x86/kprobes: Fix crash when probing CS CALL instructionsgrafted

When using eBPF to probe CS CALL instructions within a function,
a crash can be triggered.

The eBPF tool probes offset 257 of the __hrtimer_run_queues()
function:

<__hrtimer_run_queues+249>:  nopl   0x0(%rax,%rax,1)
<__hrtimer_run_queues+254>:  mov    %r14,%rdi
<__hrtimer_run_queues+257>:  cs call <__x86_indirect_thunk_r12>
<__hrtimer_run_queues+263>:  mov    %eax,%r12d
<__hrtimer_run_queues+266>:  xchg   %ax,%ax
<__hrtimer_run_queues+268>:  mov    %r13,%rdi

Which triggers this crash:

  BUG: unable to handle page fault for address: 00000000000f41c9
  #PF: supervisor write access in kernel mode
  #PF: error_code(0x0002) - not-present page
  PGD 0 P4D 0
  Oops: 0002 [#1] SMP NOPTI
  CPU: 1 PID: 0 Comm: swapper/1 Kdump: loaded Tainted: P
  RIP: 0010:__hrtimer_run_queues+0x106/0x230

Note that __hrtimer_run_queues+0x106 is __hrtimer_run_queues+262, which is
at the 6th byte of the above CS CALL instruction. Since the CS CALL
instruction occupies 6 bytes, the exception occurred in the middle of that
call instruction.

The root cause is that when using eBPF tools to probe in the middle of a
function, a kprobe with INT3 is used as the underlying implementation.

During single-step emulation of the original CALL instruction,
int3_emulate_call() assumes that the probed CALL instruction is 5 bytes
long. However, the actual CS-prefixed CALL instruction occupies 6 bytes,
so it constructs an incorrect exception return address. When the CPU
returns from the kprobe handler, the next instruction to be executed is at
the address of the last byte of that CS CALL instruction. Coincidentally,
starting from that address, the CPU fetches and decodes a completely
different instruction, which ultimately triggers a kernel crash.

Fix the issue by using the actual instruction length obtained from
the instruction decoder when constructing the exception return
address, rather than relying on the hardcoded CALL_INSN_SIZE macro.

[ mingo: Refined the changelog ]

Fixes: 6256e668b7af ("x86/kprobes: Use int3 instead of debug trap for single-step")
Suggested-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: Jinke Han <jinkehan@didiglobal.com>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Reviewed-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Acked-by: Yafang Shao <laoar.shao@gmail.com>
Acked-by: Borislav Petkov <bp@alien8.de>
Cc: Peter Zijlstra <peterz@infradead.org>
Link: https://patch.msgid.link/20260908073742.GA10517@didi-ThinkCentre-M920t-N000

