From a5f7a5bb3b7f28ba7e4fa246775b29a0e5537255 Mon Sep 17 00:00:00 2001 From: Jinke Han Date: Tue, 8 Sep 2026 15:37:42 +0800 Subject: x86/kprobes: Fix crash when probing CS CALL instructions When using eBPF to probe CS CALL instructions within a function, a crash can be triggered. The eBPF tool probes offset 257 of the __hrtimer_run_queues() function: <__hrtimer_run_queues+249>: nopl 0x0(%rax,%rax,1) <__hrtimer_run_queues+254>: mov %r14,%rdi <__hrtimer_run_queues+257>: cs call <__x86_indirect_thunk_r12> <__hrtimer_run_queues+263>: mov %eax,%r12d <__hrtimer_run_queues+266>: xchg %ax,%ax <__hrtimer_run_queues+268>: mov %r13,%rdi Which triggers this crash: BUG: unable to handle page fault for address: 00000000000f41c9 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 0 P4D 0 Oops: 0002 [#1] SMP NOPTI CPU: 1 PID: 0 Comm: swapper/1 Kdump: loaded Tainted: P RIP: 0010:__hrtimer_run_queues+0x106/0x230 Note that __hrtimer_run_queues+0x106 is __hrtimer_run_queues+262, which is at the 6th byte of the above CS CALL instruction. Since the CS CALL instruction occupies 6 bytes, the exception occurred in the middle of that call instruction. The root cause is that when using eBPF tools to probe in the middle of a function, a kprobe with INT3 is used as the underlying implementation. During single-step emulation of the original CALL instruction, int3_emulate_call() assumes that the probed CALL instruction is 5 bytes long. However, the actual CS-prefixed CALL instruction occupies 6 bytes, so it constructs an incorrect exception return address. When the CPU returns from the kprobe handler, the next instruction to be executed is at the address of the last byte of that CS CALL instruction. Coincidentally, starting from that address, the CPU fetches and decodes a completely different instruction, which ultimately triggers a kernel crash. Fix the issue by using the actual instruction length obtained from the instruction decoder when constructing the exception return address, rather than relying on the hardcoded CALL_INSN_SIZE macro. [ mingo: Refined the changelog ] Fixes: 6256e668b7af ("x86/kprobes: Use int3 instead of debug trap for single-step") Suggested-by: Masami Hiramatsu (Google) Signed-off-by: Jinke Han Signed-off-by: Ingo Molnar Reviewed-by: Masami Hiramatsu (Google) Acked-by: Yafang Shao Acked-by: Borislav Petkov Cc: Peter Zijlstra Link: https://patch.msgid.link/20260908073742.GA10517@didi-ThinkCentre-M920t-N000 --- drivers/video/console/Kconfig | 138 ++++ drivers/video/console/Makefile | 9 + drivers/video/console/dummycon.c | 159 +++++ drivers/video/console/newport_con.c | 725 +++++++++++++++++++++ drivers/video/console/sticon.c | 395 +++++++++++ drivers/video/console/vgacon.c | 1226 +++++++++++++++++++++++++++++++++++ 6 files changed, 2652 insertions(+) create mode 100644 drivers/video/console/Kconfig create mode 100644 drivers/video/console/Makefile create mode 100644 drivers/video/console/dummycon.c create mode 100644 drivers/video/console/newport_con.c create mode 100644 drivers/video/console/sticon.c create mode 100644 drivers/video/console/vgacon.c (limited to 'drivers/video/console') diff --git a/drivers/video/console/Kconfig b/drivers/video/console/Kconfig new file mode 100644 index 000000000..9f81af350 --- /dev/null +++ b/drivers/video/console/Kconfig @@ -0,0 +1,138 @@ +# SPDX-License-Identifier: GPL-2.0-only +# +# Video configuration +# + +menu "Console display driver support" + +config VGA_CONSOLE + bool "VGA text console" if EXPERT || !X86 + depends on ALPHA || X86 || \ + (ARM && ARCH_FOOTBRIDGE) || \ + (MIPS && (MIPS_MALTA || SIBYTE_BCM112X || SIBYTE_SB1250 || SIBYTE_BCM1x80 || SNI_RM)) + select APERTURE_HELPERS if (DRM || FB || VFIO_PCI_CORE) + default y + help + Saying Y here will allow you to use Linux in text mode through a + display that complies with the generic VGA standard. Virtually + everyone wants that. + + The program SVGATextMode can be used to utilize SVGA video cards to + their full potential in text mode. Download it from + . + + Say Y. + +config SGI_NEWPORT_CONSOLE + tristate "SGI Newport Console support" + depends on SGI_IP22 && HAS_IOMEM + select FONT_SUPPORT + help + Say Y here if you want the console on the Newport aka XL graphics + card of your Indy. Most people say Y here. + +config DUMMY_CONSOLE + def_bool VT || VGA_CONSOLE || FRAMEBUFFER_CONSOLE + +config DUMMY_CONSOLE_COLUMNS + int "Initial number of console screen columns" + depends on DUMMY_CONSOLE && !