Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit deac66ae authored by Keshavamurthy Anil S's avatar Keshavamurthy Anil S Committed by Linus Torvalds
Browse files

[PATCH] kprobes: fix bug when probed on task and isr functions 



This patch fixes a race condition where in system used to hang or sometime
crash within minutes when kprobes are inserted on ISR routine and a task
routine.

The fix has been stress tested on i386, ia64, pp64 and on x86_64.  To
reproduce the problem insert kprobes on schedule() and do_IRQ() functions
and you should see hang or system crash.

Signed-off-by: default avatarAnil S Keshavamurthy <anil.s.keshavamurthy@intel.com>
Signed-off-by: default avatarAnanth N Mavinakayanahalli <ananth@in.ibm.com>
Acked-by: default avatarPrasanna S Panchamukhi <prasanna@in.ibm.com>
Signed-off-by: default avatarAndrew Morton <akpm@osdl.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@osdl.org>
parent bce06494

arch/i386/kernel/kprobes.c

+2 −1
Original line number Diff line number Diff line
@@ -177,7 +177,8 @@ static int __kprobes kprobe_handler(struct pt_regs *regs) 
		   Disarm the probe we just hit, and ignore it. */

		p = get_kprobe(addr);

		if (p) {

			if (kprobe_status == KPROBE_HIT_SS) {

			if (kprobe_status == KPROBE_HIT_SS &&

				*p->ainsn.insn == BREAKPOINT_INSTRUCTION) {

				regs->eflags &= ~TF_MASK;

				regs->eflags |= kprobe_saved_eflags;

				unlock_kprobes();

arch/ia64/kernel/kprobes.c

+19 −3
Original line number Diff line number Diff line
@@ -95,6 +95,17 @@ static void __kprobes update_kprobe_inst_flag(uint template, uint slot, 
	p->ainsn.inst_flag = 0;

	p->ainsn.target_br_reg = 0;



	/* Check for Break instruction

 	 * Bits 37:40 Major opcode to be zero

	 * Bits 27:32 X6 to be zero

	 * Bits 32:35 X3 to be zero

	 */

	if ((!major_opcode) && (!((kprobe_inst >> 27) & 0x1FF)) ) {

		/* is a break instruction */

	 	p->ainsn.inst_flag |= INST_FLAG_BREAK_INST;

		return;

	}



	if (bundle_encoding[template][slot] == B) {

		switch (major_opcode) {

		  case INDIRECT_CALL_OPCODE:
@@ -542,7 +553,10 @@ static void __kprobes prepare_ss(struct kprobe *p, struct pt_regs *regs) 
	unsigned long bundle_addr = (unsigned long) &p->opcode.bundle;

	unsigned long slot = (unsigned long)p->addr & 0xf;



	/* Update instruction pointer (IIP) and slot number (IPSR.ri) */

	/* single step inline if break instruction */

	if (p->ainsn.inst_flag == INST_FLAG_BREAK_INST)

		regs->cr_iip = (unsigned long)p->addr & ~0xFULL;

	else

		regs->cr_iip = bundle_addr & ~0xFULL;



	if (slot > 2)
@@ -599,7 +613,9 @@ static int __kprobes pre_kprobes_handler(struct die_args *args) 
	if (kprobe_running()) {

		p = get_kprobe(addr);

		if (p) {

			if (kprobe_status == KPROBE_HIT_SS) {

			if ( (kprobe_status == KPROBE_HIT_SS) &&

	 		     (p->ainsn.inst_flag == INST_FLAG_BREAK_INST)) {

  				ia64_psr(regs)->ss = 0;

				unlock_kprobes();

				goto no_kprobe;

			}

arch/ppc64/kernel/kprobes.c

+6 −5
Original line number Diff line number Diff line
@@ -102,7 +102,7 @@ static inline void prepare_singlestep(struct kprobe *p, struct pt_regs *regs) 
	regs->msr |= MSR_SE;



	/* single step inline if it is a trap variant */

	if (IS_TW(insn) || IS_TD(insn) || IS_TWI(insn) || IS_TDI(insn))

	if (is_trap(insn))

		regs->nip = (unsigned long)p->addr;

	else

		regs->nip = (unsigned long)p->ainsn.insn;
@@ -152,7 +152,9 @@ static inline int kprobe_handler(struct pt_regs *regs) 
		   Disarm the probe we just hit, and ignore it. */

		p = get_kprobe(addr);

		if (p) {

			if (kprobe_status == KPROBE_HIT_SS) {

			kprobe_opcode_t insn = *p->ainsn.insn;

			if (kprobe_status == KPROBE_HIT_SS &&

					is_trap(insn)) {

				regs->msr &= ~MSR_SE;

				regs->msr |= kprobe_saved_msr;

				unlock_kprobes();
@@ -192,8 +194,7 @@ static inline int kprobe_handler(struct pt_regs *regs) 
			 * trap variant, it could belong to someone else

			 */

			kprobe_opcode_t cur_insn = *addr;

			if (IS_TW(cur_insn) || IS_TD(cur_insn) ||

					IS_TWI(cur_insn) || IS_TDI(cur_insn))

			if (is_trap(cur_insn))

		       		goto no_kprobe;

			/*

			 * The breakpoint instruction was removed right
@@ -403,7 +404,7 @@ int __kprobes kprobe_exceptions_notify(struct notifier_block *self, 
	default:

		break;

	}

	preempt_enable();

	preempt_enable_no_resched();

	return ret;

}

arch/x86_64/kernel/kprobes.c

+2 −1
Original line number Diff line number Diff line
@@ -311,7 +311,8 @@ int __kprobes kprobe_handler(struct pt_regs *regs) 
		   Disarm the probe we just hit, and ignore it. */

		p = get_kprobe(addr);

		if (p) {

			if (kprobe_status == KPROBE_HIT_SS) {

			if (kprobe_status == KPROBE_HIT_SS &&

				*p->ainsn.insn == BREAKPOINT_INSTRUCTION) {

				regs->eflags &= ~TF_MASK;

				regs->eflags |= kprobe_saved_rflags;

				unlock_kprobes();

include/asm-ia64/kprobes.h

+1 −0
Original line number Diff line number Diff line
@@ -92,6 +92,7 @@ struct arch_specific_insn { 
	kprobe_opcode_t insn;

 #define INST_FLAG_FIX_RELATIVE_IP_ADDR		1

 #define INST_FLAG_FIX_BRANCH_REG		2

 #define INST_FLAG_BREAK_INST			4

 	unsigned long inst_flag;

 	unsigned short target_br_reg;

};