File linux-2.6-s390-kprobes-fixes.patch of Package kernel
Date: Mon, 02 Oct 2006 11:52:23 +0200
From: Jan Glauber <jglauber@redhat.com>
Subject: [RHEL5 PATCH] kprobes s390: larl instruction fixup
BZ: 205738
The larl (load address relative long) loads an address relative to
the instruction counter into a register. If a kprobe hits a larl
instruction the stored address must be fixed. The instruction
counter must also be updated.
Without this patch the instruction counter is not fixed and still points
to the kprobes code. The kernel is therefore crashing if a kprobe is
placed on a larl.
This can be avoided by setting the fixup code to FIXUP_PSW_NORMAL _and_
FIXUP_RETURN_REGISTER.
Patch is upstream and tested by IBM.
Jan
--
jglauber@redhat.com
jang@de.ibm.com
--- linux-2.6.18.s390/arch/s390/kernel/kprobes.c.fix
+++ linux-2.6.18.s390/arch/s390/kernel/kprobes.c
@@ -134,10 +134,9 @@ void __kprobes get_instruction_type(stru
}
break;
case 0xc0:
- if ((*ainsn->insn & 0x0f) == 0x00) /* larl */
- ainsn->fixup = FIXUP_RETURN_REGISTER;
- if ((*ainsn->insn & 0x0f) == 0x05) /* brasl*/
- ainsn->fixup |= FIXUP_RETURN_REGISTER;
+ if ((*ainsn->insn & 0x0f) == 0x00 /* larl */
+ || (*ainsn->insn & 0x0f) == 0x05) /* brasl */
+ ainsn->fixup |= FIXUP_RETURN_REGISTER;
break;
case 0xeb:
if (*(((__u8 *) ainsn->insn) + 5 ) == 0x44 || /* bxhg */
Date: Mon, 02 Oct 2006 12:13:05 +0200
From: Jan Glauber <jglauber@redhat.com>
Subject: [RHEL5 PATCH] kprobes break user-space single stepping on s390
BZ: 205739
With kprobes we must distinguish between user-space single stepping
and SS in the kernel. This is done by checking if the instruction counter
was in the kernel.
Unfortunately we did scan the wrong PSW. That breaks user-space single
stepping since the SS flag (PER event) is cleared and handled as a
kprobe single-step.
The patch looks at the kernel PSW on the stack which is the correct one to check.
Patch is upstream and tested by IBM.
Jan
--
jglauber@redhat.com
jang@de.ibm.com
diff -urNp linux-2.6.18.s390/arch/s390/kernel/entry64.S linux-2.6.18.s390_xxx/arch/s390/kernel/entry64.S
--- linux-2.6.18.s390/arch/s390/kernel/entry64.S 2006-09-29 12:52:27.000000000 +0200
+++ linux-2.6.18.s390_xxx/arch/s390/kernel/entry64.S 2006-09-29 15:30:15.000000000 +0200
@@ -518,7 +518,7 @@ pgm_no_vtime2:
#endif
lg %r9,__LC_THREAD_INFO # load pointer to thread_info struct
lg %r1,__TI_task(%r9)
- tm __LC_PGM_OLD_PSW+1(%r15),0x01 # kernel per event ?
+ tm SP_PSW+1(%r15),0x01 # kernel per event ?
jz kernel_per
mvc __THREAD_per+__PER_atmid(2,%r1),__LC_PER_ATMID
mvc __THREAD_per+__PER_address(8,%r1),__LC_PER_ADDRESS
diff -urNp linux-2.6.18.s390/arch/s390/kernel/entry.S linux-2.6.18.s390_xxx/arch/s390/kernel/entry.S
--- linux-2.6.18.s390/arch/s390/kernel/entry.S 2006-09-29 12:52:27.000000000 +0200
+++ linux-2.6.18.s390_xxx/arch/s390/kernel/entry.S 2006-09-29 15:30:15.000000000 +0200
@@ -505,7 +505,7 @@ pgm_no_vtime2:
mvc __THREAD_per+__PER_address(4,%r1),__LC_PER_ADDRESS
mvc __THREAD_per+__PER_access_id(1,%r1),__LC_PER_ACCESS_ID
oi __TI_flags+3(%r9),_TIF_SINGLE_STEP # set TIF_SINGLE_STEP
- tm __LC_PGM_OLD_PSW+1(%r15),0x01 # kernel per event ?
+ tm SP_PSW+1(%r15),0x01 # kernel per event ?
bz BASED(kernel_per)
l %r3,__LC_PGM_ILC # load program interruption code
la %r8,0x7f
Date: Mon, 02 Oct 2006 13:56:13 +0200
From: Jan Glauber <jglauber@redhat.com>
Subject: [RHEL5 Patch] s390 hypfs crashes when specifying invalid mount
option
The same problem that was posted for RHEL4 is also in RHEL5, see
Josef Whiter's post from Sep 26.
A misspelled entry in /etc/fstab for hypfs crashes the mount process.
I'm not sure if this is a security issue since mount is setuid.
The RHEL5 BZ is 207717. Patch is tested by IBM and upstream.
Jan
--
jglauber@redhat.com
jang@de.ibm.com
--- linux-2.6.18.s390/arch/s390/hypfs/inode.c.fix
+++ linux-2.6.18.s390/arch/s390/hypfs/inode.c
@@ -311,10 +311,12 @@ static void hypfs_kill_super(struct supe
{
struct hypfs_sb_info *sb_info = sb->s_fs_info;
- hypfs_delete_tree(sb->s_root);
- hypfs_remove(sb_info->update_file);
- kfree(sb->s_fs_info);
- sb->s_fs_info = NULL;
+ if (sb->s_root) {
+ hypfs_delete_tree(sb->s_root);
+ hypfs_remove(sb_info->update_file);
+ kfree(sb->s_fs_info);
+ sb->s_fs_info = NULL;
+ }
kill_litter_super(sb);
}
