x86/kprobes: Fix crash when probing CS CALL instructionsgrafted

When using eBPF to probe CS CALL instructions within a function,
a crash can be triggered.

The eBPF tool probes offset 257 of the __hrtimer_run_queues()
function:

<__hrtimer_run_queues+249>:  nopl   0x0(%rax,%rax,1)
<__hrtimer_run_queues+254>:  mov    %r14,%rdi
<__hrtimer_run_queues+257>:  cs call <__x86_indirect_thunk_r12>
<__hrtimer_run_queues+263>:  mov    %eax,%r12d
<__hrtimer_run_queues+266>:  xchg   %ax,%ax
<__hrtimer_run_queues+268>:  mov    %r13,%rdi

Which triggers this crash:

  BUG: unable to handle page fault for address: 00000000000f41c9
  #PF: supervisor write access in kernel mode
  #PF: error_code(0x0002) - not-present page
  PGD 0 P4D 0
  Oops: 0002 [#1] SMP NOPTI
  CPU: 1 PID: 0 Comm: swapper/1 Kdump: loaded Tainted: P
  RIP: 0010:__hrtimer_run_queues+0x106/0x230

Note that __hrtimer_run_queues+0x106 is __hrtimer_run_queues+262, which is
at the 6th byte of the above CS CALL instruction. Since the CS CALL
instruction occupies 6 bytes, the exception occurred in the middle of that
call instruction.

The root cause is that when using eBPF tools to probe in the middle of a
function, a kprobe with INT3 is used as the underlying implementation.

During single-step emulation of the original CALL instruction,
int3_emulate_call() assumes that the probed CALL instruction is 5 bytes
long. However, the actual CS-prefixed CALL instruction occupies 6 bytes,
so it constructs an incorrect exception return address. When the CPU
returns from the kprobe handler, the next instruction to be executed is at
the address of the last byte of that CS CALL instruction. Coincidentally,
starting from that address, the CPU fetches and decodes a completely
different instruction, which ultimately triggers a kernel crash.

Fix the issue by using the actual instruction length obtained from
the instruction decoder when constructing the exception return
address, rather than relying on the hardcoded CALL_INSN_SIZE macro.

[ mingo: Refined the changelog ]

Fixes: 6256e668b7af ("x86/kprobes: Use int3 instead of debug trap for single-step")
Suggested-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: Jinke Han <jinkehan@didiglobal.com>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Reviewed-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Acked-by: Yafang Shao <laoar.shao@gmail.com>
Acked-by: Borislav Petkov <bp@alien8.de>
Cc: Peter Zijlstra <peterz@infradead.org>
Link: https://patch.msgid.link/20260908073742.GA10517@didi-ThinkCentre-M920t-N000

