linux-kernel - Re: [PATCH v2 36/44] x86/entry/unwind: encode pt

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 8 Aug 2016 18:06:20 -0500
From:	Josh Poimboeuf <jpoimboe@...hat.com>
To:	Thomas Gleixner <tglx@...utronix.de>,
	Ingo Molnar <mingo@...nel.org>,
	"H . Peter Anvin" <hpa@...or.com>
Cc:	x86@...nel.org, linux-kernel@...r.kernel.org,
	Andy Lutomirski <luto@...capital.net>,
	Linus Torvalds <torvalds@...ux-foundation.org>,
	Steven Rostedt <rostedt@...dmis.org>,
	Brian Gerst <brgerst@...il.com>,
	Kees Cook <keescook@...omium.org>,
	Peter Zijlstra <peterz@...radead.org>,
	Frederic Weisbecker <fweisbec@...il.com>,
	Byungchul Park <byungchul.park@....com>
Subject: Re: [PATCH v2 36/44] x86/entry/unwind: encode pt_regs pointer in
 frame pointer

On Thu, Aug 04, 2016 at 05:22:32PM -0500, Josh Poimboeuf wrote:
> With frame pointers, when a task is interrupted, its stack is no longer
> completely reliable because the function could have been interrupted
> before it had a chance to save the previous frame pointer on the stack.
> So the caller of the interrupted function could get skipped by a stack
> trace.
> 
> This is problematic for live patching, which needs to know whether a
> stack trace of a sleeping task can be relied upon.  There's currently no
> way to detect if a sleeping task was interrupted by a page fault
> exception or preemption before it went to sleep.
> 
> Another issue is that when dumping the stack of an interrupted task, the
> unwinder has no way of knowing where the saved pt_regs registers are, so
> it can't print them.
> 
> This solves those issues by encoding the pt_regs pointer in the frame
> pointer on entry from an interrupt or an exception.  The frame pointer
> unwinder is also updated to decode it.
> 
> Suggested-by: Andy Lutomirski <luto@...capital.net>
> Signed-off-by: Josh Poimboeuf <jpoimboe@...hat.com>

When doing some testing on x86_32, I realized there's a flaw here in the
unwinder's pt_regs detection, when an interrupt hits when we're already
in the entry code.  For example, a page fault can be interrupted by an
irq, after the page fault entry code encoded the frame pointer, but
before it had a chance to call into the C handler.

In that case, regs->bp itself is encoded, and the current "pt_regs
aren't real frames" design falls apart because there can actually be
more than one set of pt_regs per "frame".  So the unwinder gets confused
and stops walking the stack too early.

So really the unwinder needs to consider each pt_regs as a frame in and
of itself.  Which of course Andy already suggested before, but I
stupidly shot it down.

Working on that for v3.

-- 
Josh