x86/kprobes: Fix crash when probing CS CALL instructionsgrafted

When using eBPF to probe CS CALL instructions within a function,
a crash can be triggered.

The eBPF tool probes offset 257 of the __hrtimer_run_queues()
function:

<__hrtimer_run_queues+249>:  nopl   0x0(%rax,%rax,1)
<__hrtimer_run_queues+254>:  mov    %r14,%rdi
<__hrtimer_run_queues+257>:  cs call <__x86_indirect_thunk_r12>
<__hrtimer_run_queues+263>:  mov    %eax,%r12d
<__hrtimer_run_queues+266>:  xchg   %ax,%ax
<__hrtimer_run_queues+268>:  mov    %r13,%rdi

Which triggers this crash:

  BUG: unable to handle page fault for address: 00000000000f41c9
  #PF: supervisor write access in kernel mode
  #PF: error_code(0x0002) - not-present page
  PGD 0 P4D 0
  Oops: 0002 [#1] SMP NOPTI
  CPU: 1 PID: 0 Comm: swapper/1 Kdump: loaded Tainted: P
  RIP: 0010:__hrtimer_run_queues+0x106/0x230

Note that __hrtimer_run_queues+0x106 is __hrtimer_run_queues+262, which is
at the 6th byte of the above CS CALL instruction. Since the CS CALL
instruction occupies 6 bytes, the exception occurred in the middle of that
call instruction.

The root cause is that when using eBPF tools to probe in the middle of a
function, a kprobe with INT3 is used as the underlying implementation.

During single-step emulation of the original CALL instruction,
int3_emulate_call() assumes that the probed CALL instruction is 5 bytes
long. However, the actual CS-prefixed CALL instruction occupies 6 bytes,
so it constructs an incorrect exception return address. When the CPU
returns from the kprobe handler, the next instruction to be executed is at
the address of the last byte of that CS CALL instruction. Coincidentally,
starting from that address, the CPU fetches and decodes a completely
different instruction, which ultimately triggers a kernel crash.

Fix the issue by using the actual instruction length obtained from
the instruction decoder when constructing the exception return
address, rather than relying on the hardcoded CALL_INSN_SIZE macro.

[ mingo: Refined the changelog ]

Fixes: 6256e668b7af ("x86/kprobes: Use int3 instead of debug trap for single-step")
Suggested-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: Jinke Han <jinkehan@didiglobal.com>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Reviewed-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Acked-by: Yafang Shao <laoar.shao@gmail.com>
Acked-by: Borislav Petkov <bp@alien8.de>
Cc: Peter Zijlstra <peterz@infradead.org>
Link: https://patch.msgid.link/20260908073742.GA10517@didi-ThinkCentre-M920t-N000

