x86/kprobes: Fix crash when probing CS CALL instructionsgrafted

When using eBPF to probe CS CALL instructions within a function,
a crash can be triggered.

The eBPF tool probes offset 257 of the __hrtimer_run_queues()
function:

<__hrtimer_run_queues+249>:  nopl   0x0(%rax,%rax,1)
<__hrtimer_run_queues+254>:  mov    %r14,%rdi
<__hrtimer_run_queues+257>:  cs call <__x86_indirect_thunk_r12>
<__hrtimer_run_queues+263>:  mov    %eax,%r12d
<__hrtimer_run_queues+266>:  xchg   %ax,%ax
<__hrtimer_run_queues+268>:  mov    %r13,%rdi

Which triggers this crash:

  BUG: unable to handle page fault for address: 00000000000f41c9
  #PF: supervisor write access in kernel mode
  #PF: error_code(0x0002) - not-present page
  PGD 0 P4D 0
  Oops: 0002 [#1] SMP NOPTI
  CPU: 1 PID: 0 Comm: swapper/1 Kdump: loaded Tainted: P
  RIP: 0010:__hrtimer_run_queues+0x106/0x230

Note that __hrtimer_run_queues+0x106 is __hrtimer_run_queues+262, which is
at the 6th byte of the above CS CALL instruction. Since the CS CALL
instruction occupies 6 bytes, the exception occurred in the middle of that
call instruction.

The root cause is that when using eBPF tools to probe in the middle of a
function, a kprobe with INT3 is used as the underlying implementation.

During single-step emulation of the original CALL instruction,
int3_emulate_call() assumes that the probed CALL instruction is 5 bytes
long. However, the actual CS-prefixed CALL instruction occupies 6 bytes,
so it constructs an incorrect exception return address. When the CPU
returns from the kprobe handler, the next instruction to be executed is at
the address of the last byte of that CS CALL instruction. Coincidentally,
starting from that address, the CPU fetches and decodes a completely
different instruction, which ultimately triggers a kernel crash.

Fix the issue by using the actual instruction length obtained from
the instruction decoder when constructing the exception return
address, rather than relying on the hardcoded CALL_INSN_SIZE macro.

[ mingo: Refined the changelog ]

Fixes: 6256e668b7af ("x86/kprobes: Use int3 instead of debug trap for single-step")
Suggested-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: Jinke Han <jinkehan@didiglobal.com>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Reviewed-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Acked-by: Yafang Shao <laoar.shao@gmail.com>
Acked-by: Borislav Petkov <bp@alien8.de>
Cc: Peter Zijlstra <peterz@infradead.org>
Link: https://patch.msgid.link/20260908073742.GA10517@didi-ThinkCentre-M920t-N000

