From a5f7a5bb3b7f28ba7e4fa246775b29a0e5537255 Mon Sep 17 00:00:00 2001 From: Jinke Han Date: Tue, 8 Sep 2026 15:37:42 +0800 Subject: x86/kprobes: Fix crash when probing CS CALL instructions When using eBPF to probe CS CALL instructions within a function, a crash can be triggered. The eBPF tool probes offset 257 of the __hrtimer_run_queues() function: <__hrtimer_run_queues+249>: nopl 0x0(%rax,%rax,1) <__hrtimer_run_queues+254>: mov %r14,%rdi <__hrtimer_run_queues+257>: cs call <__x86_indirect_thunk_r12> <__hrtimer_run_queues+263>: mov %eax,%r12d <__hrtimer_run_queues+266>: xchg %ax,%ax <__hrtimer_run_queues+268>: mov %r13,%rdi Which triggers this crash: BUG: unable to handle page fault for address: 00000000000f41c9 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 0 P4D 0 Oops: 0002 [#1] SMP NOPTI CPU: 1 PID: 0 Comm: swapper/1 Kdump: loaded Tainted: P RIP: 0010:__hrtimer_run_queues+0x106/0x230 Note that __hrtimer_run_queues+0x106 is __hrtimer_run_queues+262, which is at the 6th byte of the above CS CALL instruction. Since the CS CALL instruction occupies 6 bytes, the exception occurred in the middle of that call instruction. The root cause is that when using eBPF tools to probe in the middle of a function, a kprobe with INT3 is used as the underlying implementation. During single-step emulation of the original CALL instruction, int3_emulate_call() assumes that the probed CALL instruction is 5 bytes long. However, the actual CS-prefixed CALL instruction occupies 6 bytes, so it constructs an incorrect exception return address. When the CPU returns from the kprobe handler, the next instruction to be executed is at the address of the last byte of that CS CALL instruction. Coincidentally, starting from that address, the CPU fetches and decodes a completely different instruction, which ultimately triggers a kernel crash. Fix the issue by using the actual instruction length obtained from the instruction decoder when constructing the exception return address, rather than relying on the hardcoded CALL_INSN_SIZE macro. [ mingo: Refined the changelog ] Fixes: 6256e668b7af ("x86/kprobes: Use int3 instead of debug trap for single-step") Suggested-by: Masami Hiramatsu (Google) Signed-off-by: Jinke Han Signed-off-by: Ingo Molnar Reviewed-by: Masami Hiramatsu (Google) Acked-by: Yafang Shao Acked-by: Borislav Petkov Cc: Peter Zijlstra Link: https://patch.msgid.link/20260908073742.GA10517@didi-ThinkCentre-M920t-N000 --- drivers/net/can/Kconfig | 271 ++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 271 insertions(+) create mode 100644 drivers/net/can/Kconfig (limited to 'drivers/net/can/Kconfig') diff --git a/drivers/net/can/Kconfig b/drivers/net/can/Kconfig new file mode 100644 index 000000000..a8fad6fe5 --- /dev/null +++ b/drivers/net/can/Kconfig @@ -0,0 +1,271 @@ +# SPDX-License-Identifier: GPL-2.0-only + +menuconfig CAN_DEV + tristate "CAN Device Drivers" + default y + depends on CAN + help + Controller Area Network (CAN) is serial communications protocol up to + 1Mbit/s for its original release (now known as Classical CAN) and up + to 8Mbit/s for the more recent CAN with Flexible Data-Rate + (CAN-FD). The CAN bus was originally mainly for automotive, but is now + widely used in marine (NMEA2000), industrial, and medical + applications. More information on the CAN network protocol family + PF_CAN is contained in . + + This section contains all the CAN(-FD) device drivers including the + virtual ones. If you own such devices or plan to use the virtual CAN + interfaces to develop applications, say Y here. + + To compile as a module, choose M here: the module will be called + can-dev. + +if CAN_DEV + +config CAN_VCAN + tristate "Virtual Local CAN Interface (vcan)" + help + Similar to the network loopback devices, vcan offers a + virtual local CAN interface. + + This driver can also be built as a module. If so, the module + will be called vcan. + +config CAN_VXCAN + tristate "Virtual CAN Tunnel (vxcan)" + help + Similar to the virtual ethernet driver veth, vxcan implements a + local CAN traffic tunnel between two virtual CAN network devices. + When creating a vxcan, two vxcan devices are created as pair. + When one end receives the packet it appears on its pair and vice + versa. The vxcan can be used for cross namespace communication. + + To have a clean start in each namespace the CAN GW hop counter is + set to zero. + + This driver can also be built as a module. If so, the module + will be called vxcan. + +config CAN_NETLINK + bool "CAN device drivers with Netlink support" + default y + help + Enables the common framework for CAN device drivers. This is the + standard library and provides features for the Netlink interface such + as bittiming validation, support of CAN error states, device restart + and others. + + The additional features selected by this option will be added to the + can-dev module. + + This is required by all platform and hardware CAN drivers. If you + plan to use such devices or if unsure, say Y. + +if CAN_NETLINK + +config CAN_CALC_BITTIMING + bool "CAN bit-timing calculation" + default y + help + If enabled, CAN bit-timing parameters will be calculated for the + bit-rate specified via Netlink argument "bitrate" when the device + get started. This works fine for the most common CAN controllers + with standard bit-rates but may fail for exotic bit-rates or CAN + source clock frequencies. Disabling saves some space, but then the + bit-timing parameters must be specified directly using the Netlink + arguments "tq", "prop_seg", "phase_seg1", "phase_seg2" and "sjw". + + The additional features selected by this option will be added to the + can-dev module. + + If unsure, say Y. + +config CAN_RX_OFFLOAD + bool + +config CAN_AT91 + tristate "Atmel AT91 onchip CAN controller" + depends on (ARCH_AT91 || COMPILE_TEST) && HAS_IOMEM + select CAN_RX_OFFLOAD + help + This is a driver for the SoC CAN controller in Atmel's AT91SAM9263 + and AT91SAM9X5 processors. + +config CAN_BXCAN + tristate "STM32 Basic Extended CAN (bxCAN) devices" + depends on ARCH_STM32 || COMPILE_TEST + depends on HAS_IOMEM + select CAN_RX_OFFLOAD + help + Say yes here to build support for the STMicroelectronics STM32 basic + extended CAN Controller (bxCAN). + + This driver can also be built as a module. If so, the module + will be called bxcan. + +config CAN_CAN327 + tristate "Serial / USB serial ELM327 based OBD-II Interfaces (can327)" + depends on TTY + select CAN_RX_OFFLOAD + help + CAN driver for several 'low cost' OBD-II interfaces based on the + ELM327 OBD-II interpreter chip. + + This is a best effort driver - the ELM327 interface was never + designed to be used as a standalone CAN interface. However, it can + still be used for simple request-response protocols (such as OBD II), + and to monitor broadcast messages on a bus (such as in a vehicle). + + Please refer to the documentation for information on how to use it: + Documentation/networking/device_drivers/can/can327.rst + + If this driver is built as a module, it will be called can327. + +config CAN_DUMMY + tristate "Dummy CAN" + help + A dummy CAN module supporting Classical CAN, CAN FD and CAN XL. It + exposes bittiming values which can be configured through the netlink + interface. + + The module will simply echo any frame sent to it. If debug messages + are activated, it prints all the CAN bittiming information in the + kernel log. Aside from that it does nothing. + + This is convenient for testing the CAN netlink interface. Most of the + users will never need this. If unsure, say NO. + + To compile this driver as a module, choose M here: the module will be + called dummy-can. + +config CAN_FLEXCAN + tristate "Support for Freescale FLEXCAN based chips" + depends on OF || COLDFIRE || COMPILE_TEST + depends on HAS_IOMEM + select CAN_RX_OFFLOAD + help + Say Y here if you want to support for Freescale FlexCAN. + +config CAN_GRCAN + tristate "Aeroflex