x86/kprobes: Fix crash when probing CS CALL instructionsgrafted

When using eBPF to probe CS CALL instructions within a function,
a crash can be triggered.

The eBPF tool probes offset 257 of the __hrtimer_run_queues()
function:

<__hrtimer_run_queues+249>:  nopl   0x0(%rax,%rax,1)
<__hrtimer_run_queues+254>:  mov    %r14,%rdi
<__hrtimer_run_queues+257>:  cs call <__x86_indirect_thunk_r12>
<__hrtimer_run_queues+263>:  mov    %eax,%r12d
<__hrtimer_run_queues+266>:  xchg   %ax,%ax
<__hrtimer_run_queues+268>:  mov    %r13,%rdi

Which triggers this crash:

  BUG: unable to handle page fault for address: 00000000000f41c9
  #PF: supervisor write access in kernel mode
  #PF: error_code(0x0002) - not-present page
  PGD 0 P4D 0
  Oops: 0002 [#1] SMP NOPTI
  CPU: 1 PID: 0 Comm: swapper/1 Kdump: loaded Tainted: P
  RIP: 0010:__hrtimer_run_queues+0x106/0x230

Note that __hrtimer_run_queues+0x106 is __hrtimer_run_queues+262, which is
at the 6th byte of the above CS CALL instruction. Since the CS CALL
instruction occupies 6 bytes, the exception occurred in the middle of that
call instruction.

The root cause is that when using eBPF tools to probe in the middle of a
function, a kprobe with INT3 is used as the underlying implementation.

During single-step emulation of the original CALL instruction,
int3_emulate_call() assumes that the probed CALL instruction is 5 bytes
long. However, the actual CS-prefixed CALL instruction occupies 6 bytes,
so it constructs an incorrect exception return address. When the CPU
returns from the kprobe handler, the next instruction to be executed is at
the address of the last byte of that CS CALL instruction. Coincidentally,
starting from that address, the CPU fetches and decodes a completely
different instruction, which ultimately triggers a kernel crash.

Fix the issue by using the actual instruction length obtained from
the instruction decoder when constructing the exception return
address, rather than relying on the hardcoded CALL_INSN_SIZE macro.

[ mingo: Refined the changelog ]

Fixes: 6256e668b7af ("x86/kprobes: Use int3 instead of debug trap for single-step")
Suggested-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: Jinke Han <jinkehan@didiglobal.com>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Reviewed-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Acked-by: Yafang Shao <laoar.shao@gmail.com>
Acked-by: Borislav Petkov <bp@alien8.de>
Cc: Peter Zijlstra <peterz@infradead.org>
Link: https://patch.msgid.link/20260908073742.GA10517@didi-ThinkCentre-M920t-N000

1 files changed, 86 insertions, 0 deletions

diff --git a/drivers/net/arcnet/Kconfig b/drivers/net/arcnet/Kconfig
new file mode 100644
index 000000000..4611a3716
--- /dev/null
+++ b/drivers/net/arcnet/Kconfig
@@ -0,0 +1,86 @@
+# SPDX-License-Identifier: GPL-2.0-only
+#
+# Arcnet configuration
+#
+
+menuconfig ARCNET
+	depends on NETDEVICES && PCI && HAS_IOPORT
+	tristate "ARCnet support"
+	help
+	  If you have a network card of this type, say Y and check out the
+	  (arguably) beautiful poetry in
+	  <file:Documentation/networking/arcnet.rst>.
+
+	  You need both this driver, and the driver for the particular ARCnet
+	  chipset of your card.
+
+	  To compile this driver as a module, choose M here. The module will
+	  be called arcnet.
+
+if ARCNET
+
+config ARCNET_1201
+	tristate "Enable standard ARCNet packet format (RFC 1201)"
+	help
+	  This allows you to use RFC1201 with your ARCnet card via the virtual
+	  arc0 device.  You need to say Y here to communicate with
+	  industry-standard RFC1201 implementations, like the arcether.com
+	  packet driver or most DOS/Windows ODI drivers.  Please read the
+	  ARCnet documentation in <file:Documentation/networking/arcnet.rst>
+	  for more information about using arc0.
+
+config ARCNET_1051
+	tristate "Enable old ARCNet packet format (RFC 1051)"
+	help
+	  This allows you to use RFC1051 with your ARCnet card via the virtual
+	  arc0s device. You only need arc0s if you want to talk to ARCnet
+	  software complying with the "old" standard, specifically, the DOS
+	  arcnet.com packet driver, Amigas running AmiTCP, and some variants
+	  of NetBSD. You do not need to say Y here to communicate with
+	  industry-standard RFC1201 implementations, like the arcether.com
+	  packet driver or most DOS/Windows ODI drivers. RFC1201 is included
+	  automatically as the arc0 device. Please read the ARCnet
+	  documentation in <file:Documentation/networking/arcnet.rst> for more
+	  information about using arc0e and arc0s.
+
+config ARCNET_RAW
+	tristate "Enable raw mode packet interface"
+	help
+	  ARCnet "raw mode" packet encapsulation, no soft headers.  Unlikely
+	  to work unless talking to a copy of the same Linux arcnet driver,
+	  but perhaps marginally faster in that case.
+
+config ARCNET_CAP
+	tristate "Enable CAP mode packet interface"
+	help
+	  ARCnet "cap mode" packet encapsulation. Used to get the hardware
+	  acknowledge back to userspace. After the initial protocol byte every
+	  packet is stuffed with an extra 4 byte "cookie" which doesn't
+	  actually appear on the network. After transmit the driver will send
+	  back a packet with protocol byte 0 containing the status of the
+	  transmission:
+	     0=no hardware acknowledge
+	     1=excessive nak
+	     2=transmission accepted by the receiver hardware
+
+	  Received packets are also stuffed with the extra 4 bytes but it will
+	  be random data.
+
+	  Cap only listens to protocol 1-8.
+
+config ARCNET_COM20020
+	tristate "ARCnet COM20020 chipset driver"
+	depends on LEDS_CLASS
+	help
+	  This is the driver for the new COM20020 chipset. It supports such
+	  things as promiscuous mode, so packet sniffing is possible, and
+	  extra diagnostic information.
+
+	  To compile this driver as a module, choose M here. The module will
+	  be called com20020.
+
+config ARCNET_COM20020_PCI
+	tristate "Support for COM20020 on PCI"
+	depends on ARCNET_COM20020 && PCI
+
+endif # ARCNET