
new file mode 100644
index 000000000..98e9327bf
--- /dev/null
+++ b/drivers/char/bsr.c
@@ -0,0 +1,346 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/* IBM POWER Barrier Synchronization Register Driver
+ *
+ * Copyright IBM Corporation 2008
+ *
+ * Author: Sonny Rao <sonnyrao@us.ibm.com>
+ */
+
+#include <linux/device.h>
+#include <linux/kernel.h>
+#include <linux/of.h>
+#include <linux/of_address.h>
+#include <linux/fs.h>
+#include <linux/module.h>
+#include <linux/cdev.h>
+#include <linux/list.h>
+#include <linux/mm.h>
+#include <linux/slab.h>
+#include <asm/io.h>
+
+/*
+ This driver exposes a special register which can be used for fast
+ synchronization across a large SMP machine.  The hardware is exposed
+ as an array of bytes where each process will write to one of the bytes to
+ indicate it has finished the current stage and this update is broadcast to
+ all processors without having to bounce a cacheline between them. In
+ POWER5 and POWER6 there is one of these registers per SMP,  but it is
+ presented in two forms; first, it is given as a whole and then as a number
+ of smaller registers which alias to parts of the single whole register.
+ This can potentially allow multiple groups of processes to each have their
+ own private synchronization device.
+
+ Note that this hardware *must* be written to using *only* single byte writes.
+ It may be read using 1, 2, 4, or 8 byte loads which must be aligned since
+ this region is treated as cache-inhibited  processes should also use a
+ full sync before and after writing to the BSR to ensure all stores and
+ the BSR update have made it to all chips in the system
+*/
+
+/* This is arbitrary number, up to Power6 it's been 17 or fewer  */
+#define BSR_MAX_DEVS (32)
+
+struct bsr_dev {
+	u64      bsr_addr;     /* Real address */
+	u64      bsr_len;      /* length of mem region we can map */
+	unsigned bsr_bytes;    /* size of the BSR reg itself */
+	unsigned bsr_stride;   /* interval at which BSR repeats in the page */
+	unsigned bsr_type;     /* maps to enum below */
+	unsigned bsr_num;      /* bsr id number for its type */
+	int      bsr_minor;
+
+	struct list_head bsr_list;
+
+	dev_t    bsr_dev;
+	struct cdev bsr_cdev;
+	struct device *bsr_device;
+	char     bsr_name[32];
+
+};
+
+static unsigned total_bsr_devs;
+static LIST_HEAD(bsr_devs);
+static int bsr_major;
+
+enum {
+	BSR_8    = 0,
+	BSR_16   = 1,
+	BSR_64   = 2,
+	BSR_128  = 3,
+	BSR_4096 = 4,
+	BSR_UNKNOWN = 5,
+	BSR_MAX  = 6,
+};
+
+static unsigned bsr_types[BSR_MAX];
+
+static ssize_t
+bsr_size_show(struct device *dev, struct device_attribute *attr, char *buf)
+{
+	struct bsr_dev *bsr_dev = dev_get_drvdata(dev);
+	return sprintf(buf, "%u\n", bsr_dev->bsr_bytes);
+}
+static DEVICE_ATTR_RO(bsr_size);
+
+static ssize_t
+bsr_stride_show(struct device *dev, struct device_attribute *attr, char *buf)
+{
+	struct bsr_dev *bsr_dev = dev_get_drvdata(dev);
+	return sprintf(buf, "%u\n", bsr_dev->bsr_stride);
+}
+static DEVICE_ATTR_RO(bsr_stride);
+
+static ssize_t
+bsr_length_show(struct device *dev, struct device_attribute *attr, char *buf)
+{
+	struct bsr_dev *bsr_dev = dev_get_drvdata(dev);
+	return sprintf(buf, "%llu\n", bsr_dev->bsr_len);
+}
+static DEVICE_ATTR_RO(bsr_length);
+
+static struct attribute *bsr_dev_attrs[] = {
+	&dev_attr_bsr_size.attr,
+	&dev_attr_bsr_stride.attr,
+	&dev_attr_bsr_length.attr,
+	NULL,
+};
+ATTRIBUTE_GROUPS(bsr_dev);
+
+static const struct class bsr_class = {
+	.name		= "bsr",
+	.dev_groups	= bsr_dev_groups,
+};
+
+static int bsr_mmap(struct file *filp, struct vm_area_struct *vma)
+{
+	unsigned long size   = vma->vm_end - vma->vm_start;
+	struct bsr_dev *dev = filp->private_data;
+	int ret;
+
+	vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
+
+	/* check for the case of a small BSR device and map one 4k page for it*/
+	if (dev->bsr_len < PAGE_SIZE && size == PAGE_SIZE)
+		ret = remap_4k_pfn(vma, vma->vm_start, dev->bsr_addr >> 12,
+				   vma->vm_page_prot);
+	else if (size <= dev->bsr_len)
+		ret = io_remap_pfn_range(vma, vma->vm_start,
+					 dev->bsr_addr >> PAGE_SHIFT,
+					 size, vma->vm_page_prot);
+	else
+		return -EINVAL;
+
+	if (ret)
+		return -EAGAIN;
+
+	return 0;
+}
+
+static int bsr_open(struct inode *inode, struct file *filp)
+{
+	struct cdev *cdev = inode->i_cdev;
+	struct bsr_dev *dev = container_of(cdev, struct bsr_dev, bsr_cdev);
+
+	filp->private_data = dev;
+	return 0;
+}
+
+static const struct file_operations bsr_fops = {
+	.owner = THIS_MODULE,
+	.mmap  = bsr_mmap,
+	.open  = bsr_open,
+	.llseek = noop_llseek,
+};
+
+static void bsr_cleanup_devs(void)
+{
+	struct bsr_dev *cur, *n;
+
+	list_for_each_entry_safe(cur, n, &bsr_devs, bsr_list) {
+		if (cur->bsr_device) {
+			cdev_del(&cur->bsr_cdev);
+			device_del(cur->bsr_device);
+		}
+		list_del(&cur->bsr_list);
+		kfree(cur);
+	}
+}
+
+static int bsr_add_node(struct device_node *bn)
+{
+	int bsr_stride_len, bsr_bytes_len, num_bsr_devs;
+	const u32 *bsr_stride;
+	const u32 *bsr_bytes;
+	unsigned i;
+	int ret = -ENODEV;
+
+	bsr_stride = of_get_property(bn, "ibm,lock-stride", &bsr_stride_len);
+	bsr_bytes  = of_get_property(bn, "ibm,#lock-bytes", &bsr_bytes_len);
+
+	if (!bsr_stride || !bsr_bytes ||
+	    (bsr_stride_len != bsr_bytes_len)) {
+		printk(KERN_ERR "bsr of-node has missing/incorrect property\n");
+		return ret;
+	}
+
+	num_bsr_devs = bsr_bytes_len / sizeof(u32);
+
+	for (i = 0 ; i < num_bsr_devs; i++) {
+		struct bsr_dev *cur = kzalloc_obj(struct bsr_dev);
+		struct resource res;
+		int result;
+
+		if (!cur) {
+			printk(KERN_ERR "Unable to alloc bsr dev\n");
+			ret = -ENOMEM;
+			goto out_err;
+		}
+
+		result = of_address_to_resource(bn, i, &res);
+		if (result < 0) {
+			printk(KERN_ERR "bsr of-node has invalid reg property, skipping\n");
+			kfree(cur);
+			continue;
+		}
+
+		cur->bsr_minor  = i + total_bsr_devs;
+		cur->bsr_addr   = res.start;
+		cur->bsr_len    = resource_size(&res);
+		cur->bsr_bytes  = bsr_bytes[i];
+		cur->bsr_stride = bsr_stride[i];
+		cur->bsr_dev    = MKDEV(bsr_major, i + total_bsr_devs);
+
+		/* if we have a bsr_len of > 4k and less then PAGE_SIZE (64k pages) */
+		/* we can only map 4k of it, so only advertise the 4k in sysfs */
+		if (cur->bsr_len > 4096 && cur->bsr_len < PAGE_SIZE)
+			cur->bsr_len = 4096;
+
+		switch(cur->bsr_bytes) {
+		case 8:
+			cur->bsr_type = BSR_8;
+			break;
+		case 16:
+			cur->bsr_type = BSR_16;
+			break;
+		case 64:
+			cur->bsr_type = BSR_64;
+			break;
+		case 128:
+			cur->bsr_type = BSR_128;
+			break;
+		case 4096:
+			cur->bsr_type = BSR_4096;
+			break;
+		default:
+			cur->bsr_type = BSR_UNKNOWN;
+		}
+
+		cur->bsr_num = bsr_types[cur->bsr_type];
+		snprintf(cur->bsr_name, 32, "bsr%d_%d",
+			 cur->bsr_bytes, cur->bsr_num);
+
+		cdev_init(&cur->bsr_cdev, &bsr_fops);
+		result = cdev_add(&cur->bsr_cdev, cur->bsr_dev, 1);
+		if (result) {
+			kfree(cur);
+			goto out_err;
+		}
+
+		cur->bsr_device = device_create(&bsr_class, NULL, cur->bsr_dev,
+						cur, "%s", cur->bsr_name);
+		if (IS_ERR(cur->bsr_device)) {
+			printk(KERN_ERR "device_create failed for %s\n",
+			       cur->bsr_name);
+			cdev_del(&cur->bsr_cdev);
+			kfree(cur);
+			goto out_err;
+		}
+
+		bsr_types[cur->bsr_type] = cur->bsr_num + 1;
+		list_add_tail(&cur->bsr_list, &bsr_devs);
+	}
+
+	total_bsr_devs += num_bsr_devs;
+
+	return 0;
+
+ out_err:
+
+	bsr_cleanup_devs();
+	return ret;
+}
+
+static int bsr_create_devs(struct device_node *bn)
+{
+	int ret;
+
+	while (bn) {
+		ret = bsr_add_node(bn);
+		if (ret) {
+			of_node_put(bn);
+			return ret;
+		}
+		bn = of_find_compatible_node(bn, NULL, "ibm,bsr");
+	}
+	return 0;
+}
+
+static int __init bsr_init(void)
+{
+	struct device_node *np;
+	dev_t bsr_dev;
+	int ret = -ENODEV;
+
+	np = of_find_compatible_node(NULL, NULL, "ibm,bsr");
+	if (!np)
+		goto out_err;
+
+	ret = class_register(&bsr_class);
+	if (ret)
+		goto out_err_1;
+
+	ret = alloc_chrdev_region(&bsr_dev, 0, BSR_MAX_DEVS, "bsr");
+	bsr_major = MAJOR(bsr_dev);
+	if (ret < 0) {
+		printk(KERN_ERR "alloc_chrdev_region() failed for bsr\n");
+		goto out_err_2;
+	}
+
+	ret = bsr_create_devs(np);
+	if (ret < 0) {
+		np = NULL;
+		goto out_err_3;
+	}
+
+	return 0;
+
+ out_err_3:
+	unregister_chrdev_region(bsr_dev, BSR_MAX_DEVS);
+
+ out_err_2:
+	class_unregister(&bsr_class);
+
+ out_err_1:
+	of_node_put(np);
+
+ out_err:
+
+	return ret;
+}
+
+static void __exit  bsr_exit(void)
+{
+
+	bsr_cleanup_devs();
+
+	class_unregister(&bsr_class);
+
+	if (bsr_major)
+		unregister_chrdev_region(MKDEV(bsr_major, 0), BSR_MAX_DEVS);
+}
+
+module_init(bsr_init);
+module_exit(bsr_exit);
+MODULE_DESCRIPTION("IBM POWER Barrier Synchronization Register Driver");
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Sonny Rao <sonnyrao@us.ibm.com>");