[PATCH] kprobes: fix bug when probed on task and isr functions

This patch fixes a race condition where in system used to hang or sometime
crash within minutes when kprobes are inserted on ISR routine and a task
routine.

The fix has been stress tested on i386, ia64, pp64 and on x86_64.  To
reproduce the problem insert kprobes on schedule() and do_IRQ() functions
and you should see hang or system crash.

Signed-off-by: Anil S Keshavamurthy <anil.s.keshavamurthy@intel.com>
Signed-off-by: Ananth N Mavinakayanahalli <ananth@in.ibm.com>
Acked-by: Prasanna S Panchamukhi <prasanna@in.ibm.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

4 files changed, 29 insertions, 10 deletions

diff --git a/arch/i386/kernel/kprobes.c b/arch/i386/kernel/kprobes.c
index e5cec32018a5..6345b430b105 100644
--- a/arch/i386/kernel/kprobes.c
+++ b/arch/i386/kernel/kprobes.c
@@ -177,7 +177,8 @@ static int __kprobes kprobe_handler(struct pt_regs *regs)
                    Disarm the probe we just hit, and ignore it. */
                 p = get_kprobe(addr);
                 if (p) {
-                        if (kprobe_status == KPROBE_HIT_SS) {
+                        if (kprobe_status == KPROBE_HIT_SS &&
+                                *p->ainsn.insn == BREAKPOINT_INSTRUCTION) {
                                 regs->eflags &= ~TF_MASK;
                                 regs->eflags |= kprobe_saved_eflags;
                                 unlock_kprobes();
diff --git a/arch/ia64/kernel/kprobes.c b/arch/ia64/kernel/kprobes.c
index 4b1bd539ec47..471086b808a4 100644
--- a/arch/ia64/kernel/kprobes.c
+++ b/arch/ia64/kernel/kprobes.c
@@ -95,6 +95,17 @@ static void __kprobes update_kprobe_inst_flag(uint template, uint  slot,
         p->ainsn.inst_flag = 0;
         p->ainsn.target_br_reg = 0;
 
+        /* Check for Break instruction
+         * Bits 37:40 Major opcode to be zero
+         * Bits 27:32 X6 to be zero
+         * Bits 32:35 X3 to be zero
+         */
+        if ((!major_opcode) && (!((kprobe_inst >> 27) & 0x1FF)) ) {
+                /* is a break instruction */
+                p->ainsn.inst_flag |= INST_FLAG_BREAK_INST;
+                return;
+        }
+
         if (bundle_encoding[template][slot] == B) {
                 switch (major_opcode) {
                   case INDIRECT_CALL_OPCODE:
@@ -542,8 +553,11 @@ static void __kprobes prepare_ss(struct kprobe *p, struct pt_regs *regs)
         unsigned long bundle_addr = (unsigned long) &p->opcode.bundle;
         unsigned long slot = (unsigned long)p->addr & 0xf;
 
-        /* Update instruction pointer (IIP) and slot number (IPSR.ri) */
-        regs->cr_iip = bundle_addr & ~0xFULL;
+        /* single step inline if break instruction */
+        if (p->ainsn.inst_flag == INST_FLAG_BREAK_INST)
+                regs->cr_iip = (unsigned long)p->addr & ~0xFULL;
+        else
+                regs->cr_iip = bundle_addr & ~0xFULL;
 
         if (slot > 2)
                 slot = 0;
@@ -599,7 +613,9 @@ static int __kprobes pre_kprobes_handler(struct die_args *args)
         if (kprobe_running()) {
                 p = get_kprobe(addr);
                 if (p) {
-                        if (kprobe_status == KPROBE_HIT_SS) {
+                        if ( (kprobe_status == KPROBE_HIT_SS) &&
+                             (p->ainsn.inst_flag == INST_FLAG_BREAK_INST)) {
+                                ia64_psr(regs)->ss = 0;
                                 unlock_kprobes();
                                 goto no_kprobe;
                         }
diff --git a/arch/ppc64/kernel/kprobes.c b/arch/ppc64/kernel/kprobes.c
index 591e4b67b5a5..7e80d49c589a 100644
--- a/arch/ppc64/kernel/kprobes.c
+++ b/arch/ppc64/kernel/kprobes.c
@@ -102,7 +102,7 @@ static inline void prepare_singlestep(struct kprobe *p, struct pt_regs *regs)
         regs->msr |= MSR_SE;
 
         /* single step inline if it is a trap variant */
-        if (IS_TW(insn) || IS_TD(insn) || IS_TWI(insn) || IS_TDI(insn))
+        if (is_trap(insn))
                 regs->nip = (unsigned long)p->addr;
         else
                 regs->nip = (unsigned long)p->ainsn.insn;
@@ -152,7 +152,9 @@ static inline int kprobe_handler(struct pt_regs *regs)
                    Disarm the probe we just hit, and ignore it. */
                 p = get_kprobe(addr);
                 if (p) {
-                        if (kprobe_status == KPROBE_HIT_SS) {
+                        kprobe_opcode_t insn = *p->ainsn.insn;
+                        if (kprobe_status == KPROBE_HIT_SS &&
+                                        is_trap(insn)) {
                                 regs->msr &= ~MSR_SE;
                                 regs->msr |= kprobe_saved_msr;
                                 unlock_kprobes();
@@ -192,8 +194,7 @@ static inline int kprobe_handler(struct pt_regs *regs)
                          * trap variant, it could belong to someone else
                          */
                         kprobe_opcode_t cur_insn = *addr;
-                        if (IS_TW(cur_insn) || IS_TD(cur_insn) ||
-                                        IS_TWI(cur_insn) || IS_TDI(cur_insn))
+                        if (is_trap(cur_insn))
                                 goto no_kprobe;
                         /*
                          * The breakpoint instruction was removed right
@@ -403,7 +404,7 @@ int __kprobes kprobe_exceptions_notify(struct notifier_block *self,
         default:
                 break;
         }
-        preempt_enable();
+        preempt_enable_no_resched();
         return ret;
 }
 
diff --git a/arch/x86_64/kernel/kprobes.c b/arch/x86_64/kernel/kprobes.c
index 2d7658fbbb28..df08c43276a0 100644
--- a/arch/x86_64/kernel/kprobes.c
+++ b/arch/x86_64/kernel/kprobes.c
@@ -311,7 +311,8 @@ int __kprobes kprobe_handler(struct pt_regs *regs)
                    Disarm the probe we just hit, and ignore it. */
                 p = get_kprobe(addr);
                 if (p) {
-                        if (kprobe_status == KPROBE_HIT_SS) {
+                        if (kprobe_status == KPROBE_HIT_SS &&
+                                *p->ainsn.insn == BREAKPOINT_INSTRUCTION) {
                                 regs->eflags &= ~TF_MASK;
                                 regs->eflags |= kprobe_saved_rflags;
                                 unlock_kprobes();