(ARCH_FOOTBRIDGE && VGA_CONSOLE) + default 160 if PARISC + default 80 + help + On PA-RISC, the default value is 160, which should fit a 1280x1024 + monitor. + Select 80 if you use a 640x480 resolution by default. + +config DUMMY_CONSOLE_ROWS + int "Initial number of console screen rows" + depends on DUMMY_CONSOLE && !(ARCH_FOOTBRIDGE && VGA_CONSOLE) + default 64 if PARISC + default 30 if ARM + default 25 + help + On PA-RISC, the default value is 64, which should fit a 1280x1024 + monitor. + Select 25 if you use a 640x480 resolution by default. + +config FRAMEBUFFER_CONSOLE + bool "Framebuffer Console support" + depends on FB_CORE && !UML + default DRM_FBDEV_EMULATION + select VT_HW_CONSOLE_BINDING + select CRC32 + select FONT_SUPPORT + help + Low-level framebuffer-based console driver. + +config FRAMEBUFFER_CONSOLE_LEGACY_ACCELERATION + bool "Enable legacy fbcon hardware acceleration code" + depends on FRAMEBUFFER_CONSOLE + default y if PARISC + default n + help + This option enables the fbcon (framebuffer text-based) hardware + acceleration for graphics drivers which were written for the fbdev + graphics interface. + + On modern machines, on mainstream machines (like x86-64) or when + using a modern Linux distribution those fbdev drivers usually aren't used. + So enabling this option wouldn't have any effect, which is why you want + to disable this option on such newer machines. + + If you compile this kernel for older machines which still require the + fbdev drivers, you may want to say Y. + + If unsure, select n. + +config FRAMEBUFFER_CONSOLE_DETECT_PRIMARY + bool "Map the console to the primary display device" + depends on FRAMEBUFFER_CONSOLE + default n + help + If this option is selected, the framebuffer console will + automatically select the primary display device (if the architecture + supports this feature). Otherwise, the framebuffer console will + always select the first framebuffer driver that is loaded. The latter + is the default behavior. + + You can always override the automatic selection of the primary device + by using the fbcon=map: boot option. + + If unsure, select n. + +config FRAMEBUFFER_CONSOLE_ROTATION + bool "Framebuffer Console Rotation" + depends on FRAMEBUFFER_CONSOLE + help + Enable display rotation for the framebuffer console. This is done + in software and may be significantly slower than a normally oriented + display. Note that the rotation is done at the console level only + such that other users of the framebuffer will remain normally + oriented. + +config FRAMEBUFFER_CONSOLE_DEFERRED_TAKEOVER + bool "Framebuffer Console Deferred Takeover" + depends on FB=y && FRAMEBUFFER_CONSOLE && DUMMY_CONSOLE + help + If enabled this defers the framebuffer console taking over the + console from the dummy console until the first text is displayed on + the console. This is useful in combination with the "quiet" kernel + commandline option to keep the framebuffer contents initially put up + by the firmware in place, rather then replacing the contents with a + black screen as soon as fbcon loads. + +config STI_CONSOLE + bool "STI text console" + depends on PARISC && HAS_IOMEM + select FONT_SUPPORT + select CRC32 + select STI_CORE + default y + help + The STI console is the builtin display/keyboard on HP-PARISC + machines. Say Y here to build support for it into your kernel. + The alternative is to use your primary serial port as a console. + +endmenu + diff --git a/drivers/video/console/Makefile b/drivers/video/console/Makefile new file mode 100644 index 000000000..f10006052 --- /dev/null +++ b/drivers/video/console/Makefile @@ -0,0 +1,9 @@ +# SPDX-License-Identifier: GPL-2.0 +# Makefile for the Linux graphics to console drivers. +# 5 Aug 1999, James Simmons, +# Rewritten to use lists instead of if-statements. + +obj-$(CONFIG_DUMMY_CONSOLE) += dummycon.o +obj-$(CONFIG_SGI_NEWPORT_CONSOLE) += newport_con.o +obj-$(CONFIG_STI_CONSOLE) += sticon.o +obj-$(CONFIG_VGA_CONSOLE) += vgacon.o diff --git a/drivers/video/console/dummycon.c b/drivers/video/console/dummycon.c new file mode 100644 index 000000000..7d02470f1 --- /dev/null +++ b/drivers/video/console/dummycon.c @@ -0,0 +1,159 @@ +// SPDX-License-Identifier: GPL-2.0-only +/* + * linux/drivers/video/dummycon.c -- A dummy console driver + * + * To be used if there's no other console driver (e.g. for plain VGA text) + * available, usually until fbcon takes console over. + */ + +#include +#include +#include +#include +#include +#include +#include + +/* + * Dummy console driver + */ + +#if defined(CONFIG_ARCH_FOOTBRIDGE) && defined(CONFIG_VGA_CONSOLE) +#include +#define DUMMY_COLUMNS vgacon_screen_info.orig_video_cols +#define DUMMY_ROWS vgacon_screen_info.orig_video_lines +#else +/* set by Kconfig. Use 80x25 for 640x480 and 160x64 for 1280x1024 */ +#define DUMMY_COLUMNS CONFIG_DUMMY_CONSOLE_COLUMNS +#define DUMMY_ROWS CONFIG_DUMMY_CONSOLE_ROWS +#endif + +#ifdef CONFIG_FRAMEBUFFER_CONSOLE_DEFERRED_TAKEOVER +/* These are both protected by the console_lock */ +static RAW_NOTIFIER_HEAD(dummycon_output_nh); +static bool dummycon_putc_called; + +void dummycon_register_output_notifier(struct notifier_block *nb) +{ + WARN_CONSOLE_UNLOCKED(); + + raw_notifier_chain_register(&dummycon_output_nh, nb); + + if (dummycon_putc_called) + nb->notifier_call(nb, 0, NULL); +} + +void dummycon_unregister_output_notifier(struct notifier_block *nb) +{ + WARN_CONSOLE_UNLOCKED(); + + raw_notifier_chain_unregister(&dummycon_output_nh, nb); +} + +static void dummycon_putc(struct vc_data *vc, u16 c, unsigned int y, + unsigned int x) +{ + WARN_CONSOLE_UNLOCKED(); + + dummycon_putc_called = true; + raw_notifier_call_chain(&dummycon_output_nh, 0, NULL); +} + +static void dummycon_putcs(struct vc_data *vc, const u16 *s, unsigned int count, + unsigned int ypos, unsigned int xpos) +{ + unsigned int i; + + if (!dummycon_putc_called) { + /* Ignore erases */ + for (i = 0 ; i < count; i++) { + if (s[i] != vc->vc_video_erase_char) + break; + } + if (i == count) + return; + + dummycon_putc_called = true; + } + + raw_notifier_call_chain(&dummycon_output_nh, 0, NULL); +} + +static bool dummycon_blank(struct vc_data *vc, enum vesa_blank_mode blank, + bool mode_switch) +{ + /* Redraw, so that we get putc(s) for output done while blanked */ + return true; +} + +static bool dummycon_switch(struct vc_data *vc) +{ + /* + * Redraw, so that we get putc(s) for output done while switched + * away. Informs deferred consoles to take over the display. + */ + return true; +} +#else +static void dummycon_putc(struct vc_data *vc, u16 c, unsigned int y, + unsigned int x) { } +static void dummycon_putcs(struct vc_data *vc, const u16 *s, unsigned int count, + unsigned int ypos, unsigned int xpos) { } +static bool dummycon_blank(struct vc_data *vc, enum vesa_blank_mode blank, + bool mode_switch) +{ + return false; +} +static bool dummycon_switch(struct vc_data *vc) +{ + return false; +} +#endif + +static const char *dummycon_startup(void) +{ + return "dummy device"; +} + +static void dummycon_init(struct vc_data *vc, bool init) +{ + vc->vc_can_do_color = 1; + if (init) { + vc->vc_cols = DUMMY_COLUMNS; + vc->vc_rows = DUMMY_ROWS; + } else + vc_resize(vc, DUMMY_COLUMNS, DUMMY_ROWS); +} + +static void dummycon_deinit(struct vc_data *vc) { } +static void dummycon_clear(struct vc_data *vc, unsigned int sy, unsigned int sx, + unsigned int width) { } +static void dummycon_cursor(struct vc_data *vc, bool enable) { } + +static bool dummycon_scroll(struct vc_data *vc, unsigned int top, + unsigned int bottom, enum con_scroll dir, + unsigned int lines) +{ + return false; +} + +/* + * The console `switch' structure for the dummy console + * + * Most of the operations are dummies. + */ + +const struct consw dummy_con = { + .owner = THIS_MODULE, + .con_startup = dummycon_startup, + .con_init = dummycon_init, + .con_deinit = dummycon_deinit, + .con_clear = dummycon_clear, + .con_putc = dummycon_putc, + .con_putcs = dummycon_putcs, + .con_cursor = dummycon_cursor, + .con_scroll = dummycon_scroll, + .con_switch = dummycon_switch, + .con_blank = dummycon_blank, +}; +EXPORT_SYMBOL_GPL(dummy_con); diff --git a/drivers/video/console/newport_con.c b/drivers/video/console/newport_con.c new file mode 100644 index 000000000..e88ff3a93 --- /dev/null +++ b/drivers/video/console/newport_con.c @@ -0,0 +1,725 @@ +// SPDX-License-Identifier: GPL-2.0-only +/* + * newport_con.c: Abscon for newport hardware + * + * (C) 1998 Thomas Bogendoerfer (tsbogend@alpha.franken.de) + * (C) 1999 Ulf Carlsson (ulfc@thepuffingruop.com) + * + * This driver is based on sgicons.c and cons_newport. + * + * Copyright (C) 1996 David S. Miller (davem@davemloft.net) + * Copyright (C) 1997 Miguel de Icaza (miguel@nuclecu.unam.mx) + */ +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include + +#include +#include +#include +#include + +#include