[PATCH 3.14 16/53] kprobes/x86: Clear TF bit in fault on single-stepping

From	Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Newsgroups	linux.kernel
Subject	[PATCH 3.14 16/53] kprobes/x86: Clear TF bit in fault on single-stepping
Date	2016-07-25 23:00 +0200
Message-ID	<rYV8L-Pn-31@gated-at.bofh.it> (permalink)
References	<rYV8K-Pn-3@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

3.14-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Masami Hiramatsu <mhiramat@kernel.org>

commit dcfc47248d3f7d28df6f531e6426b933de94370d upstream.

Fix kprobe_fault_handler() to clear the TF (trap flag) bit of
the flags register in the case of a fault fixup on single-stepping.

If we put a kprobe on the instruction which caused a
page fault (e.g. actual mov instructions in copy_user_*),
that fault happens on the single-stepping buffer. In this
case, kprobes resets running instance so that the CPU can
retry execution on the original ip address.

However, current code forgets to reset the TF bit. Since this
fault happens with TF bit set for enabling single-stepping,
when it retries, it causes a debug exception and kprobes
can not handle it because it already reset itself.

On the most of x86-64 platform, it can be easily reproduced
by using kprobe tracer. E.g.

  # cd /sys/kernel/debug/tracing
  # echo p copy_user_enhanced_fast_string+5 > kprobe_events
  # echo 1 > events/kprobes/enable

And you'll see a kernel panic on do_debug(), since the debug
trap is not handled by kprobes.

To fix this problem, we just need to clear the TF bit when
resetting running kprobe.

Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
Reviewed-by: Ananth N Mavinakayanahalli <ananth@linux.vnet.ibm.com>
Acked-by: Steven Rostedt <rostedt@goodmis.org>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Brian Gerst <brgerst@gmail.com>
Cc: Denys Vlasenko <dvlasenk@redhat.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Jiri Olsa <jolsa@redhat.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Stephane Eranian <eranian@google.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Vince Weaver <vincent.weaver@maine.edu>
Cc: systemtap@sourceware.org
Link: http://lkml.kernel.org/r/20160611140648.25885.37482.stgit@devbox
[ Updated the comments. ]
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/x86/kernel/kprobes/core.c |   12 ++++++++++++
 1 file changed, 12 insertions(+)

--- a/arch/x86/kernel/kprobes/core.c
+++ b/arch/x86/kernel/kprobes/core.c
@@ -911,7 +911,19 @@ int __kprobes kprobe_fault_handler(struc
 		 * normal page fault.
 		 */
 		regs->ip = (unsigned long)cur->addr;
+		/*
+		 * Trap flag (TF) has been set here because this fault
+		 * happened where the single stepping will be done.
+		 * So clear it by resetting the current kprobe:
+		 */
+		regs->flags &= ~X86_EFLAGS_TF;
+
+		/*
+		 * If the TF flag was set before the kprobe hit,
+		 * don't touch it:
+		 */
 		regs->flags |= kcb->kprobe_old_flags;
+
 		if (kcb->kprobe_status == KPROBE_REENTER)
 			restore_previous_kprobe(kcb);
 		else

