From patchwork Tue Apr 11 05:08:13 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ravi Bangoria X-Patchwork-Id: 749334 Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from lists.ozlabs.org (lists.ozlabs.org [103.22.144.68]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 3w2FTc65BRz9sNg for ; Tue, 11 Apr 2017 15:09:24 +1000 (AEST) Received: from lists.ozlabs.org (lists.ozlabs.org [IPv6:2401:3900:2:1::3]) by lists.ozlabs.org (Postfix) with ESMTP id 3w2FTc5FnjzDqFL for ; Tue, 11 Apr 2017 15:09:24 +1000 (AEST) X-Original-To: linuxppc-dev@lists.ozlabs.org Delivered-To: linuxppc-dev@lists.ozlabs.org Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by lists.ozlabs.org (Postfix) with ESMTPS id 3w2FSS4HH9zDq5W for ; Tue, 11 Apr 2017 15:08:24 +1000 (AEST) Received: from pps.filterd (m0098393.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.16.0.20/8.16.0.20) with SMTP id v3B53nbp056092 for ; Tue, 11 Apr 2017 01:08:21 -0400 Received: from e28smtp02.in.ibm.com (e28smtp02.in.ibm.com [125.16.236.2]) by mx0a-001b2d01.pphosted.com with ESMTP id 29rmq6s362-1 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=NOT) for ; Tue, 11 Apr 2017 01:08:21 -0400 Received: from localhost by e28smtp02.in.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Tue, 11 Apr 2017 10:38:18 +0530 Received: from d28relay05.in.ibm.com (9.184.220.62) by e28smtp02.in.ibm.com (192.168.1.132) with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted; Tue, 11 Apr 2017 10:38:16 +0530 Received: from d28av04.in.ibm.com (d28av04.in.ibm.com [9.184.220.66]) by d28relay05.in.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id v3B58Arx9568380 for ; Tue, 11 Apr 2017 10:38:10 +0530 Received: from d28av04.in.ibm.com (localhost [127.0.0.1]) by d28av04.in.ibm.com (8.14.4/8.14.4/NCO v10.0 AVout) with ESMTP id v3B58EZE005086 for ; Tue, 11 Apr 2017 10:38:15 +0530 Received: from bangoria.in.ibm.com ([9.109.223.7]) by d28av04.in.ibm.com (8.14.4/8.14.4/NCO v10.0 AVin) with ESMTP id v3B58DAU005076; Tue, 11 Apr 2017 10:38:13 +0530 From: Ravi Bangoria To: mpe@ellerman.id.au Subject: [PATCH v2] ppc64/kprobe: Fix oops when kprobed on 'stdu' instruction Date: Tue, 11 Apr 2017 10:38:13 +0530 X-Mailer: git-send-email 2.1.4 X-TM-AS-MML: disable x-cbid: 17041105-0004-0000-0000-000005660594 X-IBM-AV-DETECTION: SAVI=unused REMOTE=unused XFE=unused x-cbparentid: 17041105-0005-0000-0000-000013647FD4 Message-Id: <1491887293-3815-1-git-send-email-ravi.bangoria@linux.vnet.ibm.com> X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2017-04-11_04:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 suspectscore=1 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1702020001 definitions=main-1704110045 X-BeenThere: linuxppc-dev@lists.ozlabs.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: Linux on PowerPC Developers Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: chris@distroguy.com, npiggin@gmail.com, linux-kernel@vger.kernel.org, paulus@samba.org, aneesh.kumar@linux.vnet.ibm.com, Ravi Bangoria , naveen.n.rao@linux.vnet.ibm.com, linuxppc-dev@lists.ozlabs.org, anton@samba.org, viro@zeniv.linux.org.uk Errors-To: linuxppc-dev-bounces+patchwork-incoming=ozlabs.org@lists.ozlabs.org Sender: "Linuxppc-dev" If we set a kprobe on a 'stdu' instruction on powerpc64, we see a kernel OOPS: [ 1275.165932] Bad kernel stack pointer cd93c840 at c000000000009868 [ 1275.166378] Oops: Bad kernel stack pointer, sig: 6 [#1] ... GPR00: c000001fcd93cb30 00000000cd93c840 c0000000015c5e00 00000000cd93c840 ... [ 1275.178305] NIP [c000000000009868] resume_kernel+0x2c/0x58 [ 1275.178594] LR [c000000000006208] program_check_common+0x108/0x180 Basically, on 64 bit system, when user probes on 'stdu' instruction, kernel does not emulate actual store in emulate_step itself because it may corrupt exception frame. So kernel does actual store operation in exception return code i.e. resume_kernel(). resume_kernel() loads the saved stack pointer from memory using lwz, effectively loading a corrupt (32bit) address, causing the kernel crash. Fix this by loading the 64bit value instead. Fixes: be96f63375a1 ("powerpc: Split out instruction analysis part of emulate_step()") Signed-off-by: Ravi Bangoria Reviewed-by: Naveen N. Rao Reviewed-by: Ananth N Mavinakayanahalli --- History: Commit 8e9f69371536 ("powerpc/kprobe: Don't emulate store when kprobe stwu r1") fixed exception frame corruption for 32 bit system which uses 'stwu' instruction for stack frame allocation. This commit also added code for 64 bit system but did not enabled it for 'stdu' instruction. So 'stdu' instruction on 64 bit machine was emulating actual store in emulate_step() itself until... Commit be96f63375a1 ("powerpc: Split out instruction analysis part of emulate_step()"), enabled it for 'stdu' instruction on 64 bit machine. So kprobe on 'stdu' has always been broken on powerpc64. We haven't noticed since most stdu operations were probably landing in the red zone so the exception frame never got corrupted. In that sense, this fix is needed for BE ever since load/store emulation was added. For LE, this is only getting exposed now due to my recent patch to enable load/store emulation on LE, which got merged as commit e148bd17f48b ("powerpc: Emulation support for load/store instructions on LE"). Please mark this for stable as well. Changes in v2: - Replace 'stwu' with 'stdu' in the comment. arch/powerpc/kernel/entry_64.S | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/arch/powerpc/kernel/entry_64.S b/arch/powerpc/kernel/entry_64.S index 6432d4b..767ef6d 100644 --- a/arch/powerpc/kernel/entry_64.S +++ b/arch/powerpc/kernel/entry_64.S @@ -689,7 +689,7 @@ resume_kernel: addi r8,r1,INT_FRAME_SIZE /* Get the kprobed function entry */ - lwz r3,GPR1(r1) + ld r3,GPR1(r1) subi r3,r3,INT_FRAME_SIZE /* dst: Allocate a trampoline exception frame */ mr r4,r1 /* src: current exception frame */ mr r1,r3 /* Reroute the trampoline frame to r1 */ @@ -703,8 +703,8 @@ resume_kernel: addi r6,r6,8 bdnz 2b - /* Do real store operation to complete stwu */ - lwz r5,GPR1(r1) + /* Do real store operation to complete stdu */ + ld r5,GPR1(r1) std r8,0(r5) /* Clear _TIF_EMULATE_STACK_STORE flag */