1 files changed, 280 insertions, 0 deletions

diff --git a/fs/isofs/dir.c b/fs/isofs/dir.c
new file mode 100644
index 000000000..c7ca7603e
--- /dev/null
+++ b/fs/isofs/dir.c
@@ -0,0 +1,280 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ *  linux/fs/isofs/dir.c
+ *
+ *  (C) 1992, 1993, 1994  Eric Youngdale Modified for ISO 9660 filesystem.
+ *
+ *  (C) 1991  Linus Torvalds - minix filesystem
+ *
+ *  Steve Beynon		       : Missing last directory entries fixed
+ *  (stephen@askone.demon.co.uk)      : 21st June 1996
+ *
+ *  isofs directory handling functions
+ */
+#include <linux/gfp.h>
+#include <linux/filelock.h>
+#include <linux/slab.h>
+#include "isofs.h"
+#include <linux/fileattr.h>
+
+int isofs_name_translate(struct iso_directory_record *de, char *new, struct inode *inode)
+{
+	char * old = de->name;
+	int len = de->name_len[0];
+	int i;
+
+	for (i = 0; i < len; i++) {
+		unsigned char c = old[i];
+		if (!c)
+			break;
+
+		if (c >= 'A' && c <= 'Z')
+			c |= 0x20;	/* lower case */
+
+		/* Drop trailing '.;1' (ISO 9660:1988 7.5.1 requires period) */
+		if (c == '.' && i == len - 3 && old[i + 1] == ';' && old[i + 2] == '1')
+			break;
+
+		/* Drop trailing ';1' */
+		if (c == ';' && i == len - 2 && old[i + 1] == '1')
+			break;
+
+		/* Convert remaining ';' to '.' */
+		/* Also '/' to '.' (broken Acorn-generated ISO9660 images) */
+		if (c == ';' || c == '/')
+			c = '.';
+
+		new[i] = c;
+	}
+	return i;
+}
+
+/* Acorn extensions written by Matthew Wilcox <willy@infradead.org> 1998 */
+int get_acorn_filename(struct iso_directory_record *de,
+			    char *retname, struct inode *inode)
+{
+	int std;
+	unsigned char *chr;
+	int retnamlen = isofs_name_translate(de, retname, inode);
+
+	if (retnamlen == 0)
+		return 0;
+	std = sizeof(struct iso_directory_record) + de->name_len[0];
+	if (std & 1)
+		std++;
+	if (de->length[0] - std != 32)
+		return retnamlen;
+	chr = ((unsigned char *) de) + std;
+	if (strncmp(chr, "ARCHIMEDES", 10))
+		return retnamlen;
+	if ((*retname == '_') && ((chr[19] & 1) == 1))
+		*retname = '!';
+	if (((de->flags[0] & 2) == 0) && (chr[13] == 0xff)
+		&& ((chr[12] & 0xf0) == 0xf0)) {
+		retname[retnamlen] = ',';
+		sprintf(retname+retnamlen+1, "%3.3x",
+			((chr[12] & 0xf) << 8) | chr[11]);
+		retnamlen += 4;
+	}
+	return retnamlen;
+}
+
+/*
+ * This should _really_ be cleaned up some day..
+ */
+static int do_isofs_readdir(struct inode *inode, struct file *file,
+		struct dir_context *ctx,
+		char *tmpname)
+{
+	unsigned long bufsize = ISOFS_BUFFER_SIZE(inode);
+	unsigned char bufbits = ISOFS_BUFFER_BITS(inode);
+	unsigned long block, offset, block_saved, offset_saved;
+	unsigned long inode_number = 0;	/* Quiet GCC */
+	struct buffer_head *bh = NULL;
+	int len;
+	int map;
+	int first_de = 1;
+	char *p = NULL;		/* Quiet GCC */
+	struct iso_directory_record *de;
+	struct isofs_sb_info *sbi = ISOFS_SB(inode->i_sb);
+
+	offset = ctx->pos & (bufsize - 1);
+	block = ctx->pos >> bufbits;
+
+	while (ctx->pos < inode->i_size) {
+		int de_len;
+
+		if (!bh) {
+			bh = isofs_bread(inode, block);
+			if (!bh)
+				return 0;
+		}
+
+		de = (struct iso_directory_record *) (bh->b_data + offset);
+
+		de_len = *(unsigned char *)de;
+
+		/*
+		 * If the length byte is zero, we should move on to the next
+		 * CDROM sector.  If we are at the end of the directory, we
+		 * kick out of the while loop.
+		 */
+
+		if (de_len == 0) {
+			brelse(bh);
+			bh = NULL;
+			ctx->pos = (ctx->pos + ISOFS_BLOCK_SIZE) & ~(ISOFS_BLOCK_SIZE - 1);
+			block = ctx->pos >> bufbits;