1 files changed, 226 insertions, 0 deletions

diff --git a/sound/firewire/iso-resources.c b/sound/firewire/iso-resources.c
new file mode 100644
index 000000000..4f6327922
--- /dev/null
+++ b/sound/firewire/iso-resources.c
@@ -0,0 +1,226 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * isochronous resources helper functions
+ *
+ * Copyright (c) Clemens Ladisch <clemens@ladisch.de>
+ */
+
+#include <linux/device.h>
+#include <linux/firewire.h>
+#include <linux/firewire-constants.h>
+#include <linux/export.h>
+#include <linux/jiffies.h>
+#include <linux/mutex.h>
+#include <linux/sched.h>
+#include <linux/spinlock.h>
+#include "iso-resources.h"
+
+/**
+ * fw_iso_resources_init - initializes a &struct fw_iso_resources
+ * @r: the resource manager to initialize
+ * @unit: the device unit for which the resources will be needed
+ *
+ * If the device does not support all channel numbers, change @r->channels_mask
+ * after calling this function.
+ */
+int fw_iso_resources_init(struct fw_iso_resources *r, struct fw_unit *unit)
+{
+	r->channels_mask = ~0uLL;
+	r->unit = unit;
+	mutex_init(&r->mutex);
+	r->allocated = false;
+
+	return 0;
+}
+EXPORT_SYMBOL(fw_iso_resources_init);
+
+/**
+ * fw_iso_resources_destroy - destroy a resource manager
+ * @r: the resource manager that is no longer needed
+ */
+void fw_iso_resources_destroy(struct fw_iso_resources *r)
+{
+	WARN_ON(r->allocated);
+	mutex_destroy(&r->mutex);
+}
+EXPORT_SYMBOL(fw_iso_resources_destroy);
+
+static unsigned int packet_bandwidth(unsigned int max_payload_bytes, int speed)
+{
+	unsigned int bytes, s400_bytes;
+
+	/* iso packets have three header quadlets and quadlet-aligned payload */
+	bytes = 3 * 4 + ALIGN(max_payload_bytes, 4);
+
+	/* convert to bandwidth units (quadlets at S1600 = bytes at S400) */
+	if (speed <= SCODE_400)
+		s400_bytes = bytes * (1 << (SCODE_400 - speed));
+	else
+		s400_bytes = DIV_ROUND_UP(bytes, 1 << (speed - SCODE_400));
+
+	return s400_bytes;
+}
+
+static int current_bandwidth_overhead(struct fw_card *card)
+{
+	/*
+	 * Under the usual pessimistic assumption (cable length 4.5 m), the
+	 * isochronous overhead for N cables is 1.797 µs + N * 0.494 µs, or
+	 * 88.3 + N * 24.3 in bandwidth units.
+	 *
+	 * The calculation below tries to deduce N from the current gap count.
+	 * If the gap count has been optimized by measuring the actual packet
+	 * transmission time, this derived overhead should be near the actual
+	 * overhead as well.
+	 */
+	return card->gap_count < 63 ? card->gap_count * 97 / 10 + 89 : 512;
+}
+
+static int wait_isoch_resource_delay_after_bus_reset(struct fw_card *card)
+{
+	for (;;) {
+		s64 delay = (card->reset_jiffies + HZ) - get_jiffies_64();
+		if (delay <= 0)
+			return 0;
+		if (schedule_timeout_interruptible(delay) > 0)
+			return -ERESTARTSYS;
+	}
+}
+
+/**
+ * fw_iso_resources_allocate - allocate isochronous channel and bandwidth
+ * @r: the resource manager
+ * @max_payload_bytes: the amount of data (including CIP headers) per packet
+ * @speed: the speed (e.g., SCODE_400) at which the packets will be sent
+ *
+ * This function allocates one isochronous channel and enough bandwidth for the
+ * specified packet size.
+ *
+ * Returns the channel number that the caller must use for streaming, or
+ * a negative error code.  Due to potentionally long delays, this function is
+ * interruptible and can return -ERESTARTSYS.  On success, the caller is
+ * responsible for calling fw_iso_resources_update() on bus resets, and
+ * fw_iso_resources_free() when the resources are not longer needed.
+ */
+int fw_iso_resources_allocate(struct fw_iso_resources *r,
+			      unsigned int max_payload_bytes, int speed)
+{
+	struct fw_card *card = fw_parent_device(r->unit)->card;
+	int bandwidth, channel, err;
+
+	if (WARN_ON(r->allocated))
+		return -EBADFD;
+
+	r->bandwidth = packet_bandwidth(max_payload_bytes, speed);
+
+retry_after_bus_reset:
+	scoped_guard(spinlock_irq, &card->lock) {
+		r->generation = card->generation;
+		r->bandwidth_overhead = current_bandwidth_overhead(card);
+	}
+
+	err = wait_isoch_resource_delay_after_bus_reset(card);
+	if (err < 0)
+		return err;
+
+	scoped_guard(mutex, &r->mutex) {
+		bandwidth = r->bandwidth + r->bandwidth_overhead;
+		fw_iso_resource_manage(card, r->generation, r->channels_mask,
+				       &channel, &bandwidth, true);
+		if (channel == -EAGAIN)
+			goto retry_after_bus_reset;
+		if (channel >= 0) {
+			r->channel = channel;
+			r->allocated = true;
+		} else {
+			if (channel == -EBUSY)
+				dev_err(&r->unit->device,
+					"isochronous resources exhausted\n");
+			else
+				dev_err(&r->unit->device,
+					"isochronous resource allocation failed\n");
+		}
+	}
+
+	return channel;
+}
+EXPORT_SYMBOL(fw_iso_resources_allocate);
+
+/**
+ * fw_iso_resources_update - update resource allocations after a bus reset
+ * @r: the resource manager
+ *
+ * This function must be called from the driver's .update handler to reallocate
+ * any resources that were allocated before the bus reset.  It is safe to call
+ * this function if no resources are currently allocated.
+ *
+ * Returns a negative error code on failure.  If this happens, the caller must
+ * stop streaming.
+ */
+int fw_iso_resources_update(struct fw_iso_resources *r)
+{
+	struct fw_card *card = fw_parent_device(r->unit)->card;
+	int bandwidth, channel;
+
+	guard(mutex)(&r->mutex);
+
+	if (!r->allocated)
+		return 0;
+
+	scoped_guard(spinlock_irq, &card->lock) {
+		r->generation = card->generation;
+		r->bandwidth_overhead = current_bandwidth_overhead(card);
+	}
+
+	bandwidth = r->bandwidth + r->bandwidth_overhead;
+
+	fw_iso_resource_manage(card, r->generation, 1uLL << r->channel,
+			       &channel, &bandwidth, true);
+	/*
+	 * When another bus reset happens, pretend that the allocation
+	 * succeeded; we will try again for the new generation later.
+	 */
+	if (channel < 0 && channel != -EAGAIN) {
+		r->allocated = false;
+		if (channel == -EBUSY)
+			dev_err(&r->unit->device,
+				"isochronous resources exhausted\n");
+		else
+			dev_err(&r->unit->device,
+				"isochronous resource allocation failed\n");
+	}
+
+	return channel;
+}
+EXPORT_SYMBOL(fw_iso_resources_update);
+
+/**
+ * fw_iso_resources_free - frees allocated resources
+ * @r: the resource manager
+ *
+ * This function deallocates the channel and bandwidth, if allocated.
+ */
+void fw_iso_resources_free(struct fw_iso_resources *r)
+{
+	struct fw_card *card;
+	int bandwidth, channel;
+
+	/* Not initialized. */
+	if (r->unit == NULL)
+		return;
+	card = fw_parent_device(r->unit)->card;
+
+	guard(mutex)(&r->mutex);
+
+	if (r->allocated) {
+		bandwidth = r->bandwidth + r->bandwidth_overhead;
+		fw_iso_resource_manage(card, r->generation, 1uLL << r->channel,
+				       &channel, &bandwidth, false);
+		if (channel < 0)
+			dev_err(&r->unit->device,
+				"isochronous resource deallocation failed\n");
+
+		r->allocated = false;
+	}
+}
+EXPORT_SYMBOL(fw_iso_resources_free);