• Masami Hiramatsu's avatar
    x86/alternatives: Sync bp_patching update for avoiding NULL pointer exception · 285a54ef
    Masami Hiramatsu authored
    ftracetest multiple_kprobes.tc testcase hits the following NULL pointer
    exception:
    
     BUG: kernel NULL pointer dereference, address: 0000000000000000
     PGD 800000007bf60067 P4D 800000007bf60067 PUD 7bf5f067 PMD 0
     Oops: 0000 [#1] PREEMPT SMP PTI
     RIP: 0010:poke_int3_handler+0x39/0x100
     Call Trace:
      <IRQ>
      do_int3+0xd/0xf0
      int3+0x42/0x50
      RIP: 0010:sched_clock+0x6/0x10
    
    poke_int3_handler+0x39 was alternatives:958:
    
      static inline void *text_poke_addr(struct text_poke_loc *tp)
      {
              return _stext + tp->rel_addr; <------ Here is line #958
      }
    
    This seems to be caused by tp (bp_patching.vec) being NULL but
    bp_patching.nr_entries != 0. There is a small chance for this
    to happen, because we have no synchronization between the zeroing
    of bp_patching.nr_entries and before clearing bp_patching.vec.
    
    Steve suggested we could fix this by adding sync_core(), because int3
    is done with interrupts disabled, and the on_each_cpu() requires
    all CPUs to have had their interrupts enabled.
    
     [ mingo: Edited the comments and the changelog. ]
    Suggested-by: default avatarSteven Rostedt (VMware) <rostedt@goodmis.org>
    Tested-by: default avatarAlexei Starovoitov <ast@kernel.org>
    Signed-off-by: default avatarMasami Hiramatsu <mhiramat@kernel.org>
    Cc: Andy Lutomirski <luto@kernel.org>
    Cc: Borislav Petkov <bp@alien8.de>
    Cc: Linus Torvalds <torvalds@linux-foundation.org>
    Cc: Peter Zijlstra <peterz@infradead.org>
    Cc: Thomas Gleixner <tglx@linutronix.de>
    Cc: bristot@redhat.com
    Fixes: c0213b0a ("x86/alternative: Batch of patch operations")
    Link: https://lkml.kernel.org/r/157483421229.25881.15314414408559963162.stgit@devnote2Signed-off-by: default avatarIngo Molnar <mingo@kernel.org>
    285a54ef
alternative.c 30.6 KB