x86/kprobes: Fix crash when probing CS CALL instructionsgrafted

When using eBPF to probe CS CALL instructions within a function,
a crash can be triggered.

The eBPF tool probes offset 257 of the __hrtimer_run_queues()
function:

<__hrtimer_run_queues+249>:  nopl   0x0(%rax,%rax,1)
<__hrtimer_run_queues+254>:  mov    %r14,%rdi
<__hrtimer_run_queues+257>:  cs call <__x86_indirect_thunk_r12>
<__hrtimer_run_queues+263>:  mov    %eax,%r12d
<__hrtimer_run_queues+266>:  xchg   %ax,%ax
<__hrtimer_run_queues+268>:  mov    %r13,%rdi

Which triggers this crash:

  BUG: unable to handle page fault for address: 00000000000f41c9
  #PF: supervisor write access in kernel mode
  #PF: error_code(0x0002) - not-present page
  PGD 0 P4D 0
  Oops: 0002 [#1] SMP NOPTI
  CPU: 1 PID: 0 Comm: swapper/1 Kdump: loaded Tainted: P
  RIP: 0010:__hrtimer_run_queues+0x106/0x230

Note that __hrtimer_run_queues+0x106 is __hrtimer_run_queues+262, which is
at the 6th byte of the above CS CALL instruction. Since the CS CALL
instruction occupies 6 bytes, the exception occurred in the middle of that
call instruction.

The root cause is that when using eBPF tools to probe in the middle of a
function, a kprobe with INT3 is used as the underlying implementation.

During single-step emulation of the original CALL instruction,
int3_emulate_call() assumes that the probed CALL instruction is 5 bytes
long. However, the actual CS-prefixed CALL instruction occupies 6 bytes,
so it constructs an incorrect exception return address. When the CPU
returns from the kprobe handler, the next instruction to be executed is at
the address of the last byte of that CS CALL instruction. Coincidentally,
starting from that address, the CPU fetches and decodes a completely
different instruction, which ultimately triggers a kernel crash.

Fix the issue by using the actual instruction length obtained from
the instruction decoder when constructing the exception return
address, rather than relying on the hardcoded CALL_INSN_SIZE macro.

[ mingo: Refined the changelog ]

Fixes: 6256e668b7af ("x86/kprobes: Use int3 instead of debug trap for single-step")
Suggested-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: Jinke Han <jinkehan@didiglobal.com>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Reviewed-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Acked-by: Yafang Shao <laoar.shao@gmail.com>
Acked-by: Borislav Petkov <bp@alien8.de>
Cc: Peter Zijlstra <peterz@infradead.org>
Link: https://patch.msgid.link/20260908073742.GA10517@didi-ThinkCentre-M920t-N000

