| From 9e1ba4f27f018742a1aa95d11e35106feba08ec1 Mon Sep 17 00:00:00 2001 |
| From: Ravi Bangoria <ravi.bangoria@linux.vnet.ibm.com> |
| Date: Tue, 11 Apr 2017 10:38:13 +0530 |
| Subject: [PATCH] powerpc/kprobe: Fix oops when kprobed on 'stdu' instruction |
| |
| commit 9e1ba4f27f018742a1aa95d11e35106feba08ec1 upstream. |
| |
| If we set a kprobe on a 'stdu' instruction on powerpc64, we see a kernel |
| OOPS: |
| |
| Bad kernel stack pointer cd93c840 at c000000000009868 |
| Oops: Bad kernel stack pointer, sig: 6 [#1] |
| ... |
| GPR00: c000001fcd93cb30 00000000cd93c840 c0000000015c5e00 00000000cd93c840 |
| ... |
| NIP [c000000000009868] resume_kernel+0x2c/0x58 |
| LR [c000000000006208] program_check_common+0x108/0x180 |
| |
| On a 64-bit system when the user probes on a 'stdu' instruction, the kernel does |
| not emulate actual store in emulate_step() because it may corrupt the exception |
| frame. So the kernel does the actual store operation in exception return code |
| i.e. resume_kernel(). |
| |
| resume_kernel() loads the saved stack pointer from memory using lwz, which only |
| loads the low 32-bits of the address, causing the kernel crash. |
| |
| Fix this by loading the 64-bit value instead. |
| |
| Fixes: be96f63375a1 ("powerpc: Split out instruction analysis part of emulate_step()") |
| Cc: stable@vger.kernel.org # v3.18+ |
| Signed-off-by: Ravi Bangoria <ravi.bangoria@linux.vnet.ibm.com> |
| Reviewed-by: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com> |
| Reviewed-by: Ananth N Mavinakayanahalli <ananth@linux.vnet.ibm.com> |
| [mpe: Change log massage, add stable tag] |
| Signed-off-by: Michael Ellerman <mpe@ellerman.id.au> |
| |
| diff --git a/arch/powerpc/kernel/entry_64.S b/arch/powerpc/kernel/entry_64.S |
| index 6432d4bf08c8..767ef6d68c9e 100644 |
| --- a/arch/powerpc/kernel/entry_64.S |
| +++ b/arch/powerpc/kernel/entry_64.S |
| @@ -689,7 +689,7 @@ resume_kernel: |
| |
| addi r8,r1,INT_FRAME_SIZE /* Get the kprobed function entry */ |
| |
| - lwz r3,GPR1(r1) |
| + ld r3,GPR1(r1) |
| subi r3,r3,INT_FRAME_SIZE /* dst: Allocate a trampoline exception frame */ |
| mr r4,r1 /* src: current exception frame */ |
| mr r1,r3 /* Reroute the trampoline frame to r1 */ |
| @@ -703,8 +703,8 @@ resume_kernel: |
| addi r6,r6,8 |
| bdnz 2b |
| |
| - /* Do real store operation to complete stwu */ |
| - lwz r5,GPR1(r1) |
| + /* Do real store operation to complete stdu */ |
| + ld r5,GPR1(r1) |
| std r8,0(r5) |
| |
| /* Clear _TIF_EMULATE_STACK_STORE flag */ |
| -- |
| 2.12.0 |
| |