1 files changed, 164 insertions, 0 deletions

diff --git a/sound/soc/codecs/rt1019.h b/sound/soc/codecs/rt1019.h
new file mode 100644
index 000000000..48ba15efb
--- /dev/null
+++ b/sound/soc/codecs/rt1019.h
@@ -0,0 +1,164 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * rt1019.h  --  RT1019 ALSA SoC audio amplifier driver
+ *
+ * Copyright(c) 2021 Realtek Semiconductor Corp.
+ */
+
+#ifndef __RT1019_H__
+#define __RT1019_H__
+
+#define RT1019_DEVICE_ID_VAL			0x1019
+#define RT1019_DEVICE_ID_VAL2			0x6731
+
+#define RT1019_RESET				0x0000
+#define RT1019_IDS_CTRL				0x0011
+#define RT1019_ASEL_CTRL			0x0013
+#define RT1019_PWR_STRP_2			0x0019
+#define RT1019_BEEP_TONE			0x001b
+#define RT1019_VER_ID				0x005c
+#define RT1019_VEND_ID_1			0x005e
+#define RT1019_VEND_ID_2			0x005f
+#define RT1019_DEV_ID_1				0x0061
+#define RT1019_DEV_ID_2				0x0062
+#define RT1019_SDB_CTRL				0x0066
+#define RT1019_CLK_TREE_1			0x0100
+#define RT1019_CLK_TREE_2			0x0101
+#define RT1019_CLK_TREE_3			0x0102
+#define RT1019_PLL_1				0x0311
+#define RT1019_PLL_2				0x0312
+#define RT1019_PLL_3				0x0313
+#define RT1019_TDM_1				0x0400
+#define RT1019_TDM_2				0x0401
+#define RT1019_TDM_3				0x0402
+#define RT1019_DMIX_MONO_1			0x0504
+#define RT1019_DMIX_MONO_2			0x0505
+#define RT1019_BEEP_1				0x0b00
+#define RT1019_BEEP_2				0x0b01
+
+/* 0x0019 Power On Strap Control-2 */
+#define RT1019_AUTO_BITS_SEL_MASK		(0x1 << 5)
+#define RT1019_AUTO_BITS_SEL_AUTO		(0x1 << 5)
+#define RT1019_AUTO_BITS_SEL_MANU		(0x0 << 5)
+#define RT1019_AUTO_CLK_SEL_MASK		(0x1 << 4)
+#define RT1019_AUTO_CLK_SEL_AUTO		(0x1 << 4)
+#define RT1019_AUTO_CLK_SEL_MANU		(0x0 << 4)
+
+/* 0x0100 Clock Tree Control-1 */
+#define RT1019_CLK_SYS_PRE_SEL_MASK		(0x1 << 7)
+#define RT1019_CLK_SYS_PRE_SEL_SFT		7
+#define RT1019_CLK_SYS_PRE_SEL_BCLK		(0x0 << 7)
+#define RT1019_CLK_SYS_PRE_SEL_PLL		(0x1 << 7)
+#define RT1019_PLL_SRC_MASK				(0x1 << 4)
+#define RT1019_PLL_SRC_SFT				4
+#define RT1019_PLL_SRC_SEL_BCLK			(0x0 << 4)
+#define RT1019_PLL_SRC_SEL_RC			(0x1 << 4)
+#define RT1019_SEL_FIFO_MASK			(0x3 << 2)
+#define RT1019_SEL_FIFO_DIV1			(0x0 << 2)
+#define RT1019_SEL_FIFO_DIV2			(0x1 << 2)
+#define RT1019_SEL_FIFO_DIV4			(0x2 << 2)
+
+/* 0x0101 clock tree control-2 */
+#define RT1019_SYS_DIV_DA_FIL_MASK		(0x7 << 5)
+#define RT1019_SYS_DIV_DA_FIL_DIV1		(0x2 << 5)
+#define RT1019_SYS_DIV_DA_FIL_DIV2		(0x3 << 5)
+#define RT1019_SYS_DIV_DA_FIL_DIV4		(0x4 << 5)
+#define RT1019_SYS_DA_OSR_MASK			(0x3 << 2)
+#define RT1019_SYS_DA_OSR_DIV1			(0x0 << 2)
+#define RT1019_SYS_DA_OSR_DIV2			(0x1 << 2)
