linux-kernel - Re: [PATCH] samples/hw_breakpoint: Fix kernel BUG 'invalid opcode: 0000'

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 24 Jul 2023 14:59:15 +0200
From:   Petr Mladek <pmladek@...e.com>
To:     Rong Tao <rtoax@...mail.com>, Luis Chamberlain <mcgrof@...nel.org>
Cc:     prasad@...ux.vnet.ibm.com, ast@...nel.org, frederic@...nel.org,
        gregkh@...uxfoundation.org, linux-kernel@...r.kernel.org,
        mbenes@...e.cz, qperret@...gle.com, rongtao@...tc.cn,
        tglx@...utronix.de, will@...nel.org, mhiramat@...nel.org
Subject: Re: [PATCH] samples/hw_breakpoint: Fix kernel BUG 'invalid opcode:
 0000'

On Mon 2023-07-24 18:47:58, Rong Tao wrote:
> From: Rong Tao <rongtao@...tc.cn>
> 
> Macro symbol_put() is defined as __symbol_put(__stringify(x))
> 
>     ksym_name = "jiffies"
>     symbol_put(ksym_name)
> 
> will be resolved as
> 
>     __symbol_put("ksym_name")
> 
> which is clearly wrong. So symbol_put must be replaced with __symbol_put.
> 
> When we uninstall hw_breakpoint.ko (rmmod), a kernel bug occurs with the
> following error:
> 
> [11381.854152] kernel BUG at kernel/module/main.c:779!
> [11381.854159] invalid opcode: 0000 [#2] PREEMPT SMP PTI
> [11381.854163] CPU: 8 PID: 59623 Comm: rmmod Tainted: G      D    OE      6.2.9-200.fc37.x86_64 #1
> [11381.854167] Hardware name: To Be Filled By O.E.M. To Be Filled By O.E.M./B360M-HDV, BIOS P3.20 10/23/2018
> [11381.854169] RIP: 0010:__symbol_put+0xa2/0xb0
> [11381.854175] Code: 00 e8 92 d2 f7 ff 65 8b 05 c3 2f e6 78 85 c0 74 1b 48 8b 44 24 30 65 48 2b 04 25 28 00 00 00 75 12 48 83 c4 38 c3 cc cc cc cc <0f> 0b 0f 1f 44 00 00 eb de e8 c0 df d8 00 90 90 90 90 90 90 90 90
> [11381.854178] RSP: 0018:ffffad8ec6ae7dd0 EFLAGS: 00010246
> [11381.854181] RAX: 0000000000000000 RBX: ffffffffc1fd1240 RCX: 000000000000000c
> [11381.854184] RDX: 000000000000006b RSI: ffffffffc02bf7c7 RDI: ffffffffc1fd001c
> [11381.854186] RBP: 000055a38b76e7c8 R08: ffffffff871ccfe0 R09: 0000000000000000
> [11381.854188] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
> [11381.854190] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
> [11381.854192] FS:  00007fbf7c62c740(0000) GS:ffff8c5badc00000(0000) knlGS:0000000000000000
> [11381.854195] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [11381.854197] CR2: 000055a38b7793f8 CR3: 0000000363e1e001 CR4: 00000000003726e0
> [11381.854200] DR0: ffffffffb3407980 DR1: 0000000000000000 DR2: 0000000000000000
> [11381.854202] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
> [11381.854204] Call Trace:
> [11381.854207]  <TASK>
> [11381.854212]  s_module_exit+0xc/0xff0 [symbol_getput]
> [11381.854219]  __do_sys_delete_module.constprop.0+0x198/0x2f0
> [11381.854225]  do_syscall_64+0x58/0x80
> [11381.854231]  ? exit_to_user_mode_prepare+0x180/0x1f0
> [11381.854237]  ? syscall_exit_to_user_mode+0x17/0x40
> [11381.854241]  ? do_syscall_64+0x67/0x80
> [11381.854245]  ? syscall_exit_to_user_mode+0x17/0x40
> [11381.854248]  ? do_syscall_64+0x67/0x80
> [11381.854252]  ? exc_page_fault+0x70/0x170
> [11381.854256]  entry_SYSCALL_64_after_hwframe+0x72/0xdc
> 
> Signed-off-by: Rong Tao <rongtao@...tc.cn>

Reviewed-by: Petr Mladek <pmladek@...e.com>

I have already seen and acked this patch few months ago, see
https://lore.kernel.org/all/ZD0TfQHWQftNvFNA@alley/#t

symbol_put() is in module loader code, so this might go via
the module loaded tree. Adding Luis into Cc.

Best Regards,
Petr

---
>  samples/hw_breakpoint/data_breakpoint.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/samples/hw_breakpoint/data_breakpoint.c b/samples/hw_breakpoint/data_breakpoint.c
> index 418c46fe5ffc..9debd128b2ab 100644
> --- a/samples/hw_breakpoint/data_breakpoint.c
> +++ b/samples/hw_breakpoint/data_breakpoint.c
> @@ -70,7 +70,7 @@ static int __init hw_break_module_init(void)
>  static void __exit hw_break_module_exit(void)
>  {
>  	unregister_wide_hw_breakpoint(sample_hbp);
> -	symbol_put(ksym_name);
> +	__symbol_put(ksym_name);
>  	printk(KERN_INFO "HW Breakpoint for %s write uninstalled\n", ksym_name);
>  }
>  
> -- 
> 2.39.3