Thread

[PATCH 3.14 00/53] 3.14.74-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:00 +0200
  [PATCH 3.14 25/53] signal: remove warning about using SI_TKILL in rt_[tg]sigqueueinfo Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:00 +0200
  [PATCH 3.14 16/53] kprobes/x86: Clear TF bit in fault on single-stepping Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:00 +0200
  [PATCH 3.14 40/53] iio: accel: kxsd9: fix the usage of spi_w8r8() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:00 +0200
  [PATCH 3.14 39/53] staging: iio: accel: fix error check Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:00 +0200
  [PATCH 3.14 24/53] nfsd: check permissions when setting ACLs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:00 +0200
  [PATCH 3.14 03/53] ipmr/ip6mr: Initialize the last assert time of mfc entries. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:00 +0200
  [PATCH 3.14 05/53] usb: quirks: Add no-lpm quirk for Acer C120 LED Projector Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:00 +0200
  [PATCH 3.14 17/53] x86/amd_nb: Fix boot crash on non-AMD systems Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:00 +0200
  [PATCH 3.14 48/53] scsi: fix race between simultaneous decrements of ->host_failed Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:00 +0200
  [PATCH 3.14 49/53] Fix reconnect to not defer smb3 session reconnect long after socket reconnect Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:10 +0200
  [PATCH 3.14 47/53] ALSA: ctl: Stop notification after disconnection Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:10 +0200
  [PATCH 3.14 36/53] perf/x86: Honor the architectural performance monitoring version Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:20 +0200
  [PATCH 3.14 52/53] tmpfs: fix regression hang in fallocate undo Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:20 +0200
  [PATCH 3.14 43/53] iio:ad7266: Fix probe deferral for vref Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:20 +0200
  [PATCH 3.14 15/53] x86, build: copy ldlinux.c32 to image.iso Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:20 +0200
  [PATCH 3.14 50/53] xen/acpi: allow xen-acpi-processor driver to load on Xen 4.7 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:20 +0200
  [PATCH 3.14 31/53] HID: hiddev: validate num_values for HIDIOCGUSAGES, HIDIOCSUSAGES commands Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:20 +0200
  [PATCH 3.14 13/53] powerpc/tm: Always reclaim in start_thread() for exec() class syscalls Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:20 +0200
  [PATCH 3.14 41/53] iio:ad7266: Fix broken regulator error handling Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:20 +0200
  [PATCH 3.14 46/53] ALSA: au88x0: Fix calculation in vortex_wtdma_bufshift() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:20 +0200
  [PATCH 3.14 45/53] ALSA: dummy: Fix a use-after-free at closing Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:20 +0200
  [PATCH 3.14 11/53] powerpc/iommu: Remove the dependency on EEH struct in DDW mechanism Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:20 +0200
  [PATCH 3.14 53/53] s390/seccomp: fix error return for filtered system calls Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:20 +0200
  [PATCH 3.14 44/53] tty/vt/keyboard: fix OOB access in do_compute_shiftstate() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:20 +0200
  [PATCH 3.14 12/53] powerpc/pseries: Fix PCI config address for DDW Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:20 +0200
  [PATCH 3.14 32/53] tracing: Handle NULL formats in hold_module_trace_bprintk_format() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:20 +0200
  [PATCH 3.14 14/53] USB: EHCI: declare hostpc register as zero-length array Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:20 +0200
  [PATCH 3.14 37/53] perf/x86: Fix undefined shift on 32-bit kernels Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:20 +0200
  [PATCH 3.14 29/53] kvm: Fix irq route entries exceeding KVM_MAX_IRQ_ROUTES Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:20 +0200
  [PATCH 3.14 34/53] drm/radeon: fix asic initialization for virtualized environments Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:20 +0200
  [PATCH 3.14 51/53] tmpfs: dont undo fallocate past its last page Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:20 +0200
  [PATCH 3.14 30/53] HID: elo: kill not flush the work Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:20 +0200
  [PATCH 3.14 23/53] posix_acl: Add set_posix_acl Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:20 +0200
  [PATCH 3.14 42/53] iio:ad7266: Fix support for optional regulators Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-25 23:20 +0200
  [PATCH 3.14 04/53] net: alx: Work around the DMA RX overflow issue Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-26 00:50 +0200
  [PATCH 3.14 21/53] mm: Export migrate_page_move_mapping and migrate_page_copy Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-26 00:50 +0200
  [PATCH 3.14 22/53] UBIFS: Implement ->migratepage() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-26 00:50 +0200
  [PATCH 3.14 20/53] ARM: 8578/1: mm: ensure pmd_present only checks the valid bit Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-26 00:50 +0200
  [PATCH 3.14 19/53] NFS: Fix another OPEN_DOWNGRADE bug Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-26 00:50 +0200
  [PATCH 3.14 01/53] crypto: ux500 - memmove the right size Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-26 00:50 +0200
  [PATCH 3.14 07/53] usb: musb: Ensure rx reinit occurs for shared_fifo endpoints Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-26 00:50 +0200
  [PATCH 3.14 18/53] make nfs_atomic_open() call d_drop() on all ->open_context() errors. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-26 00:50 +0200
  [PATCH 3.14 02/53] sit: correct IP protocol used in ipip6_err Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-26 00:50 +0200
  [PATCH 3.14 10/53] IB/mlx4: Properly initialize GRH TClass and FlowLabel in AHs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-26 00:50 +0200
  [PATCH 3.14 28/53] KEYS: potential uninitialized variable Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-26 00:50 +0200
  [PATCH 3.14 09/53] mac80211_hwsim: Add missing check for HWSIM_ATTR_SIGNAL Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-26 00:50 +0200
  [PATCH 3.14 06/53] usb: musb: Stop bulk endpoint while queue is rotated Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-07-26 00:50 +0200
  Re: [PATCH 3.14 00/53] 3.14.74-stable review Shuah Khan <shuah.kh@samsung.com> - 2016-07-26 04:10 +0200
  Re: [PATCH 3.14 00/53] 3.14.74-stable review Guenter Roeck <linux@roeck-us.net> - 2016-07-26 16:00 +0200

csiph-web