| From f8c2602733c953ed7a16e060640b8e96f9d94b9b Mon Sep 17 00:00:00 2001 |
| From: Vasily Gorbik <gor@linux.ibm.com> |
| Date: Fri, 25 Jun 2021 23:50:07 +0200 |
| Subject: s390/ftrace: fix ftrace_update_ftrace_func implementation |
| |
| From: Vasily Gorbik <gor@linux.ibm.com> |
| |
| commit f8c2602733c953ed7a16e060640b8e96f9d94b9b upstream. |
| |
| s390 enforces DYNAMIC_FTRACE if FUNCTION_TRACER is selected. |
| At the same time implementation of ftrace_caller is not compliant with |
| HAVE_DYNAMIC_FTRACE since it doesn't provide implementation of |
| ftrace_update_ftrace_func() and calls ftrace_trace_function() directly. |
| |
| The subtle difference is that during ftrace code patching ftrace |
| replaces function tracer via ftrace_update_ftrace_func() and activates |
| it back afterwards. Unexpected direct calls to ftrace_trace_function() |
| during ftrace code patching leads to nullptr-dereferences when tracing |
| is activated for one of functions which are used during code patching. |
| Those function currently are: |
| copy_from_kernel_nofault() |
| copy_from_kernel_nofault_allowed() |
| preempt_count_sub() [with debug_defconfig] |
| preempt_count_add() [with debug_defconfig] |
| |
| Corresponding KASAN report: |
| BUG: KASAN: nullptr-dereference in function_trace_call+0x316/0x3b0 |
| Read of size 4 at addr 0000000000001e08 by task migration/0/15 |
| |
| CPU: 0 PID: 15 Comm: migration/0 Tainted: G B 5.13.0-41423-g08316af3644d |
| Hardware name: IBM 3906 M04 704 (LPAR) |
| Stopper: multi_cpu_stop+0x0/0x3e0 <- stop_machine_cpuslocked+0x1e4/0x218 |
| Call Trace: |
| [<0000000001f77caa>] show_stack+0x16a/0x1d0 |
| [<0000000001f8de42>] dump_stack+0x15a/0x1b0 |
| [<0000000001f81d56>] print_address_description.constprop.0+0x66/0x2e0 |
| [<000000000082b0ca>] kasan_report+0x152/0x1c0 |
| [<00000000004cfd8e>] function_trace_call+0x316/0x3b0 |
| [<0000000001fb7082>] ftrace_caller+0x7a/0x7e |
| [<00000000006bb3e6>] copy_from_kernel_nofault_allowed+0x6/0x10 |
| [<00000000006bb42e>] copy_from_kernel_nofault+0x3e/0xd0 |
| [<000000000014605c>] ftrace_make_call+0xb4/0x1f8 |
| [<000000000047a1b4>] ftrace_replace_code+0x134/0x1d8 |
| [<000000000047a6e0>] ftrace_modify_all_code+0x120/0x1d0 |
| [<000000000047a7ec>] __ftrace_modify_code+0x5c/0x78 |
| [<000000000042395c>] multi_cpu_stop+0x224/0x3e0 |
| [<0000000000423212>] cpu_stopper_thread+0x33a/0x5a0 |
| [<0000000000243ff2>] smpboot_thread_fn+0x302/0x708 |
| [<00000000002329ea>] kthread+0x342/0x408 |
| [<00000000001066b2>] __ret_from_fork+0x92/0xf0 |
| [<0000000001fb57fa>] ret_from_fork+0xa/0x30 |
| |
| The buggy address belongs to the page: |
| page:(____ptrval____) refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1 |
| flags: 0x1ffff00000001000(reserved|node=0|zone=0|lastcpupid=0x1ffff) |
| raw: 1ffff00000001000 0000040000000048 0000040000000048 0000000000000000 |
| raw: 0000000000000000 0000000000000000 ffffffff00000001 0000000000000000 |
| page dumped because: kasan: bad access detected |
| |
| Memory state around the buggy address: |
| 0000000000001d00: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 |
| 0000000000001d80: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 |
| >0000000000001e00: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 |
| ^ |
| 0000000000001e80: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 |
| 0000000000001f00: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 |
| ================================================================== |
| |
| To fix that introduce ftrace_func callback to be called from |
| ftrace_caller and update it in ftrace_update_ftrace_func(). |
| |
| Fixes: 4cc9bed034d1 ("[S390] cleanup ftrace backend functions") |
| Cc: stable@vger.kernel.org |
| Reviewed-by: Heiko Carstens <hca@linux.ibm.com> |
| Signed-off-by: Vasily Gorbik <gor@linux.ibm.com> |
| Signed-off-by: Heiko Carstens <hca@linux.ibm.com> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| --- |
| arch/s390/include/asm/ftrace.h | 1 + |
| arch/s390/kernel/ftrace.c | 2 ++ |
| arch/s390/kernel/mcount.S | 4 ++-- |
| 3 files changed, 5 insertions(+), 2 deletions(-) |
| |
| --- a/arch/s390/include/asm/ftrace.h |
| +++ b/arch/s390/include/asm/ftrace.h |
| @@ -19,6 +19,7 @@ void ftrace_caller(void); |
| |
| extern char ftrace_graph_caller_end; |
| extern unsigned long ftrace_plt; |
| +extern void *ftrace_func; |
| |
| struct dyn_arch_ftrace { }; |
| |
| --- a/arch/s390/kernel/ftrace.c |
| +++ b/arch/s390/kernel/ftrace.c |
| @@ -40,6 +40,7 @@ |
| * trampoline (ftrace_plt), which clobbers also r1. |
| */ |
| |
| +void *ftrace_func __read_mostly = ftrace_stub; |
| unsigned long ftrace_plt; |
| |
| int ftrace_modify_call(struct dyn_ftrace *rec, unsigned long old_addr, |
| @@ -85,6 +86,7 @@ int ftrace_make_call(struct dyn_ftrace * |
| |
| int ftrace_update_ftrace_func(ftrace_func_t func) |
| { |
| + ftrace_func = func; |
| return 0; |
| } |
| |
| --- a/arch/s390/kernel/mcount.S |
| +++ b/arch/s390/kernel/mcount.S |
| @@ -59,13 +59,13 @@ ENTRY(ftrace_caller) |
| #ifdef CONFIG_HAVE_MARCH_Z196_FEATURES |
| aghik %r2,%r0,-MCOUNT_INSN_SIZE |
| lgrl %r4,function_trace_op |
| - lgrl %r1,ftrace_trace_function |
| + lgrl %r1,ftrace_func |
| #else |
| lgr %r2,%r0 |
| aghi %r2,-MCOUNT_INSN_SIZE |
| larl %r4,function_trace_op |
| lg %r4,0(%r4) |
| - larl %r1,ftrace_trace_function |
| + larl %r1,ftrace_func |
| lg %r1,0(%r1) |
| #endif |
| lgr %r3,%r14 |