Skip to content

Commit 9e1ba4f

Browse files
Ravi Bangoriampe
authored andcommitted
powerpc/kprobe: Fix oops when kprobed on 'stdu' instruction
If we set a kprobe on a 'stdu' instruction on powerpc64, we see a kernel OOPS: Bad kernel stack pointer cd93c840 at c000000000009868 Oops: Bad kernel stack pointer, sig: 6 [#1] ... GPR00: c000001fcd93cb30 00000000cd93c840 c0000000015c5e00 00000000cd93c840 ... NIP [c000000000009868] resume_kernel+0x2c/0x58 LR [c000000000006208] program_check_common+0x108/0x180 On a 64-bit system when the user probes on a 'stdu' instruction, the kernel does not emulate actual store in emulate_step() because it may corrupt the exception frame. So the kernel does the actual store operation in exception return code i.e. resume_kernel(). resume_kernel() loads the saved stack pointer from memory using lwz, which only loads the low 32-bits of the address, causing the kernel crash. Fix this by loading the 64-bit value instead. Fixes: be96f63 ("powerpc: Split out instruction analysis part of emulate_step()") Cc: [email protected] # v3.18+ Signed-off-by: Ravi Bangoria <[email protected]> Reviewed-by: Naveen N. Rao <[email protected]> Reviewed-by: Ananth N Mavinakayanahalli <[email protected]> [mpe: Change log massage, add stable tag] Signed-off-by: Michael Ellerman <[email protected]>
1 parent 4749228 commit 9e1ba4f

File tree

1 file changed

+3
-3
lines changed

1 file changed

+3
-3
lines changed

arch/powerpc/kernel/entry_64.S

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -689,7 +689,7 @@ resume_kernel:
689689

690690
addi r8,r1,INT_FRAME_SIZE /* Get the kprobed function entry */
691691

692-
lwz r3,GPR1(r1)
692+
ld r3,GPR1(r1)
693693
subi r3,r3,INT_FRAME_SIZE /* dst: Allocate a trampoline exception frame */
694694
mr r4,r1 /* src: current exception frame */
695695
mr r1,r3 /* Reroute the trampoline frame to r1 */
@@ -703,8 +703,8 @@ resume_kernel:
703703
addi r6,r6,8
704704
bdnz 2b
705705

706-
/* Do real store operation to complete stwu */
707-
lwz r5,GPR1(r1)
706+
/* Do real store operation to complete stdu */
707+
ld r5,GPR1(r1)
708708
std r8,0(r5)
709709

710710
/* Clear _TIF_EMULATE_STACK_STORE flag */

0 commit comments

Comments
 (0)