From: Greg Kroah-Hartman Date: Mon, 31 Jan 2022 12:21:53 +0000 (+0100) Subject: drop arm-9170-1-fix-panic-when-kasan-and-kprobe-are-enabled.patch from 5.10 and older X-Git-Tag: v5.4.176~7 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=0b8f0d93d369c49a5176a5dd45ca217fc34c0f01;p=thirdparty%2Fkernel%2Fstable-queue.git drop arm-9170-1-fix-panic-when-kasan-and-kprobe-are-enabled.patch from 5.10 and older --- diff --git a/queue-4.14/arm-9170-1-fix-panic-when-kasan-and-kprobe-are-enabled.patch b/queue-4.14/arm-9170-1-fix-panic-when-kasan-and-kprobe-are-enabled.patch deleted file mode 100644 index 31c2b14d655..00000000000 --- a/queue-4.14/arm-9170-1-fix-panic-when-kasan-and-kprobe-are-enabled.patch +++ /dev/null @@ -1,114 +0,0 @@ -From 8b59b0a53c840921b625378f137e88adfa87647e Mon Sep 17 00:00:00 2001 -From: sparkhuang -Date: Wed, 15 Dec 2021 10:08:23 +0100 -Subject: ARM: 9170/1: fix panic when kasan and kprobe are enabled - -From: sparkhuang - -commit 8b59b0a53c840921b625378f137e88adfa87647e upstream. - -arm32 uses software to simulate the instruction replaced -by kprobe. some instructions may be simulated by constructing -assembly functions. therefore, before executing instruction -simulation, it is necessary to construct assembly function -execution environment in C language through binding registers. -after kasan is enabled, the register binding relationship will -be destroyed, resulting in instruction simulation errors and -causing kernel panic. - -the kprobe emulate instruction function is distributed in three -files: actions-common.c actions-arm.c actions-thumb.c, so disable -KASAN when compiling these files. - -for example, use kprobe insert on cap_capable+20 after kasan -enabled, the cap_capable assembly code is as follows: -: -e92d47f0 push {r4, r5, r6, r7, r8, r9, sl, lr} -e1a05000 mov r5, r0 -e280006c add r0, r0, #108 ; 0x6c -e1a04001 mov r4, r1 -e1a06002 mov r6, r2 -e59fa090 ldr sl, [pc, #144] ; -ebfc7bf8 bl c03aa4b4 <__asan_load4> -e595706c ldr r7, [r5, #108] ; 0x6c -e2859014 add r9, r5, #20 -...... -The emulate_ldr assembly code after enabling kasan is as follows: -c06f1384 : -e92d47f0 push {r4, r5, r6, r7, r8, r9, sl, lr} -e282803c add r8, r2, #60 ; 0x3c -e1a05000 mov r5, r0 -e7e37855 ubfx r7, r5, #16, #4 -e1a00008 mov r0, r8 -e1a09001 mov r9, r1 -e1a04002 mov r4, r2 -ebf35462 bl c03c6530 <__asan_load4> -e357000f cmp r7, #15 -e7e36655 ubfx r6, r5, #12, #4 -e205a00f and sl, r5, #15 -0a000001 beq c06f13bc -e0840107 add r0, r4, r7, lsl #2 -ebf3545c bl c03c6530 <__asan_load4> -e084010a add r0, r4, sl, lsl #2 -ebf3545a bl c03c6530 <__asan_load4> -e2890010 add r0, r9, #16 -ebf35458 bl c03c6530 <__asan_load4> -e5990010 ldr r0, [r9, #16] -e12fff30 blx r0 -e356000f cm r6, #15 -1a000014 bne c06f1430 -e1a06000 mov r6, r0 -e2840040 add r0, r4, #64 ; 0x40 -...... - -when running in emulate_ldr to simulate the ldr instruction, panic -occurred, and the log is as follows: -Unable to handle kernel NULL pointer dereference at virtual address -00000090 -pgd = ecb46400 -[00000090] *pgd=2e0fa003, *pmd=00000000 -Internal error: Oops: 206 [#1] SMP ARM -PC is at cap_capable+0x14/0xb0 -LR is at emulate_ldr+0x50/0xc0 -psr: 600d0293 sp : ecd63af8 ip : 00000004 fp : c0a7c30c -r10: 00000000 r9 : c30897f4 r8 : ecd63cd4 -r7 : 0000000f r6 : 0000000a r5 : e59fa090 r4 : ecd63c98 -r3 : c06ae294 r2 : 00000000 r1 : b7611300 r0 : bf4ec008 -Flags: nZCv IRQs off FIQs on Mode SVC_32 ISA ARM Segment user -Control: 32c5387d Table: 2d546400 DAC: 55555555 -Process bash (pid: 1643, stack limit = 0xecd60190) -(cap_capable) from (kprobe_handler+0x218/0x340) -(kprobe_handler) from (kprobe_trap_handler+0x24/0x48) -(kprobe_trap_handler) from (do_undefinstr+0x13c/0x364) -(do_undefinstr) from (__und_svc_finish+0x0/0x30) -(__und_svc_finish) from (cap_capable+0x18/0xb0) -(cap_capable) from (cap_vm_enough_memory+0x38/0x48) -(cap_vm_enough_memory) from -(security_vm_enough_memory_mm+0x48/0x6c) -(security_vm_enough_memory_mm) from -(copy_process.constprop.5+0x16b4/0x25c8) -(copy_process.constprop.5) from (_do_fork+0xe8/0x55c) -(_do_fork) from (SyS_clone+0x1c/0x24) -(SyS_clone) from (__sys_trace_return+0x0/0x10) -Code: 0050a0e1 6c0080e2 0140a0e1 0260a0e1 (f801f0e7) - -Fixes: 35aa1df43283 ("ARM kprobes: instruction single-stepping support") -Fixes: 421015713b30 ("ARM: 9017/2: Enable KASan for ARM") -Signed-off-by: huangshaobo -Acked-by: Ard Biesheuvel -Signed-off-by: Russell King (Oracle) -Signed-off-by: Greg Kroah-Hartman ---- - arch/arm/probes/kprobes/Makefile | 3 +++ - 1 file changed, 3 insertions(+) - ---- a/arch/arm/probes/kprobes/Makefile -+++ b/arch/arm/probes/kprobes/Makefile -@@ -1,4 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 -+KASAN_SANITIZE_actions-common.o := n -+KASAN_SANITIZE_actions-arm.o := n -+KASAN_SANITIZE_actions-thumb.o := n - obj-$(CONFIG_KPROBES) += core.o actions-common.o checkers-common.o - obj-$(CONFIG_ARM_KPROBES_TEST) += test-kprobes.o - test-kprobes-objs := test-core.o diff --git a/queue-4.14/series b/queue-4.14/series index 44185972baa..ba6d1dd14c2 100644 --- a/queue-4.14/series +++ b/queue-4.14/series @@ -22,7 +22,6 @@ rpmsg-char-fix-race-between-the-release-of-rpmsg_ctrldev-and-cdev.patch rpmsg-char-fix-race-between-the-release-of-rpmsg_eptdev-and-cdev.patch scsi-bnx2fc-flush-destroy_work-queue-before-calling-bnx2fc_interface_put.patch ipv6_tunnel-rate-limit-warning-messages.patch -arm-9170-1-fix-panic-when-kasan-and-kprobe-are-enabled.patch net-fix-information-leakage-in-proc-net-ptype.patch ping-fix-the-sk_bound_dev_if-match-in-ping_lookup.patch ipv4-avoid-using-shared-ip-generator-for-connected-sockets.patch diff --git a/queue-4.19/arm-9170-1-fix-panic-when-kasan-and-kprobe-are-enabled.patch b/queue-4.19/arm-9170-1-fix-panic-when-kasan-and-kprobe-are-enabled.patch deleted file mode 100644 index 31c2b14d655..00000000000 --- a/queue-4.19/arm-9170-1-fix-panic-when-kasan-and-kprobe-are-enabled.patch +++ /dev/null @@ -1,114 +0,0 @@ -From 8b59b0a53c840921b625378f137e88adfa87647e Mon Sep 17 00:00:00 2001 -From: sparkhuang -Date: Wed, 15 Dec 2021 10:08:23 +0100 -Subject: ARM: 9170/1: fix panic when kasan and kprobe are enabled - -From: sparkhuang - -commit 8b59b0a53c840921b625378f137e88adfa87647e upstream. - -arm32 uses software to simulate the instruction replaced -by kprobe. some instructions may be simulated by constructing -assembly functions. therefore, before executing instruction -simulation, it is necessary to construct assembly function -execution environment in C language through binding registers. -after kasan is enabled, the register binding relationship will -be destroyed, resulting in instruction simulation errors and -causing kernel panic. - -the kprobe emulate instruction function is distributed in three -files: actions-common.c actions-arm.c actions-thumb.c, so disable -KASAN when compiling these files. - -for example, use kprobe insert on cap_capable+20 after kasan -enabled, the cap_capable assembly code is as follows: -: -e92d47f0 push {r4, r5, r6, r7, r8, r9, sl, lr} -e1a05000 mov r5, r0 -e280006c add r0, r0, #108 ; 0x6c -e1a04001 mov r4, r1 -e1a06002 mov r6, r2 -e59fa090 ldr sl, [pc, #144] ; -ebfc7bf8 bl c03aa4b4 <__asan_load4> -e595706c ldr r7, [r5, #108] ; 0x6c -e2859014 add r9, r5, #20 -...... -The emulate_ldr assembly code after enabling kasan is as follows: -c06f1384 : -e92d47f0 push {r4, r5, r6, r7, r8, r9, sl, lr} -e282803c add r8, r2, #60 ; 0x3c -e1a05000 mov r5, r0 -e7e37855 ubfx r7, r5, #16, #4 -e1a00008 mov r0, r8 -e1a09001 mov r9, r1 -e1a04002 mov r4, r2 -ebf35462 bl c03c6530 <__asan_load4> -e357000f cmp r7, #15 -e7e36655 ubfx r6, r5, #12, #4 -e205a00f and sl, r5, #15 -0a000001 beq c06f13bc -e0840107 add r0, r4, r7, lsl #2 -ebf3545c bl c03c6530 <__asan_load4> -e084010a add r0, r4, sl, lsl #2 -ebf3545a bl c03c6530 <__asan_load4> -e2890010 add r0, r9, #16 -ebf35458 bl c03c6530 <__asan_load4> -e5990010 ldr r0, [r9, #16] -e12fff30 blx r0 -e356000f cm r6, #15 -1a000014 bne c06f1430 -e1a06000 mov r6, r0 -e2840040 add r0, r4, #64 ; 0x40 -...... - -when running in emulate_ldr to simulate the ldr instruction, panic -occurred, and the log is as follows: -Unable to handle kernel NULL pointer dereference at virtual address -00000090 -pgd = ecb46400 -[00000090] *pgd=2e0fa003, *pmd=00000000 -Internal error: Oops: 206 [#1] SMP ARM -PC is at cap_capable+0x14/0xb0 -LR is at emulate_ldr+0x50/0xc0 -psr: 600d0293 sp : ecd63af8 ip : 00000004 fp : c0a7c30c -r10: 00000000 r9 : c30897f4 r8 : ecd63cd4 -r7 : 0000000f r6 : 0000000a r5 : e59fa090 r4 : ecd63c98 -r3 : c06ae294 r2 : 00000000 r1 : b7611300 r0 : bf4ec008 -Flags: nZCv IRQs off FIQs on Mode SVC_32 ISA ARM Segment user -Control: 32c5387d Table: 2d546400 DAC: 55555555 -Process bash (pid: 1643, stack limit = 0xecd60190) -(cap_capable) from (kprobe_handler+0x218/0x340) -(kprobe_handler) from (kprobe_trap_handler+0x24/0x48) -(kprobe_trap_handler) from (do_undefinstr+0x13c/0x364) -(do_undefinstr) from (__und_svc_finish+0x0/0x30) -(__und_svc_finish) from (cap_capable+0x18/0xb0) -(cap_capable) from (cap_vm_enough_memory+0x38/0x48) -(cap_vm_enough_memory) from -(security_vm_enough_memory_mm+0x48/0x6c) -(security_vm_enough_memory_mm) from -(copy_process.constprop.5+0x16b4/0x25c8) -(copy_process.constprop.5) from (_do_fork+0xe8/0x55c) -(_do_fork) from (SyS_clone+0x1c/0x24) -(SyS_clone) from (__sys_trace_return+0x0/0x10) -Code: 0050a0e1 6c0080e2 0140a0e1 0260a0e1 (f801f0e7) - -Fixes: 35aa1df43283 ("ARM kprobes: instruction single-stepping support") -Fixes: 421015713b30 ("ARM: 9017/2: Enable KASan for ARM") -Signed-off-by: huangshaobo -Acked-by: Ard Biesheuvel -Signed-off-by: Russell King (Oracle) -Signed-off-by: Greg Kroah-Hartman ---- - arch/arm/probes/kprobes/Makefile | 3 +++ - 1 file changed, 3 insertions(+) - ---- a/arch/arm/probes/kprobes/Makefile -+++ b/arch/arm/probes/kprobes/Makefile -@@ -1,4 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 -+KASAN_SANITIZE_actions-common.o := n -+KASAN_SANITIZE_actions-arm.o := n -+KASAN_SANITIZE_actions-thumb.o := n - obj-$(CONFIG_KPROBES) += core.o actions-common.o checkers-common.o - obj-$(CONFIG_ARM_KPROBES_TEST) += test-kprobes.o - test-kprobes-objs := test-core.o diff --git a/queue-4.19/series b/queue-4.19/series index a52c5600133..ea400239e28 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -25,7 +25,6 @@ rpmsg-char-fix-race-between-the-release-of-rpmsg_ctrldev-and-cdev.patch rpmsg-char-fix-race-between-the-release-of-rpmsg_eptdev-and-cdev.patch scsi-bnx2fc-flush-destroy_work-queue-before-calling-bnx2fc_interface_put.patch ipv6_tunnel-rate-limit-warning-messages.patch -arm-9170-1-fix-panic-when-kasan-and-kprobe-are-enabled.patch net-fix-information-leakage-in-proc-net-ptype.patch ping-fix-the-sk_bound_dev_if-match-in-ping_lookup.patch ipv4-avoid-using-shared-ip-generator-for-connected-sockets.patch diff --git a/queue-4.4/arm-9170-1-fix-panic-when-kasan-and-kprobe-are-enabled.patch b/queue-4.4/arm-9170-1-fix-panic-when-kasan-and-kprobe-are-enabled.patch deleted file mode 100644 index 0759be6873c..00000000000 --- a/queue-4.4/arm-9170-1-fix-panic-when-kasan-and-kprobe-are-enabled.patch +++ /dev/null @@ -1,113 +0,0 @@ -From 8b59b0a53c840921b625378f137e88adfa87647e Mon Sep 17 00:00:00 2001 -From: sparkhuang -Date: Wed, 15 Dec 2021 10:08:23 +0100 -Subject: ARM: 9170/1: fix panic when kasan and kprobe are enabled - -From: sparkhuang - -commit 8b59b0a53c840921b625378f137e88adfa87647e upstream. - -arm32 uses software to simulate the instruction replaced -by kprobe. some instructions may be simulated by constructing -assembly functions. therefore, before executing instruction -simulation, it is necessary to construct assembly function -execution environment in C language through binding registers. -after kasan is enabled, the register binding relationship will -be