+			offset = 0;
+			continue;
+		}
+
+		block_saved = block;
+		offset_saved = offset;
+		offset += de_len;
+
+		if (!isofs_dir_record_valid(de, offset_saved, bufsize)) {
+			printk(KERN_NOTICE "iso9660: Corrupted directory entry"
+			       " in block %lu of inode %llu\n", block,
+			       inode->i_ino);
+			brelse(bh);
+			return -EIO;
+		}
+
+		if (first_de) {
+			isofs_normalize_block_and_offset(de,
+							&block_saved,
+							&offset_saved);
+			inode_number = isofs_get_ino(block_saved,
+							offset_saved, bufbits);
+		}
+
+		if (de->flags[-sbi->s_high_sierra] & 0x80) {
+			first_de = 0;
+			ctx->pos += de_len;
+			continue;
+		}
+		first_de = 1;
+
+		/* Handle the case of the '.' directory */
+		if (de->name_len[0] == 1 && de->name[0] == 0) {
+			if (!dir_emit_dot(file, ctx))
+				break;
+			ctx->pos += de_len;
+			continue;
+		}
+
+		len = 0;
+
+		/* Handle the case of the '..' directory */
+		if (de->name_len[0] == 1 && de->name[0] == 1) {
+			if (!dir_emit_dotdot(file, ctx))
+				break;
+			ctx->pos += de_len;
+			continue;
+		}
+
+		/* Handle everything else.  Do name translation if there
+		   is no Rock Ridge NM field. */
+
+		/*
+		 * Do not report hidden files if so instructed, or associated
+		 * files unless instructed to do so
+		 */
+		if ((sbi->s_hide && (de->flags[-sbi->s_high_sierra] & 1)) ||
+		    (!sbi->s_showassoc &&
+				(de->flags[-sbi->s_high_sierra] & 4))) {
+			ctx->pos += de_len;
+			continue;
+		}
+
+		map = 1;
+		if (sbi->s_rock) {
+			len = get_rock_ridge_filename(de, tmpname, inode);
+			if (len != 0) {		/* may be -1 */
+				p = tmpname;
+				map = 0;
+			}
+		}
+		if (map) {
+#ifdef CONFIG_JOLIET
+			if (sbi->s_joliet_level) {
+				len = get_joliet_filename(de, tmpname, inode);
+				p = tmpname;
+			} else
+#endif
+			if (sbi->s_mapping == 'a') {
+				len = get_acorn_filename(de, tmpname, inode);
+				p = tmpname;
+			} else
+			if (sbi->s_mapping == 'n') {
+				len = isofs_name_translate(de, tmpname, inode);
+				p = tmpname;
+			} else {
+				p = de->name;
+				len = de->name_len[0];
+			}
+		}
+		if (len > 0) {
+			if (!dir_emit(ctx, p, len, inode_number, DT_UNKNOWN))
+				break;
+		}
+		ctx->pos += de_len;
+	}
+	if (bh)
+		brelse(bh);
+	return 0;
+}
+
+/*
+ * Handle allocation of temporary space for name translation and
+ * handling split directory entries.. The real work is done by
+ * "do_isofs_readdir()".
+ */
+static int isofs_readdir(struct file *file, struct dir_context *ctx)
+{
+	int result;
+	char *tmpname;
+	struct inode *inode = file_inode(file);
+
+	tmpname = kmalloc(1024, GFP_KERNEL);
+	if (tmpname == NULL)
+		return -ENOMEM;
+
+	result = do_isofs_readdir(inode, file, ctx, tmpname);
+
+	kfree(tmpname);
+	return result;
+}
+
+int isofs_fileattr_get(struct dentry *dentry, struct file_kattr *fa)
+{
+	struct isofs_sb_info *sbi = ISOFS_SB(dentry->d_sb);
+
+	if (sbi->s_check == 'r') {
+		fa->fsx_xflags |= FS_XFLAG_CASEFOLD;
+		fa->flags |= FS_CASEFOLD_FL;
+	}
+	if (!sbi->s_joliet_level && !sbi->s_rock &&
+	    (sbi->s_mapping == 'n' || sbi->s_mapping == 'a'))
+		fa->fsx_xflags |= FS_XFLAG_CASENONPRESERVING;
+	return 0;
+}
+
+const struct file_operations isofs_dir_operations =
+{
+	.llseek = generic_file_llseek,
+	.read = generic_read_dir,
+	.iterate_shared = isofs_readdir,
+	.setlease = generic_setlease,
+};
+
+/*
+ * directories can handle most operations...
+ */
+const struct inode_operations isofs_dir_inode_operations =
+{
+	.lookup = isofs_lookup,
+	.fileattr_get = isofs_fileattr_get,
+};
+