• Benjamin Gray's avatar
    powerpc/dexcr: Move HASHCHK trap handler · c3f43096
    Benjamin Gray authored
    Syzkaller reported a sleep in atomic context bug relating to the HASHCHK
    handler logic:
    
      BUG: sleeping function called from invalid context at arch/powerpc/kernel/traps.c:1518
      in_atomic(): 0, irqs_disabled(): 1, non_block: 0, pid: 25040, name: syz-executor
      preempt_count: 0, expected: 0
      RCU nest depth: 0, expected: 0
      no locks held by syz-executor/25040.
      irq event stamp: 34
      hardirqs last  enabled at (33): [<c000000000048b38>] prep_irq_for_enabled_exit arch/powerpc/kernel/interrupt.c:56 [inline]
      hardirqs last  enabled at (33): [<c000000000048b38>] interrupt_exit_user_prepare_main+0x148/0x600 arch/powerpc/kernel/interrupt.c:230
      hardirqs last disabled at (34): [<c00000000003e6a4>] interrupt_enter_prepare+0x144/0x4f0 arch/powerpc/include/asm/interrupt.h:176
      softirqs last  enabled at (0): [<c000000000281954>] copy_process+0x16e4/0x4750 kernel/fork.c:2436
      softirqs last disabled at (0): [<0000000000000000>] 0x0
      CPU: 15 PID: 25040 Comm: syz-executor Not tainted 6.5.0-rc5-00001-g3ccdff6bb06d #3
      Hardware name: IBM,9105-22A POWER10 (raw) 0x800200 0xf000006 of:IBM,FW1040.00 (NL1040_021) hv:phyp pSeries
      Call Trace:
      [c0000000a8247ce0] [c00000000032b0e4] __might_resched+0x3b4/0x400 kernel/sched/core.c:10189
      [c0000000a8247d80] [c0000000008c7dc8] __might_fault+0xa8/0x170 mm/memory.c:5853
      [c0000000a8247dc0] [c00000000004160c] do_program_check+0x32c/0xb20 arch/powerpc/kernel/traps.c:1518
      [c0000000a8247e50] [c000000000009b2c] program_check_common_virt+0x3bc/0x3c0
    
    To determine if a trap was caused by a HASHCHK instruction, we inspect
    the user instruction that triggered the trap. However this may sleep
    if the page needs to be faulted in (get_user_instr() reaches
    __get_user(), which calls might_fault() and triggers the bug message).
    
    Move the HASHCHK handler logic to after we allow IRQs, which is fine
    because we are only interested in HASHCHK if it's a user space trap.
    
    Fixes: 5bcba4e6 ("powerpc/dexcr: Handle hashchk exception")
    Signed-off-by: default avatarBenjamin Gray <bgray@linux.ibm.com>
    Signed-off-by: default avatarMichael Ellerman <mpe@ellerman.id.au>
    Link: https://msgid.link/20230915034604.45393-1-bgray@linux.ibm.com
    c3f43096
traps.c 60.7 KB