destroyed, resulting in instruction simulation errors and -causing kernel panic. - -the kprobe emulate instruction function is distributed in three -files: actions-common.c actions-arm.c actions-thumb.c, so disable -KASAN when compiling these files. - -for example, use kprobe insert on cap_capable+20 after kasan -enabled, the cap_capable assembly code is as follows: -: -e92d47f0 push {r4, r5, r6, r7, r8, r9, sl, lr} -e1a05000 mov r5, r0 -e280006c add r0, r0, #108 ; 0x6c -e1a04001 mov r4, r1 -e1a06002 mov r6, r2 -e59fa090 ldr sl, [pc, #144] ; -ebfc7bf8 bl c03aa4b4 <__asan_load4> -e595706c ldr r7, [r5, #108] ; 0x6c -e2859014 add r9, r5, #20 -...... -The emulate_ldr assembly code after enabling kasan is as follows: -c06f1384 : -e92d47f0 push {r4, r5, r6, r7, r8, r9, sl, lr} -e282803c add r8, r2, #60 ; 0x3c -e1a05000 mov r5, r0 -e7e37855 ubfx r7, r5, #16, #4 -e1a00008 mov r0, r8 -e1a09001 mov r9, r1 -e1a04002 mov r4, r2 -ebf35462 bl c03c6530 <__asan_load4> -e357000f cmp r7, #15 -e7e36655 ubfx r6, r5, #12, #4 -e205a00f and sl, r5, #15 -0a000001 beq c06f13bc -e0840107 add r0, r4, r7, lsl #2 -ebf3545c bl c03c6530 <__asan_load4> -e084010a add r0, r4, sl, lsl #2 -ebf3545a bl c03c6530 <__asan_load4> -e2890010 add r0, r9, #16 -ebf35458 bl c03c6530 <__asan_load4> -e5990010 ldr r0, [r9, #16] -e12fff30 blx r0 -e356000f cm r6, #15 -1a000014 bne c06f1430 -e1a06000 mov r6, r0 -e2840040 add r0, r4, #64 ; 0x40 -...... - -when running in emulate_ldr to simulate the ldr instruction, panic -occurred, and the log is as follows: -Unable to handle kernel NULL pointer dereference at virtual address -00000090 -pgd = ecb46400 -[00000090] *pgd=2e0fa003, *pmd=00000000 -Internal error: Oops: 206 [#1] SMP ARM -PC is at cap_capable+0x14/0xb0 -LR is at emulate_ldr+0x50/0xc0 -psr: 600d0293 sp : ecd63af8 ip : 00000004 fp : c0a7c30c -r10: 00000000 r9 : c30897f4 r8 : ecd63cd4 -r7 : 0000000f r6 : 0000000a r5 : e59fa090 r4 : ecd63c98 -r3 : c06ae294 r2 : 00000000 r1 : b7611300 r0 : bf4ec008 -Flags: nZCv IRQs off FIQs on Mode SVC_32 ISA ARM Segment user -Control: 32c5387d Table: 2d546400 DAC: 55555555 -Process bash (pid: 1643, stack limit = 0xecd60190) -(cap_capable) from (kprobe_handler+0x218/0x340) -(kprobe_handler) from (kprobe_trap_handler+0x24/0x48) -(kprobe_trap_handler) from (do_undefinstr+0x13c/0x364) -(do_undefinstr) from (__und_svc_finish+0x0/0x30) -(__und_svc_finish) from (cap_capable+0x18/0xb0) -(cap_capable) from (cap_vm_enough_memory+0x38/0x48) -(cap_vm_enough_memory) from -(security_vm_enough_memory_mm+0x48/0x6c) -(security_vm_enough_memory_mm) from -(copy_process.constprop.5+0x16b4/0x25c8) -(copy_process.constprop.5) from (_do_fork+0xe8/0x55c) -(_do_fork) from (SyS_clone+0x1c/0x24) -(SyS_clone) from (__sys_trace_return+0x0/0x10) -Code: 0050a0e1 6c0080e2 0140a0e1 0260a0e1 (f801f0e7) - -Fixes: 35aa1df43283 ("ARM kprobes: instruction single-stepping support") -Fixes: 421015713b30 ("ARM: 9017/2: Enable KASan for ARM") -Signed-off-by: huangshaobo -Acked-by: Ard Biesheuvel -Signed-off-by: Russell King (Oracle) -Signed-off-by: Greg Kroah-Hartman ---- - arch/arm/probes/kprobes/Makefile | 3 +++ - 1 file changed, 3 insertions(+) - ---- a/arch/arm/probes/kprobes/Makefile -+++ b/arch/arm/probes/kprobes/Makefile -@@ -1,3 +1,6 @@ -+KASAN_SANITIZE_actions-common.o := n -+KASAN_SANITIZE_actions-arm.o := n -+KASAN_SANITIZE_actions-thumb.o := n - obj-$(CONFIG_KPROBES) += core.o actions-common.o checkers-common.o - obj-$(CONFIG_ARM_KPROBES_TEST) += test-kprobes.o - test-kprobes-objs := test-core.o diff --git a/queue-4.4/series b/queue-4.4/series index 3fa74557195..ee119728d23 100644 --- a/queue-4.4/series +++ b/queue-4.4/series @@ -12,7 +12,6 @@ usb-storage-add-unusual-devs-entry-for-vl817-usb-sata-bridge.patch usb-core-fix-hang-in-usb_kill_urb-by-adding-memory-barriers.patch scsi-bnx2fc-flush-destroy_work-queue-before-calling-bnx2fc_interface_put.patch ipv6_tunnel-rate-limit-warning-messages.patch -arm-9170-1-fix-panic-when-kasan-and-kprobe-are-enabled.patch net-fix-information-leakage-in-proc-net-ptype.patch ipv4-avoid-using-shared-ip-generator-for-connected-sockets.patch net-procfs-show-net-devices-bound-packet-types.patch diff --git a/queue-4.9/arm-9170-1-fix-panic-when-kasan-and-kprobe-are-enabled.patch b/queue-4.9/arm-9170-1-fix-panic-when-kasan-and-kprobe-are-enabled.patch deleted file mode 100644 index 0759be6873c..00000000000 --- a/queue-4.9/arm-9170-1-fix-panic-when-kasan-and-kprobe-are-enabled.patch +++ /dev/null @@ -1,113 +0,0 @@ -From 8b59b0a53c840921b625378f137e88adfa87647e Mon Sep 17 00:00:00 2001 -From: sparkhuang -Date: Wed, 15 Dec 2021 10:08:23 +0100 -Subject: ARM: 9170/1: fix panic when kasan and kprobe are enabled - -From: sparkhuang - -commit 8b59b0a53c840921b625378f137e88adfa87647e upstream. - -arm32 uses software to simulate the instruction replaced -by kprobe. some instructions may be simulated by constructing -assembly functions. therefore, before executing instruction -simulation, it is necessary to construct assembly function -execution environment in C language through binding registers. -after kasan is enabled, the register binding relationship will -be destroyed, resulting in instruction simulation errors and -causing kernel panic. - -the kprobe emulate instruction function is distributed in three -files: actions-common.c actions-arm.c actions-thumb.c, so disable -KASAN when compiling these files. - -for example, use kprobe insert on cap_capable+20 after kasan -enabled, the cap_capable assembly code is as follows: -: -e92d47f0 push {r4, r5, r6, r7, r8, r9, sl, lr} -e1a05000 mov r5, r0 -e280006c add r0, r0, #108 ; 0x6c -e1a04001 mov r4, r1 -e1a06002 mov r6, r2 -e59fa090 ldr sl, [pc, #144] ; -ebfc7bf8 bl c03aa4b4 <__asan_load4> -e595706c ldr r7, [r5, #108] ; 0x6c -e2859014 add r9, r5, #20 -...... -The emulate_ldr assembly code after enabling kasan is as follows: -c06f1384 : -e92d47f0 push {r4, r5, r6, r7, r8, r9, sl, lr} -e282803c add r8, r2, #60 ; 0x3c -e1a05000 mov r5, r0 -e7e37855 ubfx r7, r5, #16, #4 -e1a00008 mov r0, r8 -e1a09001 mov r9, r1 -e1a04002 mov r4, r2 -ebf35462 bl c03c6530 <__asan_load4> -e357000f cmp r7, #15 -e7e36655 ubfx r6, r5, #12, #4 -e205a00f and sl, r5, #15 -0a000001 beq c06f13bc -e0840107 add r0, r4, r7, lsl #2 -ebf3545c bl c03c6530 <__asan_load4> -e084010a add r0, r4, sl, lsl #2 -ebf3545a bl c03c6530 <__asan_load4> -e2890010 add r0, r9, #16 -ebf35458 bl c03c6530 <__asan_load4> -e5990010 ldr r0, [r9, #16] -e12fff30 blx r0 -e356000f cm r6, #15 -1a000014 bne c06f1430 -e1a06000 mov r6, r0 -e2840040 add r0, r4, #64 ; 0x40 -...... - -when running in emulate_ldr to simulate the ldr instruction, panic -occurred, and the log is as follows: -Unable to handle kernel NULL pointer dereference at virtual address -00000090 -pgd = ecb46400 -[00000090] *pgd=2e0fa003, *pmd=00000000 -Internal error: Oops: 206 [#1] SMP ARM -PC is at cap_capable+0x14/0xb0 -LR is at emulate_ldr+0x50/0xc0 -psr: 600d0293 sp : ecd63af8 ip : 00000004 fp : c0a7c30c -r10: 00000000 r9 : c30897f4 r8 : ecd63cd4 -r7 : 0000000f r6 : 0000000a r5 : e59fa090 r4 : ecd63c98 -r3 : c06ae294 r2 : 00000000 r1 : b7611300 r0 : bf4ec008 -Flags: nZCv IRQs off FIQs on Mode SVC_32 ISA ARM Segment user -Control: 32c5387d Table: 2d546400 DAC: 55555555 -Process bash (pid: 1643, stack limit = 0xecd60190) -(cap_capable) from (kprobe_handler+0x218/0x340) -(kprobe_handler) from (kprobe_trap_handler+0x24/0x48) -(kprobe_trap_handler) from (do_undefinstr+0x13c/0x364) -(do_undefinstr) from (__und_svc_finish+0x0/0x30) -(__und_svc_finish) from (cap_capable+0x18/0xb0) -(cap_capable) from (cap_vm_enough_memory+0x38/0x48) -(cap_vm_enough_memory) from -(security_vm_enough_memory_mm+0x48/0x6c) -(security_vm_enough_memory_mm) from -(copy_process.constprop.5+0x16b4/0x25c8) -(copy_process.constprop.5) from (_do_fork+0xe8/0x55c) -(_do_fork) from (SyS_clone+0x1c/0x24) -(SyS_clone) from (__sys_trace_return+0x0/0x10) -Code: 0050a0e1 6c0080e2 0140a0e1 0260a0e1 (f801f0e7) - -Fixes: 35aa1df43283 ("ARM kprobes: instruction single-stepping support") -Fixes: 421015713b30 ("ARM: 9017/2: Enable KASan for ARM") -Signed-off-by: huangshaobo -Acked-by: Ard Biesheuvel -Signed-off-by: Russell King (Oracle) -Signed-off-by: Greg Kroah-Hartman ---- - arch/arm/probes/kprobes/Makefile | 3 +++ - 1 file changed, 3 insertions(+) - ---- a/arch/arm/probes/kprobes/Makefile -+++ b/arch/arm/probes/kprobes/Makefile -@@ -1,3 +1,6 @@ -+KASAN_SANITIZE_actions-common.o := n -+KASAN_SANITIZE_actions-arm.o := n -+KASAN_SANITIZE_actions-thumb.o := n - obj-$(CONFIG_KPROBES) += core.o actions-common.o checkers-common.o - obj-$(CONFIG_ARM_KPROBES_TEST) += test-kprobes.o - test-kprobes-objs := test-core.o diff --git a/queue-4.9/series b/queue-4.9/series index cebbcf7de86..15fbd1b2e0b 100644 --- a/queue-4.9/series +++ b/queue-4.9/series @@ -14,7 +14,6 @@ usb-core-fix-hang-in-usb_kill_urb-by-adding-memory-barriers.patch powerpc-32-fix-boot-failure-with-gcc-latent-entropy-plugin.patch scsi-bnx2fc-flush-destroy_work-queue-before-calling-bnx2fc_interface_put.patch ipv6_tunnel-rate-limit-warning-messages.patch -arm-9170-1-fix-panic-when-kasan-and-kprobe-are-enabled.patch net-fix-information-leakage-in-proc-net-ptype.patch ipv4-avoid-using-shared-ip-generator-for-connected-sockets.patch nfsv4-handle-case-where-the-lookup-of-a-directory-fails.patch diff --git a/queue-5.10/arm-9170-1-fix-panic-when-kasan-and-kprobe-are-enabled.patch b/queue-5.10/arm-9170-1-fix-panic-when-kasan-and-kprobe-are-enabled.patch deleted file mode 100644 index 31c2b14d655..00000000000 --- a/queue-5.10/arm-9170-1-fix-panic-when-kasan-and-kprobe-are-enabled.patch +++ /dev/null @@ -1,114 +0,0 @@ -From 8b59b0a53c840921b625378f137e88adfa87647e Mon Sep 17 00:00:00 2001 -From: sparkhuang -Date: Wed, 15 Dec 2021 10:08:23 +0100 -Subject: ARM: 9170/1: fix panic when kasan and kprobe are enabled - -From: sparkhuang - -commit 8b59b0a53c840921b625378f137e88adfa87647e upstream. - -arm32 uses software to simulate the instruction replaced -by kprobe. some instructions may be simulated by constructing -assembly functions. therefore, before executing instruction -simulation, it is necessary to construct assembly function -execution environment in C language through binding registers. -after kasan is enabled, the register binding relationship will -be destroyed, resulting in instruction simulation errors and -causing kernel panic. - -the kprobe emulate instruction function is distributed in three -files: actions-common.c actions-arm.c actions-thumb.c, so disable -KASAN when compiling these files. - -for example, use kprobe insert on cap_capable+20 after kasan -enabled, the cap_capable assembly code is as follows: -: -e92d47f0 push {r4, r5, r6, r7, r8, r9, sl, lr} -e1a05000 mov r5, r0 -e280006c add r0, r0, #108 ; 0x6c -e1a04001 mov r4, r1 -e1a06002 mov r6, r2 -e59fa090 ldr sl, [pc, #144] ; -ebfc7bf8 bl c03aa4b4 <__asan_load4> -e595706c ldr r7, [r5, #108] ; 0x6c -e2859014 add r9, r5, #20 -...... -The emulate_ldr assembly code after enabling kasan is as follows: -c06f1384 : -e92d47f0 push {r4, r5, r6, r7, r8, r9, sl, lr} -e282803c add r8, r2, #60 ; 0x3c -e1a05000 mov r5, r0 -e7e37855 ubfx r7, r5, #16, #4 -e1a00008 mov r0, r8 -e1a09001 mov r9, r1 -e1a04002 mov r4, r2 -ebf35462 bl c03c6530 <__asan_load4> -e357000f cmp r7, #15 -e7e36655 ubfx r6, r5, #12, #4 -e205a00f and sl, r5, #15 -0a000001 beq c06f13bc -e0840107 add r0, r4, r7, lsl #2 -ebf3545c bl c03c6530 <__asan_load4> -e084010a add r0, r4, sl, lsl #2 -ebf3545a bl c03c6530 <__asan_load4> -e2890010 add r0, r9, #16 -ebf35458 bl c03c6530 <__asan_load4> -e5990010 ldr r0, [r9, #16] -e12fff30 blx r0 -e356000f cm r6, #15 -1a000014 bne c06f1430 -e1a06000 mov r6, r0 -e2840040 add r0, r4, #64 ; 0x40 -...... - -when running in emulate_ldr to simulate the ldr instruction, panic -occurred, and the log is as