Commit 285a54ef authored by Masami Hiramatsu's avatar Masami Hiramatsu Committed by Ingo Molnar
Browse files

x86/alternatives: Sync bp_patching update for avoiding NULL pointer exception

ftracetest testcase hits the following NULL pointer

 BUG: kernel NULL pointer dereference, address: 0000000000000000
 PGD 800000007bf60067 P4D 800000007bf60067 PUD 7bf5f067 PMD 0
 Oops: 0000 [#1] PREEMPT SMP PTI
 RIP: 0010:poke_int3_handler+0x39/0x100
 Call Trace:
  RIP: 0010:sched_clock+0x6/0x10

poke_int3_handler+0x39 was alternatives:958:

  static inline void *text_poke_addr(struct text_poke_loc *tp)
          return _stext + tp->rel_addr; <------ Here is line #958

This seems to be caused by tp (bp_patching.vec) being NULL but
bp_patching.nr_entries != 0. There is a small chance for this
to happen, because we have no synchronization between the zeroing
of bp_patching.nr_entries and before clearing bp_patching.vec.

Steve suggested we could fix this by adding sync_core(), because int3
is done with interrupts disabled, and the on_each_cpu() requires
all CPUs to have had their interrupts enabled.

 [ mingo: Edited the comments and the changelog. ]

Suggested-by: default avatarSteven Rostedt (VMware) <>
Tested-by: default avatarAlexei Starovoitov <>
Signed-off-by: default avatarMasami Hiramatsu <>
Cc: Andy Lutomirski <>
Cc: Borislav Petkov <>
Cc: Linus Torvalds <>
Cc: Peter Zijlstra <>
Cc: Thomas Gleixner <>
Fixes: c0213b0a ("x86/alternative: Batch of patch operations")

Signed-off-by: default avatarIngo Molnar <>
parent 76ffa720
......@@ -1134,8 +1134,14 @@ static void text_poke_bp_batch(struct text_poke_loc *tp, unsigned int nr_entries
* sync_core() implies an smp_mb() and orders this store against
* the writing of the new instruction.
bp_patching.vec = NULL;
bp_patching.nr_entries = 0;
* This sync_core () call ensures that all INT3 handlers in progress
* have finished. This allows poke_int3_handler() after this to
* avoid touching bp_paching.vec by checking nr_entries == 0.
bp_patching.vec = NULL;
void text_poke_loc_init(struct text_poke_loc *tp, void *addr,
Supports Markdown
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment