x86/kprobes: Fix crash when probing CS CALL instructionsgrafted

When using eBPF to probe CS CALL instructions within a function,
a crash can be triggered.

The eBPF tool probes offset 257 of the __hrtimer_run_queues()
function:

<__hrtimer_run_queues+249>:  nopl   0x0(%rax,%rax,1)
<__hrtimer_run_queues+254>:  mov    %r14,%rdi
<__hrtimer_run_queues+257>:  cs call <__x86_indirect_thunk_r12>
<__hrtimer_run_queues+263>:  mov    %eax,%r12d
<__hrtimer_run_queues+266>:  xchg   %ax,%ax
<__hrtimer_run_queues+268>:  mov    %r13,%rdi

Which triggers this crash:

  BUG: unable to handle page fault for address: 00000000000f41c9
  #PF: supervisor write access in kernel mode
  #PF: error_code(0x0002) - not-present page
  PGD 0 P4D 0
  Oops: 0002 [#1] SMP NOPTI
  CPU: 1 PID: 0 Comm: swapper/1 Kdump: loaded Tainted: P
  RIP: 0010:__hrtimer_run_queues+0x106/0x230

Note that __hrtimer_run_queues+0x106 is __hrtimer_run_queues+262, which is
at the 6th byte of the above CS CALL instruction. Since the CS CALL
instruction occupies 6 bytes, the exception occurred in the middle of that
call instruction.

The root cause is that when using eBPF tools to probe in the middle of a
function, a kprobe with INT3 is used as the underlying implementation.

During single-step emulation of the original CALL instruction,
int3_emulate_call() assumes that the probed CALL instruction is 5 bytes
long. However, the actual CS-prefixed CALL instruction occupies 6 bytes,
so it constructs an incorrect exception return address. When the CPU
returns from the kprobe handler, the next instruction to be executed is at
the address of the last byte of that CS CALL instruction. Coincidentally,
starting from that address, the CPU fetches and decodes a completely
different instruction, which ultimately triggers a kernel crash.

Fix the issue by using the actual instruction length obtained from
the instruction decoder when constructing the exception return
address, rather than relying on the hardcoded CALL_INSN_SIZE macro.

[ mingo: Refined the changelog ]

Fixes: 6256e668b7af ("x86/kprobes: Use int3 instead of debug trap for single-step")
Suggested-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: Jinke Han <jinkehan@didiglobal.com>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Reviewed-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Acked-by: Yafang Shao <laoar.shao@gmail.com>
Acked-by: Borislav Petkov <bp@alien8.de>
Cc: Peter Zijlstra <peterz@infradead.org>
Link: https://patch.msgid.link/20260908073742.GA10517@didi-ThinkCentre-M920t-N000

1 files changed, 231 insertions, 0 deletions

diff --git a/drivers/mtd/maps/dc21285.c b/drivers/mtd/maps/dc21285.c
new file mode 100644
index 000000000..70a3db3ab
--- /dev/null
+++ b/drivers/mtd/maps/dc21285.c
@@ -0,0 +1,231 @@
+/*
+ * MTD map driver for flash on the DC21285 (the StrongARM-110 companion chip)
+ *
+ * (C) 2000  Nicolas Pitre <nico@fluxnic.net>
+ *
+ * This code is GPL
+ */
+#include <linux/module.h>
+#include <linux/types.h>
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/delay.h>
+#include <linux/slab.h>
+
+#include <linux/mtd/mtd.h>
+#include <linux/mtd/map.h>
+#include <linux/mtd/partitions.h>
+
+#include <asm/io.h>
+#include <asm/hardware/dec21285.h>
+#include <asm/mach-types.h>
+
+
+static struct mtd_info *dc21285_mtd;
+
+#ifdef CONFIG_ARCH_NETWINDER
+/*
+ * This is really ugly, but it seams to be the only
+ * realiable way to do it, as the cpld state machine
+ * is unpredictible. So we have a 25us penalty per
+ * write access.
+ */
+static void nw_en_write(void)
+{
+	unsigned long flags;
+
+	/*
+	 * we want to write a bit pattern XXX1 to Xilinx to enable
+	 * the write gate, which will be open for about the next 2ms.
+	 */
+	raw_spin_lock_irqsave(&nw_gpio_lock, flags);
+	nw_cpld_modify(CPLD_FLASH_WR_ENABLE, CPLD_FLASH_WR_ENABLE);
+	raw_spin_unlock_irqrestore(&nw_gpio_lock, flags);
+
+	/*
+	 * let the ISA bus to catch on...
+	 */
+	udelay(25);
+}
+#else
+#define nw_en_write() do { } while (0)
+#endif
+
+static map_word dc21285_read8(struct map_info *map, unsigned long ofs)
+{
+	map_word val;
+	val.x[0] = *(uint8_t*)(map->virt + ofs);
+	return val;
+}
+
+static map_word dc21285_read16(struct map_info *map, unsigned long ofs)
+{
+	map_word val;
+	val.x[0] = *(uint16_t*)(map->virt + ofs);
+	return val;
+}
+
+static map_word dc21285_read32(struct map_info *map, unsigned long ofs)
+{
+	map_word val;
+	val.x[0] = *(uint32_t*)(map->virt + ofs);
+	return val;
+}
+
+static void dc21285_copy_from(struct map_info *map, void *to, unsigned long from, ssize_t len)
+{
+	memcpy(to, (void*)(map->virt + from), len);
+}
+
+static void dc21285_write8(struct map_info *map, const map_word d, unsigned long adr)
+{
+	if (machine_is_netwinder())
+		nw_en_write();
+	*CSR_ROMWRITEREG = adr & 3;
+	adr &= ~3;
+	*(uint8_t*)(map->virt + adr) = d.x[0];
+}
+
+static void dc21285_write16(struct map_info *map, const map_word d, unsigned long adr)
+{
+	if (machine_is_netwinder())
+		nw_en_write();
+	*CSR_ROMWRITEREG = adr & 3;
+	adr &= ~3;
+	*(uint16_t*)(map->virt + adr) = d.x[0];
+}
+
+static void dc21285_write32(struct map_info *map, const map_word d, unsigned long adr)
+{
+	if (machine_is_netwinder())
+		nw_en_write();
+	*(uint32_t*)(map->virt + adr) = d.x[0];
+}
+
+static void dc21285_copy_to_32(struct map_info *map, unsigned long to, const void *from, ssize_t len)
+{
+	while (len > 0) {
+		map_word d;
+		d.x[0] = *((uint32_t*)from);
+		dc21285_write32(map, d, to);
+		from += 4;
+		to += 4;
+		len -= 4;
+	}
+}
+
+static void dc21285_copy_to_16(struct map_info *map, unsigned long to, const void *from, ssize_t len)
+{
+	while (len > 0) {
+		map_word d;
+		d.x[0] = *((uint16_t*)from);
+		dc21285_write16(map, d, to);
+		from += 2;
+		to += 2;
+		len -= 2;
+	}
+}
+
+static void dc21285_copy_to_8(struct map_info *map, unsigned long to, const void *from, ssize_t len)
+{
+	map_word d;
+	d.x[0] = *((uint8_t*)from);
+	dc21285_write8(map, d, to);
+	from++;
+	to++;
+	len--;
+}
+
+static struct map_info dc21285_map = {
+	.name = "DC21285 flash",
+	.phys = NO_XIP,
+	.size = 16*1024*1024,
+	.copy_from = dc21285_copy_from,
+};
+
+/* Partition stuff */
+static const char * const probes[] = { "RedBoot", "cmdlinepart", NULL };
+
+static int __init init_dc21285(void)
+{
+	/* Determine bankwidth */
+	switch (*CSR_SA110_CNTL & (3<<14)) {
+		case SA110_CNTL_ROMWIDTH_8:
+			dc21285_map.bankwidth = 1;
+			dc21285_map.read = dc21285_read8;
+			dc21285_map.write = dc21285_write8;
+			dc21285_map.copy_to = dc21285_copy_to_8;
+			break;
+		case SA110_CNTL_ROMWIDTH_16:
+			dc21285_map.bankwidth = 2;
+			dc21285_map.read = dc21285_read16;
+			dc21285_map.write = dc21285_write16;
+			dc21285_map.copy_to = dc21285_copy_to_16;
+			break;
+		case SA110_CNTL_ROMWIDTH_32:
+			dc21285_map.bankwidth = 4;
+			dc21285_map.read = dc21285_read32;
+			dc21285_map.write = dc21285_write32;
+			dc21285_map.copy_to = dc21285_copy_to_32;
+			break;
+		default:
+			printk (KERN_ERR "DC21285 flash: undefined bankwidth\n");
+			return -ENXIO;
+	}
+	printk (KERN_NOTICE "DC21285 flash support (%d-bit bankwidth)\n",
+		dc21285_map.bankwidth*8);
+
+	/* Let's map the flash area */
+	dc21285_map.virt = ioremap(DC21285_FLASH, 16*1024*1024);
+	if (!dc21285_map.virt) {
+		printk("Failed to ioremap\n");
+		return -EIO;
+	}
+
+	if (machine_is_ebsa285()) {
+		dc21285_mtd = do_map_probe("cfi_probe", &dc21285_map);
+	} else {
+		dc21285_mtd = do_map_probe("jedec_probe", &dc21285_map);
+	}
+
+	if (!dc21285_mtd) {
+		iounmap(dc21285_map.virt);
+		return -ENXIO;
+	}
+
+	dc21285_mtd->owner = THIS_MODULE;
+
+	mtd_device_parse_register(dc21285_mtd, probes, NULL, NULL, 0);
+
+	if(machine_is_ebsa285()) {
+		/*
+		 * Flash timing is determined with bits 19-16 of the
+		 * CSR_SA110_CNTL.  The value is the number of wait cycles, or
+		 * 0 for 16 cycles (the default).  Cycles are 20 ns.
+		 * Here we use 7 for 140 ns flash chips.
+		 */
+		/* access time */
+		*CSR_SA110_CNTL = ((*CSR_SA110_CNTL & ~0x000f0000) | (7 << 16));
+		/* burst time */
+		*CSR_SA110_CNTL = ((*CSR_SA110_CNTL & ~0x00f00000) | (7 << 20));
+		/* tristate time */
+		*CSR_SA110_CNTL = ((*CSR_SA110_CNTL & ~0x0f000000) | (7 << 24));
+	}
+
+	return 0;
+}
+
+static void __exit cleanup_dc21285(void)
+{
+	mtd_device_unregister(dc21285_mtd);
+	map_destroy(dc21285_mtd);
+	iounmap(dc21285_map.virt);
+}
+
+module_init(init_dc21285);
+module_exit(cleanup_dc21285);
+
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Nicolas Pitre <nico@fluxnic.net>");
+MODULE_DESCRIPTION("MTD map driver for DC21285 boards");