prevent kprobes from catching spurious page faults

commit 9be260a646bf76fa418ee519afa10196b3164681 upstream.

Prevent kprobes from catching spurious faults which will cause infinite
recursive page-fault and memory corruption by stack overflow.

Signed-off-by: Masami Hiramatsu <mhiramat@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c
index da1973b9a6e2c3a18163fb69f75ac27cf6e78078..33842556ce70828eaabf88854ca25fede937667e 100644 (file)
--- a/arch/x86/mm/fault.c
+++ b/arch/x86/mm/fault.c
@@ -607,8 +607,6 @@ void __kprobes do_page_fault(struct pt_regs *regs, unsigned long error_code)
 
        si_code = SEGV_MAPERR;
 
-       if (notify_page_fault(regs))
-               return;
        if (unlikely(kmmio_fault(regs, address)))
                return;
 
@@ -638,6 +636,9 @@ void __kprobes do_page_fault(struct pt_regs *regs, unsigned long error_code)
                if (spurious_fault(address, error_code))
                        return;
 
+               /* kprobes don't want to hook the spurious faults. */
+               if (notify_page_fault(regs))
+                       return;
                /*
                 * Don't take the mm semaphore here. If we fixup a prefetch
                 * fault we could otherwise deadlock.
@@ -645,6 +646,9 @@ void __kprobes do_page_fault(struct pt_regs *regs, unsigned long error_code)
                goto bad_area_nosemaphore;
        }
 
+       /* kprobes don't want to hook the spurious faults. */
+       if (notify_page_fault(regs))
+               return;
 
 #ifdef CONFIG_X86_32
        /* It's safe to allow irq's after cr2 has been saved and the vmalloc