tree 34401820401435bd08ff26c787f923ca3e7711ce
parent 3dbbaf200f532e01e56168b8339f2981f2cb1d67
author Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com> 1487689247 +0530
committer Michael Ellerman <mpe@ellerman.id.au> 1487798610 +1100

powerpc/optprobes: Fix TOC handling in optprobes trampoline

Optprobes on powerpc are limited to kernel text area. We decided to also
optimize kretprobe_trampoline since that is also in kernel text area.
However,we failed to take into consideration the fact that the same
trampoline is also used to catch function returns from kernel modules.
As an example:

  $ sudo modprobe kobject-example
  $ sudo bash -c "echo 'r foo_show+8' > /sys/kernel/debug/tracing/kprobe_events"
  $ sudo bash -c "echo 1 > /sys/kernel/debug/tracing/events/kprobes/enable"
  $ sudo cat /sys/kernel/debug/kprobes/list
  c000000000041350  k  kretprobe_trampoline+0x0    [OPTIMIZED]
  d000000000e00200  r  foo_show+0x8  kobject_example
  $ cat /sys/kernel/kobject_example/foo
  Segmentation fault

With the below (trimmed) splat in dmesg:

  Unable to handle kernel paging request for data at address 0xfec40000
  Faulting instruction address: 0xc000000000041540
  Oops: Kernel access of bad area, sig: 11 [#1]
  ...
  NIP [c000000000041540] optimized_callback+0x70/0xe0
  LR [c000000000041e60] optinsn_slot+0xf8/0x10000
  Call Trace:
  [c0000000c7327850] [c000000000289af4] alloc_set_pte+0x1c4/0x860 (unreliable)
  [c0000000c7327890] [c000000000041e60] optinsn_slot+0xf8/0x10000
  --- interrupt: 700 at 0xc0000000c7327a80
	       LR = kretprobe_trampoline+0x0/0x10
  [c0000000c7327ba0] [c0000000003a30d4] sysfs_kf_seq_show+0x104/0x1d0
  [c0000000c7327bf0] [c0000000003a0bb4] kernfs_seq_show+0x44/0x60
  [c0000000c7327c10] [c000000000330578] seq_read+0xf8/0x560
  [c0000000c7327cb0] [c0000000003a1e64] kernfs_fop_read+0x194/0x260
  [c0000000c7327d00] [c0000000002f9954] __vfs_read+0x44/0x1a0
  [c0000000c7327d90] [c0000000002fb4cc] vfs_read+0xbc/0x1b0
  [c0000000c7327de0] [c0000000002fd138] SyS_read+0x68/0x110
  [c0000000c7327e30] [c00000000000b8e0] system_call+0x38/0xfc

Fix this by loading up the kernel TOC before calling into the kernel.
The original TOC gets restored as part of the usual pt_regs restore.

Fixes: 762df10bad69 ("powerpc/kprobes: Optimize kprobe in kretprobe_trampoline()")
Signed-off-by: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>