1 files changed, 566 insertions, 0 deletions

diff --git a/drivers/scsi/mac53c94.c b/drivers/scsi/mac53c94.c
new file mode 100644
index 000000000..de2bd860b
--- /dev/null
+++ b/drivers/scsi/mac53c94.c
@@ -0,0 +1,566 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * SCSI low-level driver for the 53c94 SCSI bus adaptor found
+ * on Power Macintosh computers, controlling the external SCSI chain.
+ * We assume the 53c94 is connected to a DBDMA (descriptor-based DMA)
+ * controller.
+ *
+ * Paul Mackerras, August 1996.
+ * Copyright (C) 1996 Paul Mackerras.
+ */
+#include <linux/kernel.h>
+#include <linux/delay.h>
+#include <linux/types.h>
+#include <linux/string.h>
+#include <linux/slab.h>
+#include <linux/blkdev.h>
+#include <linux/proc_fs.h>
+#include <linux/stat.h>
+#include <linux/spinlock.h>
+#include <linux/interrupt.h>
+#include <linux/module.h>
+#include <linux/pci.h>
+#include <linux/pgtable.h>
+#include <asm/dbdma.h>
+#include <asm/io.h>
+#include <asm/prom.h>
+#include <asm/macio.h>
+
+#include <scsi/scsi.h>
+#include <scsi/scsi_cmnd.h>
+#include <scsi/scsi_device.h>
+#include <scsi/scsi_host.h>
+
+#include "mac53c94.h"
+
+enum fsc_phase {
+	idle,
+	selecting,
+	dataing,
+	completing,
+	busfreeing,
+};
+
+struct fsc_state {
+	struct	mac53c94_regs __iomem *regs;
+	int	intr;
+	struct	dbdma_regs __iomem *dma;
+	int	dmaintr;
+	int	clk_freq;
+	struct	Scsi_Host *host;
+	struct scsi_cmnd *request_q;
+	struct scsi_cmnd *request_qtail;
+	struct scsi_cmnd *current_req;		/* req we're currently working on */
+	enum fsc_phase phase;		/* what we're currently trying to do */
+	struct dbdma_cmd *dma_cmds;	/* space for dbdma commands, aligned */
+	void	*dma_cmd_space;
+	struct	pci_dev *pdev;
+	dma_addr_t dma_addr;
+	struct macio_dev *mdev;
+};
+
+static void mac53c94_init(struct fsc_state *);
+static void mac53c94_start(struct fsc_state *);
+static void mac53c94_interrupt(int, void *);
+static irqreturn_t do_mac53c94_interrupt(int, void *);
+static void cmd_done(struct fsc_state *, int result);
+static void set_dma_cmds(struct fsc_state *, struct scsi_cmnd *);
+
+static enum scsi_qc_status mac53c94_queue_lck(struct scsi_cmnd *cmd)
+{
+	struct fsc_state *state;
+
+#if 0
+	if (cmd->sc_data_direction == DMA_TO_DEVICE) {
+		int i;
+		printk(KERN_DEBUG "mac53c94_queue %p: command is", cmd);
+		for (i = 0; i < cmd->cmd_len; ++i)
+			printk(KERN_CONT " %.2x", cmd->cmnd[i]);
+		printk(KERN_CONT "\n");
+		printk(KERN_DEBUG "use_sg=%d request_bufflen=%d request_buffer=%p\n",
+		       scsi_sg_count(cmd), scsi_bufflen(cmd), scsi_sglist(cmd));
+	}
+#endif
+
+	cmd->host_scribble = NULL;
+
+	state = (struct fsc_state *) cmd->device->host->hostdata;
+
+	if (state->request_q == NULL)
+		state->request_q = cmd;
+	else
+		state->request_qtail->host_scribble = (void *) cmd;
+	state->request_qtail = cmd;
+
+	if (state->phase == idle)
+		mac53c94_start(state);
+
+	return 0;
+}
+
+static DEF_SCSI_QCMD(mac53c94_queue)
+
+static int mac53c94_host_reset(struct scsi_cmnd *cmd)
+{
+	struct fsc_state *state = (struct fsc_state *) cmd->device->host->hostdata;
+	struct mac53c94_regs __iomem *regs = state->regs;
+	struct dbdma_regs __iomem *dma = state->dma;
+	unsigned long flags;
+
