linux-kernel - Re: [PATCH v2] powerpc/kprobes: Fix kprobe Oops happens in booke

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <c00161c6-878d-523a-0f04-7ee79b86d5fe@huawei.com>
Date:   Wed, 11 Aug 2021 14:48:21 +0800
From:   Pu Lehui <pulehui@...wei.com>
To:     Christophe Leroy <christophe.leroy@...roup.eu>
CC:     <mpe@...erman.id.au>, <linuxppc-dev@...ts.ozlabs.org>,
        <linux-kernel@...r.kernel.org>, <zhangjinhao2@...wei.com>,
        <naveen.n.rao@...ux.vnet.ibm.com>, <benh@...nel.crashing.org>,
        <paulus@...ba.org>, <mhiramat@...nel.org>, <peterz@...radead.org>,
        <npiggin@...il.com>, <ruscur@...sell.cc>
Subject: Re: [PATCH v2] powerpc/kprobes: Fix kprobe Oops happens in booke



On 2021/8/11 13:31, Christophe Leroy wrote:
> 
> 
> Le 11/08/2021 à 04:53, Pu Lehui a écrit :
>> Ping, serious problem here. All booke ppc will trigger Oops when
>> perform kprobes related operations.
> 
> As far as I can see it is in the fixes branch: 
> https://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux.git/log/?h=fixes 
> 
> 
Thanks.
>>
>> On 2021/8/9 10:36, Pu Lehui wrote:
>>> When using kprobe on powerpc booke series processor, Oops happens
>>> as show bellow:
>>>
>>> / # echo "p:myprobe do_nanosleep" > 
>>> /sys/kernel/debug/tracing/kprobe_events
>>> / # echo 1 > /sys/kernel/debug/tracing/events/kprobes/myprobe/enable
>>> / # sleep 1
>>> [   50.076730] Oops: Exception in kernel mode, sig: 5 [#1]
>>> [   50.077017] BE PAGE_SIZE=4K SMP NR_CPUS=24 QEMU e500
>>> [   50.077221] Modules linked in:
>>> [   50.077462] CPU: 0 PID: 77 Comm: sleep Not tainted 
>>> 5.14.0-rc4-00022-g251a1524293d #21
>>> [   50.077887] NIP:  c0b9c4e0 LR: c00ebecc CTR: 00000000
>>> [   50.078067] REGS: c3883de0 TRAP: 0700   Not tainted 
>>> (5.14.0-rc4-00022-g251a1524293d)
>>> [   50.078349] MSR:  00029000 <CE,EE,ME>  CR: 24000228  XER: 20000000
>>> [   50.078675]
>>> [   50.078675] GPR00: c00ebdf0 c3883e90 c313e300 c3883ea0 00000001 
>>> 00000000 c3883ecc 00000001
>>> [   50.078675] GPR08: c100598c c00ea250 00000004 00000000 24000222 
>>> 102490c2 bff4180c 101e60d4
>>> [   50.078675] GPR16: 00000000 102454ac 00000040 10240000 10241100 
>>> 102410f8 10240000 00500000
>>> [   50.078675] GPR24: 00000002 00000000 c3883ea0 00000001 00000000 
>>> 0000c350 3b9b8d50 00000000
>>> [   50.080151] NIP [c0b9c4e0] do_nanosleep+0x0/0x190
>>> [   50.080352] LR [c00ebecc] hrtimer_nanosleep+0x14c/0x1e0
>>> [   50.080638] Call Trace:
>>> [   50.080801] [c3883e90] [c00ebdf0] hrtimer_nanosleep+0x70/0x1e0 
>>> (unreliable)
>>> [   50.081110] [c3883f00] [c00ec004] sys_nanosleep_time32+0xa4/0x110
>>> [   50.081336] [c3883f40] [c001509c] ret_from_syscall+0x0/0x28
>>> [   50.081541] --- interrupt: c00 at 0x100a4d08
>>> [   50.081749] NIP:  100a4d08 LR: 101b5234 CTR: 00000003
>>> [   50.081931] REGS: c3883f50 TRAP: 0c00   Not tainted 
>>> (5.14.0-rc4-00022-g251a1524293d)
>>> [   50.082183] MSR:  0002f902 <CE,EE,PR,FP,ME>  CR: 24000222  XER: 
>>> 00000000
>>> [   50.082457]
>>> [   50.082457] GPR00: 000000a2 bf980040 1024b4d0 bf980084 bf980084 
>>> 64000000 00555345 fefefeff
>>> [   50.082457] GPR08: 7f7f7f7f 101e0000 00000069 00000003 28000422 
>>> 102490c2 bff4180c 101e60d4
>>> [   50.082457] GPR16: 00000000 102454ac 00000040 10240000 10241100 
>>> 102410f8 10240000 00500000
>>> [   50.082457] GPR24: 00000002 bf9803f4 10240000 00000000 00000000 
>>> 100039e0 00000000 102444e8
>>> [   50.083789] NIP [100a4d08] 0x100a4d08
>>> [   50.083917] LR [101b5234] 0x101b5234
>>> [   50.084042] --- interrupt: c00
>>> [   50.084238] Instruction dump:
>>> [   50.084483] 4bfffc40 60000000 60000000 60000000 9421fff0 39400402 
>>> 914200c0 38210010
>>> [   50.084841] 4bfffc20 00000000 00000000 00000000 <7fe00008> 
>>> 7c0802a6 7c892378 93c10048
>>> [   50.085487] ---[ end trace f6fffe98e2fa8f3e ]---
>>> [   50.085678]
>>> Trace/breakpoint trap
>>>
>>> There is no real mode for booke arch and the MMU translation is
>>> always on. The corresponding MSR_IS/MSR_DS bit in booke is used
>>> to switch the address space, but not for real mode judgment.
>>>
>>> Fixes: 21f8b2fa3ca5 ("powerpc/kprobes: Ignore traps that happened in 
>>> real mode")
>>> Signed-off-by: Pu Lehui <pulehui@...wei.com>
>>> ---
>>> v1->v2:
>>> - use IS_ENABLED(CONFIG_BOOKE) as suggested by Michael Ellerman and
>>>    Christophe Leroy
>>> - update Oops log to make problem clear
>>>
>>>   arch/powerpc/kernel/kprobes.c | 3 ++-
>>>   1 file changed, 2 insertions(+), 1 deletion(-)
>>>
>>> diff --git a/arch/powerpc/kernel/kprobes.c 
>>> b/arch/powerpc/kernel/kprobes.c
>>> index cbc28d1a2e1b..7a7cd6bda53e 100644
>>> --- a/arch/powerpc/kernel/kprobes.c
>>> +++ b/arch/powerpc/kernel/kprobes.c
>>> @@ -292,7 +292,8 @@ int kprobe_handler(struct pt_regs *regs)
>>>       if (user_mode(regs))
>>>           return 0;
>>> -    if (!(regs->msr & MSR_IR) || !(regs->msr & MSR_DR))
>>> +    if (!IS_ENABLED(CONFIG_BOOKE) &&
>>> +        (!(regs->msr & MSR_IR) || !(regs->msr & MSR_DR)))
>>>           return 0;
>>>       /*
>>>
> .