+#define RT1019_SYS_DA_OSR_DIV4			(0x2 << 2)
+#define RT1019_ASRC_256FS_MASK			0x3
+#define RT1019_ASRC_256FS_DIV1			0x0
+#define RT1019_ASRC_256FS_DIV2			0x1
+#define RT1019_ASRC_256FS_DIV4			0x2
+
+/* 0x0102 clock tree control-3 */
+#define RT1019_SEL_CLK_CAL_MASK			(0x3 << 6)
+#define RT1019_SEL_CLK_CAL_DIV1			(0x0 << 6)
+#define RT1019_SEL_CLK_CAL_DIV2			(0x1 << 6)
+#define RT1019_SEL_CLK_CAL_DIV4			(0x2 << 6)
+
+/* 0x0311 PLL-1 */
+#define RT1019_PLL_M_MASK			(0xf << 4)
+#define RT1019_PLL_M_SFT			4
+#define RT1019_PLL_M_BP_MASK		(0x1 << 1)
+#define RT1019_PLL_M_BP_SFT			1
+#define RT1019_PLL_Q_8_8_MASK		(0x1)
+
+/* 0x0312 PLL-2 */
+#define RT1019_PLL_Q_7_0_MASK		0xff
+
+/* 0x0313 PLL-3 */
+#define RT1019_PLL_K_MASK		0x1f
+
+/* 0x0400 TDM Control-1 */
+#define RT1019_TDM_BCLK_MASK		(0x1 << 6)
+#define RT1019_TDM_BCLK_NORM		(0x0 << 6)
+#define RT1019_TDM_BCLK_INV			(0x1 << 6)
+#define RT1019_TDM_CL_MASK			(0x7)
+#define RT1019_TDM_CL_8				(0x4)
+#define RT1019_TDM_CL_32			(0x3)
+#define RT1019_TDM_CL_24			(0x2)
+#define RT1019_TDM_CL_20			(0x1)
+#define RT1019_TDM_CL_16			(0x0)
+
+/* 0x0401 TDM Control-2 */
+#define RT1019_I2S_CH_TX_MASK		(0x3 << 6)
+#define RT1019_I2S_CH_TX_SFT		6
+#define RT1019_I2S_TX_2CH			(0x0 << 6)
+#define RT1019_I2S_TX_4CH			(0x1 << 6)
+#define RT1019_I2S_TX_6CH			(0x2 << 6)
+#define RT1019_I2S_TX_8CH			(0x3 << 6)
+#define RT1019_I2S_DF_MASK			(0x7 << 3)
+#define RT1019_I2S_DF_SFT			3
+#define RT1019_I2S_DF_I2S			(0x0 << 3)
+#define RT1019_I2S_DF_LEFT			(0x1 << 3)
+#define RT1019_I2S_DF_PCM_A_R		(0x2 << 3)
+#define RT1019_I2S_DF_PCM_B_R		(0x3 << 3)
+#define RT1019_I2S_DF_PCM_A_F		(0x6 << 3)
+#define RT1019_I2S_DF_PCM_B_F		(0x7 << 3)
+#define RT1019_I2S_DL_MASK			0x7
+#define RT1019_I2S_DL_SFT			0
+#define RT1019_I2S_DL_16			0x0
+#define RT1019_I2S_DL_20			0x1
+#define RT1019_I2S_DL_24			0x2
+#define RT1019_I2S_DL_32			0x3
+#define RT1019_I2S_DL_8				0x4
+
+/* TDM1 Control-3 (0x0402) */
+#define RT1019_TDM_I2S_TX_L_DAC1_1_MASK		(0x7 << 4)
+#define RT1019_TDM_I2S_TX_R_DAC1_1_MASK		0x7
+#define RT1019_TDM_I2S_TX_L_DAC1_1_SFT		4
+#define RT1019_TDM_I2S_TX_R_DAC1_1_SFT		0
+
+/* System Clock Source */
+enum {
+	RT1019_SCLK_S_BCLK,
+	RT1019_SCLK_S_PLL,
+};
+
+/* PLL1 Source */
+enum {
+	RT1019_PLL_S_BCLK,
+	RT1019_PLL_S_RC25M,
+};
+
+enum {
+	RT1019_AIF1,
+	RT1019_AIFS
+};
+
+struct rt1019_priv {
+	struct snd_soc_component *component;
+	struct regmap *regmap;
+	int sysclk;
+	int sysclk_src;
+	int lrck;
+	int bclk;
+	int pll_src;
+	int pll_in;
+	int pll_out;
+	unsigned int bclk_ratio;
+};
+
+#endif /* __RT1019_H__ */