+	spin_lock_irqsave(cmd->device->host->host_lock, flags);
+
+	writel((RUN|PAUSE|FLUSH|WAKE) << 16, &dma->control);
+	writeb(CMD_SCSI_RESET, &regs->command);	/* assert RST */
+	udelay(100);			/* leave it on for a while (>= 25us) */
+	writeb(CMD_RESET, &regs->command);
+	udelay(20);
+	mac53c94_init(state);
+	writeb(CMD_NOP, &regs->command);
+
+	spin_unlock_irqrestore(cmd->device->host->host_lock, flags);
+	return SUCCESS;
+}
+
+static void mac53c94_init(struct fsc_state *state)
+{
+	struct mac53c94_regs __iomem *regs = state->regs;
+	struct dbdma_regs __iomem *dma = state->dma;
+
+	writeb(state->host->this_id | CF1_PAR_ENABLE, &regs->config1);
+	writeb(TIMO_VAL(250), &regs->sel_timeout);	/* 250ms */
+	writeb(CLKF_VAL(state->clk_freq), &regs->clk_factor);
+	writeb(CF2_FEATURE_EN, &regs->config2);
+	writeb(0, &regs->config3);
+	writeb(0, &regs->sync_period);
+	writeb(0, &regs->sync_offset);
+	(void)readb(&regs->interrupt);
+	writel((RUN|PAUSE|FLUSH|WAKE) << 16, &dma->control);
+}
+
+/*
+ * Start the next command for a 53C94.
+ * Should be called with interrupts disabled.
+ */
+static void mac53c94_start(struct fsc_state *state)
+{
+	struct scsi_cmnd *cmd;
+	struct mac53c94_regs __iomem *regs = state->regs;
+	int i;
+
+	if (state->phase != idle || state->current_req != NULL)
+		panic("inappropriate mac53c94_start (state=%p)", state);
+	if (state->request_q == NULL)
+		return;
+	state->current_req = cmd = state->request_q;
+	state->request_q = (struct scsi_cmnd *) cmd->host_scribble;
+
+	/* Off we go */
+	writeb(0, &regs->count_lo);
+	writeb(0, &regs->count_mid);
+	writeb(0, &regs->count_hi);
+	writeb(CMD_NOP + CMD_DMA_MODE, &regs->command);
+	udelay(1);
+	writeb(CMD_FLUSH, &regs->command);
+	udelay(1);
+	writeb(cmd->device->id, &regs->dest_id);
+	writeb(0, &regs->sync_period);
+	writeb(0, &regs->sync_offset);
+
+	/* load the command into the FIFO */
+	for (i = 0; i < cmd->cmd_len; ++i)
+		writeb(cmd->cmnd[i], &regs->fifo);
+
+	/* do select without ATN XXX */
+	writeb(CMD_SELECT, &regs->command);
+	state->phase = selecting;
+
+	set_dma_cmds(state, cmd);
+}
+
+static irqreturn_t do_mac53c94_interrupt(int irq, void *dev_id)
+{
+	unsigned long flags;
+	struct Scsi_Host *dev = ((struct fsc_state *) dev_id)->current_req->device->host;
+	
+	spin_lock_irqsave(dev->host_lock, flags);
+	mac53c94_interrupt(irq, dev_id);
+	spin_unlock_irqrestore(dev->host_lock, flags);
+	return IRQ_HANDLED;
+}
+
+static void mac53c94_interrupt(int irq, void *dev_id)
+{
+	struct fsc_state *state = (struct fsc_state *) dev_id;
+	struct mac53c94_regs __iomem *regs = state->regs;
+	struct dbdma_regs __iomem *dma = state->dma;
+	struct scsi_cmnd *const cmd = state->current_req;
+	struct mac53c94_cmd_priv *const mcmd = mac53c94_priv(cmd);
+	int nb, stat, seq, intr;
+	static int mac53c94_errors;
+
+	/*
+	 * Apparently, reading the interrupt register unlatches
+	 * the status and sequence step registers.
+	 */
+	seq = readb(&regs->seqstep);
+	stat = readb(&regs->status);
+	intr = readb(&regs->interrupt);
+
+#if 0
+	printk(KERN_DEBUG "mac53c94_intr, intr=%x stat=%x seq=%x phase=%d\n",
+	       intr, stat, seq, state->phase);
+#endif
+
+	if (intr & INTR_RESET) {
+		/* SCSI bus was reset */
