linux-kernel - Re: [PATCH v2] powerpc/kprobes: Fix kprobe Oops happens in booke

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <9c6cdb3f-37ac-9a8c-2c75-3a939ed76ab4@csgroup.eu>
Date:   Wed, 11 Aug 2021 07:31:37 +0200
From:   Christophe Leroy <christophe.leroy@...roup.eu>
To:     Pu Lehui <pulehui@...wei.com>, mpe@...erman.id.au,
        benh@...nel.crashing.org, paulus@...ba.org,
        naveen.n.rao@...ux.vnet.ibm.com, mhiramat@...nel.org,
        peterz@...radead.org, npiggin@...il.com, ruscur@...sell.cc
Cc:     linuxppc-dev@...ts.ozlabs.org, linux-kernel@...r.kernel.org,
        zhangjinhao2@...wei.com
Subject: Re: [PATCH v2] powerpc/kprobes: Fix kprobe Oops happens in booke



Le 11/08/2021 à 04:53, Pu Lehui a écrit :
> Ping, serious problem here. All booke ppc will trigger Oops when
> perform kprobes related operations.

As far as I can see it is in the fixes branch: 
https://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux.git/log/?h=fixes

> 
> On 2021/8/9 10:36, Pu Lehui wrote:
>> When using kprobe on powerpc booke series processor, Oops happens
>> as show bellow:
>>
>> / # echo "p:myprobe do_nanosleep" > /sys/kernel/debug/tracing/kprobe_events
>> / # echo 1 > /sys/kernel/debug/tracing/events/kprobes/myprobe/enable
>> / # sleep 1
>> [   50.076730] Oops: Exception in kernel mode, sig: 5 [#1]
>> [   50.077017] BE PAGE_SIZE=4K SMP NR_CPUS=24 QEMU e500
>> [   50.077221] Modules linked in:
>> [   50.077462] CPU: 0 PID: 77 Comm: sleep Not tainted 5.14.0-rc4-00022-g251a1524293d #21
>> [   50.077887] NIP:  c0b9c4e0 LR: c00ebecc CTR: 00000000
>> [   50.078067] REGS: c3883de0 TRAP: 0700   Not tainted (5.14.0-rc4-00022-g251a1524293d)
>> [   50.078349] MSR:  00029000 <CE,EE,ME>  CR: 24000228  XER: 20000000
>> [   50.078675]
>> [   50.078675] GPR00: c00ebdf0 c3883e90 c313e300 c3883ea0 00000001 00000000 c3883ecc 00000001
>> [   50.078675] GPR08: c100598c c00ea250 00000004 00000000 24000222 102490c2 bff4180c 101e60d4
>> [   50.078675] GPR16: 00000000 102454ac 00000040 10240000 10241100 102410f8 10240000 00500000
>> [   50.078675] GPR24: 00000002 00000000 c3883ea0 00000001 00000000 0000c350 3b9b8d50 00000000
>> [   50.080151] NIP [c0b9c4e0] do_nanosleep+0x0/0x190
>> [   50.080352] LR [c00ebecc] hrtimer_nanosleep+0x14c/0x1e0
>> [   50.080638] Call Trace:
>> [   50.080801] [c3883e90] [c00ebdf0] hrtimer_nanosleep+0x70/0x1e0 (unreliable)
>> [   50.081110] [c3883f00] [c00ec004] sys_nanosleep_time32+0xa4/0x110
>> [   50.081336] [c3883f40] [c001509c] ret_from_syscall+0x0/0x28
>> [   50.081541] --- interrupt: c00 at 0x100a4d08
>> [   50.081749] NIP:  100a4d08 LR: 101b5234 CTR: 00000003
>> [   50.081931] REGS: c3883f50 TRAP: 0c00   Not tainted (5.14.0-rc4-00022-g251a1524293d)
>> [   50.082183] MSR:  0002f902 <CE,EE,PR,FP,ME>  CR: 24000222  XER: 00000000
>> [   50.082457]
>> [   50.082457] GPR00: 000000a2 bf980040 1024b4d0 bf980084 bf980084 64000000 00555345 fefefeff
>> [   50.082457] GPR08: 7f7f7f7f 101e0000 00000069 00000003 28000422 102490c2 bff4180c 101e60d4
>> [   50.082457] GPR16: 00000000 102454ac 00000040 10240000 10241100 102410f8 10240000 00500000
>> [   50.082457] GPR24: 00000002 bf9803f4 10240000 00000000 00000000 100039e0 00000000 102444e8
>> [   50.083789] NIP [100a4d08] 0x100a4d08
>> [   50.083917] LR [101b5234] 0x101b5234
>> [   50.084042] --- interrupt: c00
>> [   50.084238] Instruction dump:
>> [   50.084483] 4bfffc40 60000000 60000000 60000000 9421fff0 39400402 914200c0 38210010
>> [   50.084841] 4bfffc20 00000000 00000000 00000000 <7fe00008> 7c0802a6 7c892378 93c10048
>> [   50.085487] ---[ end trace f6fffe98e2fa8f3e ]---
>> [   50.085678]
>> Trace/breakpoint trap
>>
>> There is no real mode for booke arch and the MMU translation is
>> always on. The corresponding MSR_IS/MSR_DS bit in booke is used
>> to switch the address space, but not for real mode judgment.
>>
>> Fixes: 21f8b2fa3ca5 ("powerpc/kprobes: Ignore traps that happened in real mode")
>> Signed-off-by: Pu Lehui <pulehui@...wei.com>
>> ---
>> v1->v2:
>> - use IS_ENABLED(CONFIG_BOOKE) as suggested by Michael Ellerman and
>>    Christophe Leroy
>> - update Oops log to make problem clear
>>
>>   arch/powerpc/kernel/kprobes.c | 3 ++-
>>   1 file changed, 2 insertions(+), 1 deletion(-)
>>
>> diff --git a/arch/powerpc/kernel/kprobes.c b/arch/powerpc/kernel/kprobes.c
>> index cbc28d1a2e1b..7a7cd6bda53e 100644
>> --- a/arch/powerpc/kernel/kprobes.c
>> +++ b/arch/powerpc/kernel/kprobes.c
>> @@ -292,7 +292,8 @@ int kprobe_handler(struct pt_regs *regs)
>>       if (user_mode(regs))
>>           return 0;
>> -    if (!(regs->msr & MSR_IR) || !(regs->msr & MSR_DR))
>> +    if (!IS_ENABLED(CONFIG_BOOKE) &&
>> +        (!(regs->msr & MSR_IR) || !(regs->msr & MSR_DR)))
>>           return 0;
>>       /*
>>