aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorRavi Bangoria <ravi.bangoria@linux.vnet.ibm.com>2017-04-11 01:08:13 -0400
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2017-04-27 03:10:38 -0400
commit1bd55ab13039a0d1c004eeb7a487810138bc42c8 (patch)
treec74f564ef82e39f713cee8c98d88a30591cdd84c
parent790b2b5a01cea4ee4284d52ea995e2af06f4f8d7 (diff)
powerpc/kprobe: Fix oops when kprobed on 'stdu' instruction
commit 9e1ba4f27f018742a1aa95d11e35106feba08ec1 upstream. If we set a kprobe on a 'stdu' instruction on powerpc64, we see a kernel OOPS: Bad kernel stack pointer cd93c840 at c000000000009868 Oops: Bad kernel stack pointer, sig: 6 [#1] ... GPR00: c000001fcd93cb30 00000000cd93c840 c0000000015c5e00 00000000cd93c840 ... NIP [c000000000009868] resume_kernel+0x2c/0x58 LR [c000000000006208] program_check_common+0x108/0x180 On a 64-bit system when the user probes on a 'stdu' instruction, the kernel does not emulate actual store in emulate_step() because it may corrupt the exception frame. So the kernel does the actual store operation in exception return code i.e. resume_kernel(). resume_kernel() loads the saved stack pointer from memory using lwz, which only loads the low 32-bits of the address, causing the kernel crash. Fix this by loading the 64-bit value instead. Fixes: be96f63375a1 ("powerpc: Split out instruction analysis part of emulate_step()") Signed-off-by: Ravi Bangoria <ravi.bangoria@linux.vnet.ibm.com> Reviewed-by: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com> Reviewed-by: Ananth N Mavinakayanahalli <ananth@linux.vnet.ibm.com> [mpe: Change log massage, add stable tag] Signed-off-by: Michael Ellerman <mpe@ellerman.id.au> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-rw-r--r--arch/powerpc/kernel/entry_64.S6
1 files changed, 3 insertions, 3 deletions
diff --git a/arch/powerpc/kernel/entry_64.S b/arch/powerpc/kernel/entry_64.S
index 6432d4bf08c8..767ef6d68c9e 100644
--- a/arch/powerpc/kernel/entry_64.S
+++ b/arch/powerpc/kernel/entry_64.S
@@ -689,7 +689,7 @@ resume_kernel:
689 689
690 addi r8,r1,INT_FRAME_SIZE /* Get the kprobed function entry */ 690 addi r8,r1,INT_FRAME_SIZE /* Get the kprobed function entry */
691 691
692 lwz r3,GPR1(r1) 692 ld r3,GPR1(r1)
693 subi r3,r3,INT_FRAME_SIZE /* dst: Allocate a trampoline exception frame */ 693 subi r3,r3,INT_FRAME_SIZE /* dst: Allocate a trampoline exception frame */
694 mr r4,r1 /* src: current exception frame */ 694 mr r4,r1 /* src: current exception frame */
695 mr r1,r3 /* Reroute the trampoline frame to r1 */ 695 mr r1,r3 /* Reroute the trampoline frame to r1 */
@@ -703,8 +703,8 @@ resume_kernel:
703 addi r6,r6,8 703 addi r6,r6,8
704 bdnz 2b 704 bdnz 2b
705 705
706 /* Do real store operation to complete stwu */ 706 /* Do real store operation to complete stdu */
707 lwz r5,GPR1(r1) 707 ld r5,GPR1(r1)
708 std r8,0(r5) 708 std r8,0(r5)
709 709
710 /* Clear _TIF_EMULATE_STACK_STORE flag */ 710 /* Clear _TIF_EMULATE_STACK_STORE flag */