+		printk(KERN_INFO "external SCSI bus reset detected\n");
+		writeb(CMD_NOP, &regs->command);
+		writel(RUN << 16, &dma->control);	/* stop dma */
+		cmd_done(state, DID_RESET << 16);
+		return;
+	}
+	if (intr & INTR_ILL_CMD) {
+		printk(KERN_ERR "53c94: invalid cmd, intr=%x stat=%x seq=%x phase=%d\n",
+		       intr, stat, seq, state->phase);
+		cmd_done(state, DID_ERROR << 16);
+		return;
+	}
+	if (stat & STAT_ERROR) {
+#if 0
+		/* XXX these seem to be harmless? */
+		printk("53c94: bad error, intr=%x stat=%x seq=%x phase=%d\n",
+		       intr, stat, seq, state->phase);
+#endif
+		++mac53c94_errors;
+		writeb(CMD_NOP + CMD_DMA_MODE, &regs->command);
+	}
+	if (!cmd) {
+		printk(KERN_DEBUG "53c94: interrupt with no command active?\n");
+		return;
+	}
+	if (stat & STAT_PARITY) {
+		printk(KERN_ERR "mac53c94: parity error\n");
+		cmd_done(state, DID_PARITY << 16);
+		return;
+	}
+	switch (state->phase) {
+	case selecting:
+		if (intr & INTR_DISCONNECT) {
+			/* selection timed out */
+			cmd_done(state, DID_BAD_TARGET << 16);
+			return;
+		}
+		if (intr != INTR_BUS_SERV + INTR_DONE) {
+			printk(KERN_DEBUG "got intr %x during selection\n", intr);
+			cmd_done(state, DID_ERROR << 16);
+			return;
+		}
+		if ((seq & SS_MASK) != SS_DONE) {
+			printk(KERN_DEBUG "seq step %x after command\n", seq);
+			cmd_done(state, DID_ERROR << 16);
+			return;
+		}
+		writeb(CMD_NOP, &regs->command);
+		/* set DMA controller going if any data to transfer */
+		if ((stat & (STAT_MSG|STAT_CD)) == 0
+		    && (scsi_sg_count(cmd) > 0 || scsi_bufflen(cmd))) {
+			nb = mcmd->this_residual;
+			if (nb > 0xfff0)
+				nb = 0xfff0;
+			mcmd->this_residual -= nb;
+			writeb(nb, &regs->count_lo);
+			writeb(nb >> 8, &regs->count_mid);
+			writeb(CMD_DMA_MODE + CMD_NOP, &regs->command);
+			writel(virt_to_phys(state->dma_cmds), &dma->cmdptr);
+			writel((RUN << 16) | RUN, &dma->control);
+			writeb(CMD_DMA_MODE + CMD_XFER_DATA, &regs->command);
+			state->phase = dataing;
+			break;
+		} else if ((stat & STAT_PHASE) == STAT_CD + STAT_IO) {
+			/* up to status phase already */
+			writeb(CMD_I_COMPLETE, &regs->command);
+			state->phase = completing;
+		} else {
+			printk(KERN_DEBUG "in unexpected phase %x after cmd\n",
+			       stat & STAT_PHASE);
+			cmd_done(state, DID_ERROR << 16);
+			return;
+		}
+		break;
+
+	case dataing:
+		if (intr != INTR_BUS_SERV) {
+			printk(KERN_DEBUG "got intr %x before status\n", intr);
+			cmd_done(state, DID_ERROR << 16);
+			return;
+		}
+		if (mcmd->this_residual != 0
+		    && (stat & (STAT_MSG|STAT_CD)) == 0) {
+			/* Set up the count regs to transfer more */
+			nb = mcmd->this_residual;
+			if (nb > 0xfff0)
+				nb = 0xfff0;
+			mcmd->this_residual -= nb;
+			writeb(nb, &regs->count_lo);
+			writeb(nb >> 8, &regs->count_mid);
+			writeb(CMD_DMA_MODE + CMD_NOP, &regs->command);
+			writeb(CMD_DMA_MODE + CMD_XFER_DATA, &regs->command);
+			break;
+		}
+		if ((stat & STAT_PHASE) != STAT_CD + STAT_IO) {
+			printk(KERN_DEBUG "intr %x before data xfer complete\n", intr);
+		}
+		writel(RUN << 16, &dma->control);	/* stop dma */
+		scsi_dma_unmap(cmd);
+		/* should check dma status */
+		writeb(CMD_I_COMPLETE, &regs->command);
+		state->phase = completing;
+		break;