1 files changed, 429 insertions, 0 deletions

diff --git a/drivers/pnp/manager.c b/drivers/pnp/manager.c
new file mode 100644
index 000000000..1765d6e60
--- /dev/null
+++ b/drivers/pnp/manager.c
@@ -0,0 +1,429 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * manager.c - Resource Management, Conflict Resolution, Activation and Disabling of Devices
+ *
+ * based on isapnp.c resource management (c) Jaroslav Kysela <perex@perex.cz>
+ * Copyright 2003 Adam Belay <ambx1@neo.rr.com>
+ * Copyright (C) 2008 Hewlett-Packard Development Company, L.P.
+ *	Bjorn Helgaas <bjorn.helgaas@hp.com>
+ */
+
+#include <linux/errno.h>
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/kernel.h>
+#include <linux/pnp.h>
+#include <linux/bitmap.h>
+#include <linux/mutex.h>
+#include "base.h"
+
+DEFINE_MUTEX(pnp_res_mutex);
+
+static struct resource *pnp_find_resource(struct pnp_dev *dev,
+					  unsigned char rule,
+					  unsigned long type,
+					  unsigned int bar)
+{
+	struct resource *res = pnp_get_resource(dev, type, bar);
+
+	/* when the resource already exists, set its resource bits from rule */
+	if (res) {
+		res->flags &= ~IORESOURCE_BITS;
+		res->flags |= rule & IORESOURCE_BITS;
+	}
+
+	return res;
+}
+
+static int pnp_assign_port(struct pnp_dev *dev, struct pnp_port *rule, int idx)
+{
+	struct resource *res, local_res;
+
+	res = pnp_find_resource(dev, rule->flags, IORESOURCE_IO, idx);
+	if (res) {
+		pnp_dbg(&dev->dev, "  io %d already set to %#llx-%#llx "
+			"flags %#lx\n", idx, (unsigned long long) res->start,
+			(unsigned long long) res->end, res->flags);
+		return 0;
+	}
+
+	res = &local_res;
+	res->flags = rule->flags | IORESOURCE_AUTO;
+	res->start = 0;
+	res->end = 0;
+
+	if (!rule->size) {
+		res->flags |= IORESOURCE_DISABLED;
+		pnp_dbg(&dev->dev, "  io %d disabled\n", idx);
+		goto __add;
+	}
+
+	res->start = rule->min;
+	res->end = res->start + rule->size - 1;
+
+	while (!pnp_check_port(dev, res)) {
+		res->start += rule->align;
+		res->end = res->start + rule->size - 1;
+		if (res->start > rule->max || !rule->align) {
+			pnp_dbg(&dev->dev, "  couldn't assign io %d "
+				"(min %#llx max %#llx)\n", idx,
+				(unsigned long long) rule->min,
+				(unsigned long long) rule->max);
+			return -EBUSY;
+		}
+	}
+
+__add:
+	pnp_add_io_resource(dev, res->start, res->end, res->flags);
+	return 0;
+}
+
+static int pnp_assign_mem(struct pnp_dev *dev, struct pnp_mem *rule, int idx)
+{
+	struct resource *res, local_res;
+
+	res = pnp_find_resource(dev, rule->flags, IORESOURCE_MEM, idx);
+	if (res) {
+		pnp_dbg(&dev->dev, "  mem %d already set to %#llx-%#llx "
+			"flags %#lx\n", idx, (unsigned long long) res->start,
+			(unsigned long long) res->end, res->flags);
+		return 0;
+	}
+
+	res = &local_res;
+	res->flags = rule->flags | IORESOURCE_AUTO;
+	res->start = 0;
+	res->end = 0;
+
+	/* ??? rule->flags restricted to 8 bits, all tests bogus ??? */
+	if (!(rule->flags & IORESOURCE_MEM_WRITEABLE))
+		res->flags |= IORESOURCE_READONLY;
+	if (rule->flags & IORESOURCE_MEM_RANGELENGTH)
+		res->flags |= IORESOURCE_RANGELENGTH;
+	if (rule->flags & IORESOURCE_MEM_SHADOWABLE)
+		res->flags |= IORESOURCE_SHADOWABLE;
+
+	if (!rule->size) {
+		res->flags |= IORESOURCE_DISABLED;
+		pnp_dbg(&dev->dev, "  mem %d disabled\n", idx);
+		goto __add;
+	}
+
+	res->start = rule->min;
+	res->end = res->start + rule->size - 1;
+
+	while (!pnp_check_mem(dev, res)) {
+		res->start += rule->align;
+		res->end = res->start + rule->size - 1;
+		if (res->start > rule->max || !rule->align) {
+			pnp_dbg(&dev->dev, "  couldn't assign mem %d "
