linux-kernel - Re: [v2] ppc64/kprobe: Fix oops when kprobed on 'stdu' instruction

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <3w6k4T3xS7z9rxw@ozlabs.org>
Date:   Tue, 18 Apr 2017 21:51:37 +1000 (AEST)
From:   Michael Ellerman <patch-notifications@...erman.id.au>
To:     Ravi Bangoria <ravi.bangoria@...ux.vnet.ibm.com>
Cc:     chris@...troguy.com, npiggin@...il.com,
        linux-kernel@...r.kernel.org, paulus@...ba.org,
        aneesh.kumar@...ux.vnet.ibm.com,
        Ravi Bangoria <ravi.bangoria@...ux.vnet.ibm.com>,
        naveen.n.rao@...ux.vnet.ibm.com, linuxppc-dev@...ts.ozlabs.org,
        anton@...ba.org, viro@...iv.linux.org.uk
Subject: Re: [v2] ppc64/kprobe: Fix oops when kprobed on 'stdu' instruction

On Tue, 2017-04-11 at 05:08:13 UTC, Ravi Bangoria wrote:
> If we set a kprobe on a 'stdu' instruction on powerpc64, we see a kernel 
> OOPS:
> 
>   [ 1275.165932] Bad kernel stack pointer cd93c840 at c000000000009868
>   [ 1275.166378] Oops: Bad kernel stack pointer, sig: 6 [#1]
>   ...
>   GPR00: c000001fcd93cb30 00000000cd93c840 c0000000015c5e00 00000000cd93c840
>   ...
>   [ 1275.178305] NIP [c000000000009868] resume_kernel+0x2c/0x58
>   [ 1275.178594] LR [c000000000006208] program_check_common+0x108/0x180
> 
> Basically, on 64 bit system, when user probes on 'stdu' instruction,
> kernel does not emulate actual store in emulate_step itself because it
> may corrupt exception frame. So kernel does actual store operation in
> exception return code i.e. resume_kernel().
> 
> resume_kernel() loads the saved stack pointer from memory using lwz,
> effectively loading a corrupt (32bit) address, causing the kernel crash.
> 
> Fix this by loading the 64bit value instead.
> 
> Fixes: be96f63375a1 ("powerpc: Split out instruction analysis part of emulate_step()") 
> Signed-off-by: Ravi Bangoria <ravi.bangoria@...ux.vnet.ibm.com>
> Reviewed-by: Naveen N. Rao <naveen.n.rao@...ux.vnet.ibm.com>
> Reviewed-by: Ananth N Mavinakayanahalli <ananth@...ux.vnet.ibm.com>

Applied to powerpc fixes, thanks.

https://git.kernel.org/powerpc/c/9e1ba4f27f018742a1aa95d11e3510

cheers