follows: -Unable to handle kernel NULL pointer dereference at virtual address -00000090 -pgd = ecb46400 -[00000090] *pgd=2e0fa003, *pmd=00000000 -Internal error: Oops: 206 [#1] SMP ARM -PC is at cap_capable+0x14/0xb0 -LR is at emulate_ldr+0x50/0xc0 -psr: 600d0293 sp : ecd63af8 ip : 00000004 fp : c0a7c30c -r10: 00000000 r9 : c30897f4 r8 : ecd63cd4 -r7 : 0000000f r6 : 0000000a r5 : e59fa090 r4 : ecd63c98 -r3 : c06ae294 r2 : 00000000 r1 : b7611300 r0 : bf4ec008 -Flags: nZCv IRQs off FIQs on Mode SVC_32 ISA ARM Segment user -Control: 32c5387d Table: 2d546400 DAC: 55555555 -Process bash (pid: 1643, stack limit = 0xecd60190) -(cap_capable) from (kprobe_handler+0x218/0x340) -(kprobe_handler) from (kprobe_trap_handler+0x24/0x48) -(kprobe_trap_handler) from (do_undefinstr+0x13c/0x364) -(do_undefinstr) from (__und_svc_finish+0x0/0x30) -(__und_svc_finish) from (cap_capable+0x18/0xb0) -(cap_capable) from (cap_vm_enough_memory+0x38/0x48) -(cap_vm_enough_memory) from -(security_vm_enough_memory_mm+0x48/0x6c) -(security_vm_enough_memory_mm) from -(copy_process.constprop.5+0x16b4/0x25c8) -(copy_process.constprop.5) from (_do_fork+0xe8/0x55c) -(_do_fork) from (SyS_clone+0x1c/0x24) -(SyS_clone) from (__sys_trace_return+0x0/0x10) -Code: 0050a0e1 6c0080e2 0140a0e1 0260a0e1 (f801f0e7) - -Fixes: 35aa1df43283 ("ARM kprobes: instruction single-stepping support") -Fixes: 421015713b30 ("ARM: 9017/2: Enable KASan for ARM") -Signed-off-by: huangshaobo -Acked-by: Ard Biesheuvel -Signed-off-by: Russell King (Oracle) -Signed-off-by: Greg Kroah-Hartman ---- - arch/arm/probes/kprobes/Makefile | 3 +++ - 1 file changed, 3 insertions(+) - ---- a/arch/arm/probes/kprobes/Makefile -+++ b/arch/arm/probes/kprobes/Makefile -@@ -1,4 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 -+KASAN_SANITIZE_actions-common.o := n -+KASAN_SANITIZE_actions-arm.o := n -+KASAN_SANITIZE_actions-thumb.o := n - obj-$(CONFIG_KPROBES) += core.o actions-common.o checkers-common.o - obj-$(CONFIG_ARM_KPROBES_TEST) += test-kprobes.o - test-kprobes-objs := test-core.o diff --git a/queue-5.10/series b/queue-5.10/series index 0d5cdc7a765..c7f8b56c231 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -49,7 +49,6 @@ rpmsg-char-fix-race-between-the-release-of-rpmsg_ctrldev-and-cdev.patch rpmsg-char-fix-race-between-the-release-of-rpmsg_eptdev-and-cdev.patch scsi-bnx2fc-flush-destroy_work-queue-before-calling-bnx2fc_interface_put.patch ipv6_tunnel-rate-limit-warning-messages.patch -arm-9170-1-fix-panic-when-kasan-and-kprobe-are-enabled.patch net-fix-information-leakage-in-proc-net-ptype.patch hwmon-lm90-mark-alert-as-broken-for-max6646-6647-6649.patch hwmon-lm90-mark-alert-as-broken-for-max6680.patch diff --git a/queue-5.4/arm-9170-1-fix-panic-when-kasan-and-kprobe-are-enabled.patch b/queue-5.4/arm-9170-1-fix-panic-when-kasan-and-kprobe-are-enabled.patch deleted file mode 100644 index 31c2b14d655..00000000000 --- a/queue-5.4/arm-9170-1-fix-panic-when-kasan-and-kprobe-are-enabled.patch +++ /dev/null @@ -1,114 +0,0 @@ -From 8b59b0a53c840921b625378f137e88adfa87647e Mon Sep 17 00:00:00 2001 -From: sparkhuang -Date: Wed, 15 Dec 2021 10:08:23 +0100 -Subject: ARM: 9170/1: fix panic when kasan and kprobe are enabled - -From: sparkhuang - -commit 8b59b0a53c840921b625378f137e88adfa87647e upstream. - -arm32 uses software to simulate the instruction replaced -by kprobe. some instructions may be simulated by constructing -assembly functions. therefore, before executing instruction -simulation, it is necessary to construct assembly function -execution environment in C language through binding registers. -after kasan is enabled, the register binding relationship will -be destroyed, resulting in instruction simulation errors and -causing kernel panic. - -the kprobe emulate instruction function is distributed in three -files: actions-common.c actions-arm.c actions-thumb.c, so disable -KASAN when compiling these files. - -for example, use