linux-stable.git/arch/mips/kernel/ftrace.c, branch linux-rolling-stable

MIPS: ftrace: Fix memory corruption when kernel is located beyond 32 bits

2026-01-02T11:57:03+00:00

[ Upstream commit 36dac9a3dda1f2bae343191bc16b910c603cac25 ]

Since commit e424054000878 ("MIPS: Tracing: Reduce the overhead of
dynamic Function Tracer"), the macro UASM_i_LA_mostly has been used,
and this macro can generate more than 2 instructions. At the same
time, the code in ftrace assumes that no more than 2 instructions can
be generated, which is why it stores them in an int[2] array. However,
as previously noted, the macro UASM_i_LA_mostly (and now UASM_i_LA)
causes a buffer overflow when _mcount is beyond 32 bits. This leads to
corruption of the variables located in the __read_mostly section.

This corruption was observed because the variable
__cpu_primary_thread_mask was corrupted, causing a hang very early
during boot.

This fix prevents the corruption by avoiding the generation of
instructions if they could exceed 2 instructions in
length. Fortunately, insn_la_mcount is only used if the instrumented
code is located outside the kernel code section, so dynamic ftrace can
still be used, albeit in a more limited scope. This is still
preferable to corrupting memory and/or crashing the kernel.

Signed-off-by: Gregory CLEMENT 
Signed-off-by: Thomas Bogendoerfer 
Signed-off-by: Sasha Levin

MIPS: ftrace: Declare ftrace_get_parent_ra_addr() as static

2025-01-11T11:37:05+00:00

Declare ftrace_get_parent_ra_addr() as static to suppress clang
compiler warning that 'no previous prototype'. This function is
not intended to be called from other parts.

Fix follow error with clang-19:

arch/mips/kernel/ftrace.c:251:15: error: no previous prototype for function 'ftrace_get_parent_ra_addr' [-Werror,-Wmissing-prototypes]
  251 | unsigned long ftrace_get_parent_ra_addr(unsigned long self_ra, unsigned long
      |               ^
arch/mips/kernel/ftrace.c:251:1: note: declare 'static' if the function is not intended to be used outside of this translation unit
  251 | unsigned long ftrace_get_parent_ra_addr(unsigned long self_ra, unsigned long
      | ^
      | static
1 error generated.

Signed-off-by: WangYuli 
Acked-by: Masami Hiramatsu (Google) 
Reviewed-by: Philippe Mathieu-Daudé 
Signed-off-by: Thomas Bogendoerfer

MIPS: kernel: Remove not needed set_fs calls

2021-04-06T12:36:56+00:00

flush_icache_range always does flush kernel address ranges, so no
need to do the set_fs dance.

Signed-off-by: Thomas Bogendoerfer 
Reviewed-by: Christoph Hellwig

Revert "MIPS: kernel: {ftrace,kgdb}: Set correct address limit for cache flushes"

2021-02-13T08:53:08+00:00

This reverts commit 6ebda44f366478d1eea180d93154e7d97b591f50.

All icache flushes in this code paths are done via flush_icache_range(),
which only uses normal cache instruction. And this is the correct thing
for EVA mode, too. So no need to do set_fs(KERNEL_DS) here.

Signed-off-by: Thomas Bogendoerfer 
Reviewed-by: Christoph Hellwig

MIPS: ftrace: Remove redundant #ifdef CONFIG_DYNAMIC_FTRACE

2020-08-17T11:00:24+00:00

There exists redundant #ifdef CONFIG_DYNAMIC_FTRACE in ftrace.c, remove it.

Signed-off-by: Zejiang Tang 
Reviewed-by: Steven Rostedt (VMware) 
Signed-off-by: Thomas Bogendoerfer

MIPS: ftrace: Reword prepare_ftrace_return() comment block

2019-06-11T22:46:21+00:00

Improve the comment block for prepare_ftrace_return().

Signed-off-by: Geert Uytterhoeven 
Signed-off-by: Paul Burton 
Cc: Ralf Baechle 
Cc: James Hogan 
Cc: Steven Rostedt 
Cc: Ingo Molnar 
Cc: linux-mips@vger.kernel.org
Cc: linux-kernel@vger.kernel.org

get rid of legacy 'get_ds()' function

2019-03-04T18:50:14+00:00

Every in-kernel use of this function defined it to KERNEL_DS (either as
an actual define, or as an inline function).  It's an entirely
historical artifact, and long long long ago used to actually read the
segment selector valueof '%ds' on x86.

Which in the kernel is always KERNEL_DS.

Inspired by a patch from Jann Horn that just did this for a very small
subset of users (the ones in fs/), along with Al who suggested a script.
I then just took it to the logical extreme and removed all the remaining
gunk.

Roughly scripted with

   git grep -l '(get_ds())' -- :^tools/ | xargs sed -i 's/(get_ds())/(KERNEL_DS)/'
   git grep -lw 'get_ds' -- :^tools/ | xargs sed -i '/^#define get_ds()/d'

plus manual fixups to remove a few unusual usage patterns, the couple of
inline function cases and to fix up a comment that had become stale.

The 'get_ds()' function remains in an x86 kvm selftest, since in user
space it actually does something relevant.

Inspired-by: Jann Horn 
Inspired-by: Al Viro 
Signed-off-by: Linus Torvalds

Merge tag 'mips_4.21' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux

2018-12-26T18:45:33+00:00

Pull MIPS updates from Paul Burton:
 "Here's the main MIPS pull for Linux 4.21. Core architecture changes
  include:

   - Syscall tables & definitions for unistd.h are now generated by
     scripts, providing greater consistency with other architectures &
     making it easier to add new syscalls.

   - Support for building kernels with no floating point support, upon
     which any userland attempting to use floating point instructions
     will receive a SIGILL. Mostly useful to shrink the kernel & as
     preparation for nanoMIPS support which does not yet include FP.

   - MIPS SIMD Architecture (MSA) vector register context is now exposed
     by ptrace via a new NT_MIPS_MSA regset.

   - ASIDs are now stored as 64b values even for MIPS32 kernels,
     expanding the ASID version field sufficiently that we don't need to
     worry about overflow & avoiding rare issues with reused ASIDs that
     have been observed in the wild.

   - The branch delay slot "emulation" page is now mapped without write
     permission for the user, preventing its use as a nice location for
     attacks to execute malicious code from.

   - Support for ioremap_prot(), primarily to allow gdb or other ptrace
     users the ability to view their tracee's memory using the same
     cache coherency attribute.

   - Optimizations to more cpu_has_* macros, allowing more to be
     compile-time constant where possible.

   - Enable building the whole kernel with UBSAN instrumentation.

   - Enable building the kernel with link-time dead code & data
     elimination.

  Platform specific changes include:

   - The Boston board gains a workaround for DMA prefetching issues with
     the EG20T Platform Controller Hub that it uses.

   - Cleanups to Cavium Octeon code removing about 20k lines of
     redundant code, mostly unused or duplicate register definitions in
     headers.

   - defconfig updates for the DECstation machines, including new
     defconfigs for r4k & 64b machines.

   - Further work on Loongson 3 support.

   - DMA fixes for SiByte machines"

* tag 'mips_4.21' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux: (95 commits)
  MIPS: math-emu: Write-protect delay slot emulation pages
  MIPS: Remove struct mm_context_t fp_mode_switching field
  mips: generate uapi header and system call table files
  mips: add system call table generation support
  mips: remove syscall table entries
  mips: add +1 to __NR_syscalls in uapi header
  mips: rename scall64-64.S to scall64-n64.S
  mips: remove unused macros
  mips: add __NR_syscalls along with __NR_Linux_syscalls
  MIPS: Expand MIPS32 ASIDs to 64 bits
  MIPS: OCTEON: delete redundant register definitions
  MIPS: OCTEON: cvmx_gmxx_inf_mode: use oldest forward compatible definition
  MIPS: OCTEON: cvmx_mio_fus_dat3: use oldest forward compatible definition
  MIPS: OCTEON: cvmx_pko_mem_debug8: use oldest forward compatible definition
  MIPS: OCTEON: octeon-usb: use common gpio_bit definition
  MIPS: OCTEON: enable all OCTEON drivers in defconfig
  mips: annotate implicit fall throughs
  MIPS: Hardcode cpu_has_mips* where target ISA allows
  MIPS: MT: Remove norps command line parameter
  MIPS: Only include mmzone.h when CONFIG_NEED_MULTIPLE_NODES=y
  ...

mips: add +1 to __NR_syscalls in uapi header

2018-12-14T19:19:01+00:00

All other architectures are hold a value for __NR_syscalls will
be equal to the last system call number +1.

But in mips architecture, __NR_syscalls hold the value equal to
total number of system exits in the architecture. One of the
patch in this patch series will genarate uapi header files.

In order to make the implementation common across all architect-
ures, add +1 to __NR_syscalls, which will be equal to the last
system call number +1.

Signed-off-by: Firoz Khan 
Signed-off-by: Paul Burton 
Cc: linux-mips@vger.kernel.org
Cc: Ralf Baechle 
Cc: James Hogan 
Cc: Greg Kroah-Hartman 
Cc: Philippe Ombredanne 
Cc: Thomas Gleixner 
Cc: Kate Stewart 
Cc: y2038@lists.linaro.org
Cc: linux-kernel@vger.kernel.org
Cc: linux-arch@vger.kernel.org
Cc: arnd@arndb.de
Cc: deepa.kernel@gmail.com
Cc: marcin.juszkiewicz@linaro.org

MIPS: function_graph: Simplify with function_graph_enter()

2018-11-28T01:30:36+00:00

The function_graph_enter() function does the work of calling the function
graph hook function and the management of the shadow stack, simplifying the
work done in the architecture dependent prepare_ftrace_return().

Have MIPS use the new code, and remove the shadow stack management as well as
having to set up the trace structure.

This is needed to prepare for a fix of a design bug on how the curr_ret_stack
is used.

Cc: Ralf Baechle 
Cc: Paul Burton 
Cc: James Hogan 
Cc: linux-mips@linux-mips.org
Cc: stable@kernel.org
Fixes: 03274a3ffb449 ("tracing/fgraph: Adjust fgraph depth before calling trace return callback")
Reviewed-by: Masami Hiramatsu 
Signed-off-by: Steven Rostedt (VMware)