+				"(min %#llx max %#llx)\n", idx,
+				(unsigned long long) rule->min,
+				(unsigned long long) rule->max);
+			return -EBUSY;
+		}
+	}
+
+__add:
+	pnp_add_mem_resource(dev, res->start, res->end, res->flags);
+	return 0;
+}
+
+static int pnp_assign_irq(struct pnp_dev *dev, struct pnp_irq *rule, int idx)
+{
+	struct resource *res, local_res;
+	int i;
+
+	/* IRQ priority: this table is good for i386 */
+	static unsigned short xtab[16] = {
+		5, 10, 11, 12, 9, 14, 15, 7, 3, 4, 13, 0, 1, 6, 8, 2
+	};
+
+	res = pnp_find_resource(dev, rule->flags, IORESOURCE_IRQ, idx);
+	if (res) {
+		pnp_dbg(&dev->dev, "  irq %d already set to %d flags %#lx\n",
+			idx, (int) res->start, res->flags);
+		return 0;
+	}
+
+	res = &local_res;
+	res->flags = rule->flags | IORESOURCE_AUTO;
+	res->start = -1;
+	res->end = -1;
+
+	if (bitmap_empty(rule->map.bits, PNP_IRQ_NR)) {
+		res->flags |= IORESOURCE_DISABLED;
+		pnp_dbg(&dev->dev, "  irq %d disabled\n", idx);
+		goto __add;
+	}
+
+	/* TBD: need check for >16 IRQ */
+	res->start = find_next_bit(rule->map.bits, PNP_IRQ_NR, 16);
+	if (res->start < PNP_IRQ_NR) {
+		res->end = res->start;
+		goto __add;
+	}
+	for (i = 0; i < 16; i++) {
+		if (test_bit(xtab[i], rule->map.bits)) {
+			res->start = res->end = xtab[i];
+			if (pnp_check_irq(dev, res))
+				goto __add;
+		}
+	}
+
+	if (rule->flags & IORESOURCE_IRQ_OPTIONAL) {
+		res->start = -1;
+		res->end = -1;
+		res->flags |= IORESOURCE_DISABLED;
+		pnp_dbg(&dev->dev, "  irq %d disabled (optional)\n", idx);
+		goto __add;
+	}
+
+	pnp_dbg(&dev->dev, "  couldn't assign irq %d\n", idx);
+	return -EBUSY;
+
+__add:
+	pnp_add_irq_resource(dev, res->start, res->flags);
+	return 0;
+}
+
+#ifdef CONFIG_ISA_DMA_API
+static int pnp_assign_dma(struct pnp_dev *dev, struct pnp_dma *rule, int idx)
+{
+	struct resource *res, local_res;
+	int i;
+
+	/* DMA priority: this table is good for i386 */
+	static unsigned short xtab[8] = {
+		1, 3, 5, 6, 7, 0, 2, 4
+	};
+
+	res = pnp_find_resource(dev, rule->flags, IORESOURCE_DMA, idx);
+	if (res) {
+		pnp_dbg(&dev->dev, "  dma %d already set to %d flags %#lx\n",
+			idx, (int) res->start, res->flags);
+		return 0;
+	}
+
+	res = &local_res;
+	res->flags = rule->flags | IORESOURCE_AUTO;
+	res->start = -1;
+	res->end = -1;
+
+	if (!rule->map) {
+		res->flags |= IORESOURCE_DISABLED;
+		pnp_dbg(&dev->dev, "  dma %d disabled\n", idx);
+		goto __add;
+	}
+
+	for (i = 0; i < 8; i++) {
+		if (rule->map & (1 << xtab[i])) {
+			res->start = res->end = xtab[i];
+			if (pnp_check_dma(dev, res))
+				goto __add;
+		}
+	}
+
+	pnp_dbg(&dev->dev, "  couldn't assign dma %d\n", idx);
+	return -EBUSY;
+
+__add:
+	pnp_add_dma_resource(dev, res->start, res->flags);
+	return 0;
+}
+#endif /* CONFIG_ISA_DMA_API */
+
+void pnp_init_resources(struct pnp_dev *dev)
+{
+	pnp_free_resources(dev);
+}
+
+static void pnp_clean_resource_table(struct pnp_dev *dev)
+{
+	struct pnp_resource *pnp_res, *tmp;
+
+	list_for_each_entry_safe(pnp_res, tmp, &dev->resources, list) {
+		if (pnp_res->res.flags & IORESOURCE_AUTO)
+			pnp_free_resource(pnp_res);
+	}
+}
+
+/**
+ * pnp_assign_resources - assigns resources to the device based on the specified dependent number
+ * @dev: pointer to the desired device
+ * @set: the dependent function number
+ */
+static int pnp_assign_resources(struct pnp_dev *dev, int set)
+{
+	struct pnp_option *option;
+	int nport = 0, nmem = 0, nirq = 0;
+	int ndma __maybe_unused = 0;
+	int ret = 0;
+
+	pnp_dbg(&dev->dev, "pnp_assign_resources, try dependent set %d\n", set);
+	mutex_lock(&pnp_res_mutex);
