Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9e1ba4f2 authored by Ravi Bangoria's avatar Ravi Bangoria Committed by Michael Ellerman
Browse files

powerpc/kprobe: Fix oops when kprobed on 'stdu' instruction 



If we set a kprobe on a 'stdu' instruction on powerpc64, we see a kernel
OOPS:

  Bad kernel stack pointer cd93c840 at c000000000009868
  Oops: Bad kernel stack pointer, sig: 6 [#1]
  ...
  GPR00: c000001fcd93cb30 00000000cd93c840 c0000000015c5e00 00000000cd93c840
  ...
  NIP [c000000000009868] resume_kernel+0x2c/0x58
  LR [c000000000006208] program_check_common+0x108/0x180

On a 64-bit system when the user probes on a 'stdu' instruction, the kernel does
not emulate actual store in emulate_step() because it may corrupt the exception
frame. So the kernel does the actual store operation in exception return code
i.e. resume_kernel().

resume_kernel() loads the saved stack pointer from memory using lwz, which only
loads the low 32-bits of the address, causing the kernel crash.

Fix this by loading the 64-bit value instead.

Fixes: be96f633 ("powerpc: Split out instruction analysis part of emulate_step()")
Cc: stable@vger.kernel.org # v3.18+
Signed-off-by: default avatarRavi Bangoria <ravi.bangoria@linux.vnet.ibm.com>
Reviewed-by: default avatarNaveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
Reviewed-by: default avatarAnanth N Mavinakayanahalli <ananth@linux.vnet.ibm.com>
[mpe: Change log massage, add stable tag]
Signed-off-by: default avatarMichael Ellerman <mpe@ellerman.id.au>
parent 4749228f

arch/powerpc/kernel/entry_64.S

+3 −3
Original line number Diff line number Diff line
@@ -689,7 +689,7 @@ resume_kernel: 


	addi	r8,r1,INT_FRAME_SIZE	/* Get the kprobed function entry */



	lwz	r3,GPR1(r1)

	ld	r3,GPR1(r1)

	subi	r3,r3,INT_FRAME_SIZE	/* dst: Allocate a trampoline exception frame */

	mr	r4,r1			/* src:  current exception frame */

	mr	r1,r3			/* Reroute the trampoline frame to r1 */
@@ -703,8 +703,8 @@ resume_kernel: 
	addi	r6,r6,8

	bdnz	2b



	/* Do real store operation to complete stwu */

	lwz	r5,GPR1(r1)

	/* Do real store operation to complete stdu */

	ld	r5,GPR1(r1)

	std	r8,0(r5)



	/* Clear _TIF_EMULATE_STACK_STORE flag */