prevent kprobes from catching spurious page faults

commit 9be260a646bf76fa418ee519afa10196b3164681 upstream.

Prevent kprobes from catching spurious faults which will cause infinite
recursive page-fault and memory corruption by stack overflow.

Signed-off-by: Masami Hiramatsu <mhiramat@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c
index 46f4cb168ac2f9712be93d8ddc48d13844f0a636..68dc0609b896b96786425609caba68eb9f9e0bbd 100644 (file)
--- a/arch/x86/mm/fault.c
+++ b/arch/x86/mm/fault.c
@@ -601,8 +601,6 @@ void __kprobes do_page_fault(struct pt_regs *regs, unsigned long error_code)
 
        si_code = SEGV_MAPERR;
 
-       if (notify_page_fault(regs))
-               return;
        if (unlikely(kmmio_fault(regs, address)))
                return;
 
@@ -632,6 +630,9 @@ void __kprobes do_page_fault(struct pt_regs *regs, unsigned long error_code)
                if (spurious_fault(address, error_code))
                        return;
 
+               /* kprobes don't want to hook the spurious faults. */
+               if (notify_page_fault(regs))
+                       return;
                /*
                 * Don't take the mm semaphore here. If we fixup a prefetch
                 * fault we could otherwise deadlock.
@@ -639,6 +640,9 @@ void __kprobes do_page_fault(struct pt_regs *regs, unsigned long error_code)
                goto bad_area_nosemaphore;
        }
 
+       /* kprobes don't want to hook the spurious faults. */
+       if (notify_page_fault(regs))
+               return;
 
        /*
         * It's safe to allow irq's after cr2 has been saved and the