+	case completing:
+		if (intr != INTR_DONE) {
+			printk(KERN_DEBUG "got intr %x on completion\n", intr);
+			cmd_done(state, DID_ERROR << 16);
+			return;
+		}
+		mcmd->status = readb(&regs->fifo);
+		mcmd->message = readb(&regs->fifo);
+		writeb(CMD_ACCEPT_MSG, &regs->command);
+		state->phase = busfreeing;
+		break;
+	case busfreeing:
+		if (intr != INTR_DISCONNECT) {
+			printk(KERN_DEBUG "got intr %x when expected disconnect\n", intr);
+		}
+		cmd_done(state, (DID_OK << 16) + (mcmd->message << 8) + mcmd->status);
+		break;
+	default:
+		printk(KERN_DEBUG "don't know about phase %d\n", state->phase);
+	}
+}
+
+static void cmd_done(struct fsc_state *state, int result)
+{
+	struct scsi_cmnd *cmd;
+
+	cmd = state->current_req;
+	if (cmd) {
+		cmd->result = result;
+		scsi_done(cmd);
+		state->current_req = NULL;
+	}
+	state->phase = idle;
+	mac53c94_start(state);
+}
+
+/*
+ * Set up DMA commands for transferring data.
+ */
+static void set_dma_cmds(struct fsc_state *state, struct scsi_cmnd *cmd)
+{
+	int i, dma_cmd, total, nseg;
+	struct scatterlist *scl;
+	struct dbdma_cmd *dcmds;
+	dma_addr_t dma_addr;
+	u32 dma_len;
+
+	nseg = scsi_dma_map(cmd);
+	BUG_ON(nseg < 0);
+	if (!nseg)
+		return;
+
+	dma_cmd = cmd->sc_data_direction == DMA_TO_DEVICE ?
+			OUTPUT_MORE : INPUT_MORE;
+	dcmds = state->dma_cmds;
+	total = 0;
+
+	scsi_for_each_sg(cmd, scl, nseg, i) {
+		dma_addr = sg_dma_address(scl);
+		dma_len = sg_dma_len(scl);
+		if (dma_len > 0xffff)
+			panic("mac53c94: scatterlist element >= 64k");
+		total += dma_len;
+		dcmds->req_count = cpu_to_le16(dma_len);
+		dcmds->command = cpu_to_le16(dma_cmd);
+		dcmds->phy_addr = cpu_to_le32(dma_addr);
+		dcmds->xfer_status = 0;
+		++dcmds;
+	}
+
+	dma_cmd += OUTPUT_LAST - OUTPUT_MORE;
+	dcmds[-1].command = cpu_to_le16(dma_cmd);
+	dcmds->command = cpu_to_le16(DBDMA_STOP);
+	mac53c94_priv(cmd)->this_residual = total;
+}
+
+static const struct scsi_host_template mac53c94_template = {
+	.proc_name	= "53c94",
+	.name		= "53C94",
+	.queuecommand	= mac53c94_queue,
+	.eh_host_reset_handler = mac53c94_host_reset,
+	.can_queue	= 1,
+	.this_id	= 7,
+	.sg_tablesize	= SG_ALL,
+	.max_segment_size = 65535,
+	.cmd_size	= sizeof(struct mac53c94_cmd_priv),
+};
+
+static int mac53c94_probe(struct macio_dev *mdev, const struct of_device_id *match)
+{
+	struct device_node *node = macio_get_of_node(mdev);
+	struct pci_dev *pdev = macio_get_pci_dev(mdev);
+	struct fsc_state *state;
+	struct Scsi_Host *host;
+	void *dma_cmd_space;
+	const unsigned char *clkprop;
+	int proplen, rc = -ENODEV;
+
+	if (macio_resource_count(mdev) != 2 || macio_irq_count(mdev) != 2) {
+		printk(KERN_ERR "mac53c94: expected 2 addrs and intrs"
+		       " (got %d/%d)\n",
+		       macio_resource_count(mdev), macio_irq_count(mdev));
+		return -ENODEV;
+	}
+
+	if (macio_request_resources(mdev, "mac53c94") != 0) {
+       		printk(KERN_ERR "mac53c94: unable to request memory resources");
+		return -EBUSY;
+	}
+
+       	host = scsi_host_alloc(&mac53c94_template, sizeof(struct fsc_state));
+	if (host == NULL) {
+		printk(KERN_ERR "mac53c94: couldn't register host");
+		rc = -ENOMEM;
+		goto out_release;
+	}
+
+	state = (struct fsc_state *) host->hostdata;
+	macio_set_drvdata(mdev, state);
+	state->host = host;
+	state->pdev = pdev;
+	state->mdev = mdev;
+
+	state->regs = (struct mac53c94_regs __iomem *)
+		ioremap(macio_resource_start(mdev, 0), 0x1000);
+	state->intr = macio_irq(mdev, 0);
+	state->dma = (struct dbdma_regs __iomem *)
+		ioremap(macio_resource_start(mdev, 1), 0x1000);
+	state->dmaintr = macio_irq(mdev, 1);
+	if (state->regs == NULL || state->dma == NULL) {
+		printk(KERN_ERR "mac53c94: ioremap failed for %pOF\n", node);
+		goto out_free;
+	}
+
+	clkprop = of_get_property(node, "clock-frequency", &proplen);
+       	if (clkprop == NULL || proplen != sizeof(int)) {
+       		printk(KERN_ERR "%pOF: can't get clock frequency, "
+       		       "assuming 25MHz\n", node);
+       		state->clk_freq = 25000000;
+       	} else
+       		state->clk_freq = *(int *)clkprop;
+
+       	/* Space for dma command list: +1 for stop command,
+       	 * +1 to allow for aligning.
+	 * XXX FIXME: Use DMA consistent routines
+	 */
+       	dma_cmd_space = kmalloc_objs(struct dbdma_cmd,
+					    host->sg_tablesize + 2);
+	if (!dma_cmd_space) {
+		printk(KERN_ERR "mac53c94: couldn't allocate dma "
+		       "command space for %pOF\n", node);
+		rc = -ENOMEM;
+		goto out_free;
+	}
+
+	state->dma_cmds = (struct dbdma_cmd *)DBDMA_ALIGN(dma_cmd_space);
+	memset(state->dma_cmds, 0, (host->sg_tablesize + 1)
+	       * sizeof(struct dbdma_cmd));
+	state->dma_cmd_space = dma_cmd_space;
+
+	mac53c94_init(state);
+
+	if (request_irq(state->intr, do_mac53c94_interrupt, 0, "53C94",state)) {
+		printk(KERN_ERR "mac53C94: can't get irq %d for %pOF\n",
+		       state->intr, node);
+		goto out_free_dma;
+	}
+
+	rc = scsi_add_host(host, &mdev->ofdev.dev);
+	if (rc != 0)
+		goto out_release_irq;
+
+	scsi_scan_host(host);
+	return 0;
+
+ out_release_irq:
+	free_irq(state->intr, state);
+ out_free_dma:
+	kfree(state->dma_cmd_space);
+ out_free:
+	if (state->dma != NULL)
+		iounmap(state->dma);
+	if (state->regs != NULL)
+		iounmap(state->regs);
+	scsi_host_put(host);
+ out_release:
+	macio_release_resources(mdev);
+
+	return rc;
+}
+
+static void mac53c94_remove(struct macio_dev *mdev)
+{
+	struct fsc_state *fp = (struct fsc_state *)macio_get_drvdata(mdev);
+	struct Scsi_Host *host = fp->host;
+
+	scsi_remove_host(host);
+
+	free_irq(fp->intr, fp);
+
+	if (fp->regs)
+		iounmap(fp->regs);
+	if (fp->dma)
+		iounmap(fp->dma);
+	kfree(fp->dma_cmd_space);
+
+	scsi_host_put(host);
+
+	macio_release_resources(mdev);
+}
+
+static struct of_device_id mac53c94_match[] = 
+{
+	{
+	.name 		= "53c94",
+	},
+	{},
+};
+MODULE_DEVICE_TABLE (of, mac53c94_match);
+
+static struct macio_driver mac53c94_driver = 
+{
+	.driver = {
+		.name 		= "mac53c94",
+		.owner		= THIS_MODULE,
+		.of_match_table	= mac53c94_match,
+	},
+	.probe		= mac53c94_probe,
+	.remove		= mac53c94_remove,
+};
+
+
+static int __init init_mac53c94(void)
+{
+	return macio_register_driver(&mac53c94_driver);
+}
+
+static void __exit exit_mac53c94(void)
+{
+	return macio_unregister_driver(&mac53c94_driver);
+}
+
+module_init(init_mac53c94);
+module_exit(exit_mac53c94);
+
+MODULE_DESCRIPTION("PowerMac 53c94 SCSI driver");
+MODULE_AUTHOR("Paul Mackerras <paulus@samba.org>");
+MODULE_LICENSE("GPL");