Gaisler GRCAN and GRHCAN CAN devices" + depends on OF && HAS_DMA && HAS_IOMEM + help + Say Y here if you want to use Aeroflex Gaisler GRCAN or GRHCAN. + Note that the driver supports little endian, even though little + endian syntheses of the cores would need some modifications on + the hardware level to work. + +config CAN_JANZ_ICAN3 + tristate "Janz VMOD-ICAN3 Intelligent CAN controller" + depends on MFD_JANZ_CMODIO + help + Driver for Janz VMOD-ICAN3 Intelligent CAN controller module, which + connects to a MODULbus carrier board. + + This driver can also be built as a module. If so, the module will be + called janz-ican3.ko. + +config CAN_KVASER_PCIEFD + depends on PCI + tristate "Kvaser PCIe FD cards" + select NET_DEVLINK + help + This is a driver for the Kvaser PCI Express CAN FD family. + + Supported devices: + Kvaser PCIEcan 4xHS + Kvaser PCIEcan 2xHS v2 + Kvaser PCIEcan HS v2 + Kvaser PCIEcan 1xCAN v3 + Kvaser PCIEcan 2xCAN v3 + Kvaser PCIEcan 4xCAN v2 + Kvaser Mini PCI Express HS v2 + Kvaser Mini PCI Express 2xHS v2 + Kvaser Mini PCI Express 1xCAN v3 + Kvaser Mini PCI Express 2xCAN v3 + Kvaser M.2 PCIe 4xCAN + Kvaser PCIe 8xCAN + +config CAN_SLCAN + tristate "Serial / USB serial CAN Adaptors (slcan)" + depends on TTY + help + CAN driver for several 'low cost' CAN interfaces that are attached + via serial lines or via USB-to-serial adapters using the LAWICEL + ASCII protocol. The driver implements the tty linediscipline N_SLCAN. + + As only the sending and receiving of CAN frames is implemented, this + driver should work with the (serial/USB) CAN hardware from: + www.canusb.com / www.can232.com / www.mictronics.de / www.canhack.de + + Userspace tools to attach the SLCAN line discipline (slcan_attach, + slcand) can be found in the can-utils at the linux-can project, see + https://github.com/linux-can/can-utils for details. + + This driver can also be built as a module. If so, the module + will be called slcan. + +config CAN_SUN4I + tristate "Allwinner A10 CAN controller" + depends on MACH_SUN4I || MACH_SUN7I || (RISCV && ARCH_SUNXI) || COMPILE_TEST + help + Say Y here if you want to use CAN controller found on Allwinner + A10/A20/D1 SoCs. + + To compile this driver as a module, choose M here: the module will + be called sun4i_can. + +config CAN_TI_HECC + depends on ARM || COMPILE_TEST + tristate "TI High End CAN Controller" + select CAN_RX_OFFLOAD + help + Driver for TI HECC (High End CAN Controller) module found on many + TI devices. The device specifications are available from www.ti.com + +config CAN_VIRTIO_CAN + depends on VIRTIO + tristate "Virtio CAN device support" + default n + help + Say Y here if you want to support for Virtio CAN. + + To compile this driver as a module, choose M here: the + module will be called virtio-can. + + If unsure, say N. + +config CAN_XILINXCAN + tristate "Xilinx CAN" + depends on ARCH_ZYNQ || ARM64 || MICROBLAZE || COMPILE_TEST + depends on COMMON_CLK && HAS_IOMEM + help + Xilinx CAN driver. This driver supports both soft AXI CAN IP and + Zynq CANPS IP. + +source "drivers/net/can/c_can/Kconfig" +source "drivers/net/can/cc770/Kconfig" +source "drivers/net/can/ctucanfd/Kconfig" +source "drivers/net/can/esd/Kconfig" +source "drivers/net/can/ifi_canfd/Kconfig" +source "drivers/net/can/m_can/Kconfig" +source "drivers/net/can/mscan/Kconfig" +source "drivers/net/can/peak_canfd/Kconfig" +source "drivers/net/can/rcar/Kconfig" +source "drivers/net/can/rockchip/Kconfig" +source "drivers/net/can/sja1000/Kconfig" +source "drivers/net/can/softing/Kconfig" +source "drivers/net/can/spi/Kconfig" +source "drivers/net/can/usb/Kconfig" + +endif #CAN_NETLINK + +config CAN_DEBUG_DEVICES + bool "CAN devices debugging messages" + help + Say Y here if you want the CAN device drivers to produce a bunch of + debug messages to the system log. Select this if you are having + a problem with CAN support and want to see more of what is going + on. + +endif #CAN_DEV -- cgit v1.3.1