kprobe insert on cap_capable+20 after kasan -enabled, the cap_capable assembly code is as follows: -: -e92d47f0 push {r4, r5, r6, r7, r8, r9, sl, lr} -e1a05000 mov r5, r0 -e280006c add r0, r0, #108 ; 0x6c -e1a04001 mov r4, r1 -e1a06002 mov r6, r2 -e59fa090 ldr sl, [pc, #144] ; -ebfc7bf8 bl c03aa4b4 <__asan_load4> -e595706c ldr r7, [r5, #108] ; 0x6c -e2859014 add r9, r5, #20 -...... -The emulate_ldr assembly code after enabling kasan is as follows: -c06f1384 : -e92d47f0 push {r4, r5, r6, r7, r8, r9, sl, lr} -e282803c add r8, r2, #60 ; 0x3c -e1a05000 mov r5, r0 -e7e37855 ubfx r7, r5, #16, #4 -e1a00008 mov r0, r8 -e1a09001 mov r9, r1 -e1a04002 mov r4, r2 -ebf35462 bl c03c6530 <__asan_load4> -e357000f cmp r7, #15 -e7e36655 ubfx r6, r5, #12, #4 -e205a00f and sl, r5, #15 -0a000001 beq c06f13bc -e0840107 add r0, r4, r7, lsl #2 -ebf3545c bl c03c6530 <__asan_load4> -e084010a add r0, r4, sl, lsl #2 -ebf3545a bl c03c6530 <__asan_load4> -e2890010 add r0, r9, #16 -ebf35458 bl c03c6530 <__asan_load4> -e5990010 ldr r0, [r9, #16] -e12fff30 blx r0 -e356000f cm r6, #15 -1a000014 bne c06f1430 -e1a06000 mov r6, r0 -e2840040 add r0, r4, #64 ; 0x40 -...... - -when running in emulate_ldr to simulate the ldr instruction, panic -occurred, and the log is as follows: -Unable to handle kernel NULL pointer dereference at virtual address -00000090 -pgd = ecb46400 -[00000090] *pgd=2e0fa003, *pmd=00000000 -Internal error: Oops: 206 [#1] SMP ARM -PC is at cap_capable+0x14/0xb0 -LR is at emulate_ldr+0x50/0xc0 -psr: 600d0293 sp : ecd63af8 ip : 00000004 fp : c0a7c30c -r10: 00000000 r9 : c30897f4 r8 : ecd63cd4 -r7 : 0000000f r6 : 0000000a r5 : e59fa090 r4 : ecd63c98 -r3 : c06ae294 r2 : 00000000 r1 : b7611300 r0 : bf4ec008 -Flags: nZCv IRQs off FIQs on Mode SVC_32 ISA ARM Segment user -Control: 32c5387d Table: 2d546400 DAC: 55555555 -Process bash (pid: 1643, stack limit = 0xecd60190) -(cap_capable) from (kprobe_handler+0x218/0x340) -(kprobe_handler) from (kprobe_trap_handler+0x24/0x48) -(kprobe_trap_handler) from (do_undefinstr+0x13c/0x364) -(do_undefinstr) from (__und_svc_finish+0x0/0x30) -(__und_svc_finish) from (cap_capable+0x18/0xb0) -(cap_capable) from (cap_vm_enough_memory+0x38/0x48) -(cap_vm_enough_memory) from -(security_vm_enough_memory_mm+0x48/0x6c) -(security_vm_enough_memory_mm) from -(copy_process.constprop.5+0x16b4/0x25c8) -(copy_process.constprop.5) from (_do_fork+0xe8/0x55c) -(_do_fork) from (SyS_clone+0x1c/0x24) -(SyS_clone) from (__sys_trace_return+0x0/0x10) -Code: 0050a0e1 6c0080e2 0140a0e1 0260a0e1 (f801f0e7) - -Fixes: 35aa1df43283 ("ARM kprobes: instruction single-stepping support") -Fixes: 421015713b30 ("ARM: 9017/2: Enable KASan for ARM") -Signed-off-by: huangshaobo -Acked-by: Ard Biesheuvel -Signed-off-by: Russell King (Oracle) -Signed-off-by: Greg Kroah-Hartman ---- - arch/arm/probes/kprobes/Makefile | 3 +++ - 1 file changed, 3 insertions(+) - ---- a/arch/arm/probes/kprobes/Makefile -+++ b/arch/arm/probes/kprobes/Makefile -@@ -1,4 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 -+KASAN_SANITIZE_actions-common.o := n -+KASAN_SANITIZE_actions-arm.o := n -+KASAN_SANITIZE_actions-thumb.o := n - obj-$(CONFIG_KPROBES) += core.o actions-common.o checkers-common.o - obj-$(CONFIG_ARM_KPROBES_TEST) += test-kprobes.o - test-kprobes-objs := test-core.o diff --git a/queue-5.4/series b/queue-5.4/series index 1ecd29baeef..add52f4ace2 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -30,7 +30,6 @@ rpmsg-char-fix-race-between-the-release-of-rpmsg_ctrldev-and-cdev.patch rpmsg-char-fix-race-between-the-release-of-rpmsg_eptdev-and-cdev.patch scsi-bnx2fc-flush-destroy_work-queue-before-calling-bnx2fc_interface_put.patch ipv6_tunnel-rate-limit-warning-messages.patch -arm-9170-1-fix-panic-when-kasan-and-kprobe-are-enabled.patch net-fix-information-leakage-in-proc-net-ptype.patch hwmon-lm90-mark-alert-as-broken-for-max6646-6647-6649.patch hwmon-lm90-mark-alert-as-broken-for-max6680.patch