+	pnp_clean_resource_table(dev);
+
+	list_for_each_entry(option, &dev->options, list) {
+		if (pnp_option_is_dependent(option) &&
+		    pnp_option_set(option) != set)
+				continue;
+
+		switch (option->type) {
+		case IORESOURCE_IO:
+			ret = pnp_assign_port(dev, &option->u.port, nport++);
+			break;
+		case IORESOURCE_MEM:
+			ret = pnp_assign_mem(dev, &option->u.mem, nmem++);
+			break;
+		case IORESOURCE_IRQ:
+			ret = pnp_assign_irq(dev, &option->u.irq, nirq++);
+			break;
+#ifdef CONFIG_ISA_DMA_API
+		case IORESOURCE_DMA:
+			ret = pnp_assign_dma(dev, &option->u.dma, ndma++);
+			break;
+#endif
+		default:
+			ret = -EINVAL;
+			break;
+		}
+		if (ret < 0)
+			break;
+	}
+
+	mutex_unlock(&pnp_res_mutex);
+	if (ret < 0) {
+		pnp_dbg(&dev->dev, "pnp_assign_resources failed (%d)\n", ret);
+		pnp_clean_resource_table(dev);
+	} else
+		dbg_pnp_show_resources(dev, "pnp_assign_resources succeeded");
+	return ret;
+}
+
+/**
+ * pnp_auto_config_dev - automatically assigns resources to a device
+ * @dev: pointer to the desired device
+ */
+int pnp_auto_config_dev(struct pnp_dev *dev)
+{
+	int i, ret;
+
+	if (!pnp_can_configure(dev)) {
+		pnp_dbg(&dev->dev, "configuration not supported\n");
+		return -ENODEV;
+	}
+
+	ret = pnp_assign_resources(dev, 0);
+	if (ret == 0)
+		return 0;
+
+	for (i = 1; i < dev->num_dependent_sets; i++) {
+		ret = pnp_assign_resources(dev, i);
+		if (ret == 0)
+			return 0;
+	}
+
+	dev_err(&dev->dev, "unable to assign resources\n");
+	return ret;
+}
+
+/**
+ * pnp_start_dev - low-level start of the PnP device
+ * @dev: pointer to the desired device
+ *
+ * assumes that resources have already been allocated
+ */
+int pnp_start_dev(struct pnp_dev *dev)
+{
+	if (!pnp_can_write(dev)) {
+		pnp_dbg(&dev->dev, "activation not supported\n");
+		return -EINVAL;
+	}
+
+	dbg_pnp_show_resources(dev, "pnp_start_dev");
+	if (dev->protocol->set(dev) < 0) {
+		dev_err(&dev->dev, "activation failed\n");
+		return -EIO;
+	}
+
+	dev_info(&dev->dev, "activated\n");
+	return 0;
+}
+EXPORT_SYMBOL(pnp_start_dev);
+
+/**
+ * pnp_stop_dev - low-level disable of the PnP device
+ * @dev: pointer to the desired device
+ *
+ * does not free resources
+ */
+int pnp_stop_dev(struct pnp_dev *dev)
+{
+	if (!pnp_can_disable(dev)) {
+		pnp_dbg(&dev->dev, "disabling not supported\n");
+		return -EINVAL;
+	}
+	if (dev->protocol->disable(dev) < 0) {
+		dev_err(&dev->dev, "disable failed\n");
+		return -EIO;
+	}
+
+	dev_info(&dev->dev, "disabled\n");
+	return 0;
+}
+EXPORT_SYMBOL(pnp_stop_dev);
+
+/**
+ * pnp_activate_dev - activates a PnP device for use
+ * @dev: pointer to the desired device
+ *
+ * does not validate or set resources so be careful.
+ */
+int pnp_activate_dev(struct pnp_dev *dev)
+{
+	int error;
+
+	if (dev->active)
+		return 0;
+
+	/* ensure resources are allocated */
+	if (pnp_auto_config_dev(dev))
+		return -EBUSY;
+
+	error = pnp_start_dev(dev);
+	if (error)
+		return error;
+
+	dev->active = 1;
+	return 0;
+}
+EXPORT_SYMBOL(pnp_activate_dev);
+
+/**
+ * pnp_disable_dev - disables device
+ * @dev: pointer to the desired device
+ *
+ * inform the correct pnp protocol so that resources can be used by other devices
+ */
+int pnp_disable_dev(struct pnp_dev *dev)
+{
+	int error;
+
+	if (!dev->active)
+		return 0;
+
+	error = pnp_stop_dev(dev);
+	if (error)
+		return error;
+
+	dev->active = 0;
+
+	/* release the resources so that other devices can use them */
+	mutex_lock(&pnp_res_mutex);
+	pnp_clean_resource_table(dev);
+	mutex_unlock(&pnp_res_mutex);
+
+	return 0;
+}
+EXPORT_SYMBOL(pnp_disable_dev);