linux-kernel - Re: [PATCH v3 44/51] x86/dumpstack: print any pt

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Sun, 14 Aug 2016 01:16:14 -0700
From:	Andy Lutomirski <luto@...capital.net>
To:	Josh Poimboeuf <jpoimboe@...hat.com>
Cc:	Thomas Gleixner <tglx@...utronix.de>,
	Ingo Molnar <mingo@...nel.org>,
	"H . Peter Anvin" <hpa@...or.com>, X86 ML <x86@...nel.org>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	Linus Torvalds <torvalds@...ux-foundation.org>,
	Steven Rostedt <rostedt@...dmis.org>,
	Brian Gerst <brgerst@...il.com>,
	Kees Cook <keescook@...omium.org>,
	Peter Zijlstra <peterz@...radead.org>,
	Frederic Weisbecker <fweisbec@...il.com>,
	Byungchul Park <byungchul.park@....com>,
	Nilay Vaish <nilayvaish@...il.com>
Subject: Re: [PATCH v3 44/51] x86/dumpstack: print any pt_regs found on the stack

On Fri, Aug 12, 2016 at 7:29 AM, Josh Poimboeuf <jpoimboe@...hat.com> wrote:
> Now that we can find pt_regs registers on the stack, print them.  Here's
> an example of what it looks like:
>
> Call Trace:
>  <IRQ>
>  [<ffffffff8144b793>] dump_stack+0x86/0xc3
>  [<ffffffff81142c73>] hrtimer_interrupt+0xb3/0x1c0
>  [<ffffffff8105eb86>] local_apic_timer_interrupt+0x36/0x60
>  [<ffffffff818b27cd>] smp_apic_timer_interrupt+0x3d/0x50
>  [<ffffffff818b06ee>] apic_timer_interrupt+0x9e/0xb0
> RIP: 0010:[<ffffffff818aef43>]  [<ffffffff818aef43>] _raw_spin_unlock_irq+0x33/0x60
> RSP: 0018:ffff880079c4f760  EFLAGS: 00000202
> RAX: ffff880078738000 RBX: ffff88007d3da0c0 RCX: 0000000000000007
> RDX: 0000000000006d78 RSI: ffff8800787388f0 RDI: ffff880078738000
> RBP: ffff880079c4f768 R08: 0000002199088f38 R09: 0000000000000000
> R10: 0000000000000000 R11: 0000000000000000 R12: ffffffff81e0d540
> R13: ffff8800369fb700 R14: 0000000000000000 R15: ffff880078738000
>  <EOI>
>  [<ffffffff810e1f14>] finish_task_switch+0xb4/0x250
>  [<ffffffff810e1ed6>] ? finish_task_switch+0x76/0x250
>  [<ffffffff818a7b61>] __schedule+0x3e1/0xb20
>  ...
>  [<ffffffff810759c8>] trace_do_page_fault+0x58/0x2c0
>  [<ffffffff8106f7dc>] do_async_page_fault+0x2c/0xa0
>  [<ffffffff818b1dd8>] async_page_fault+0x28/0x30
> RIP: 0010:[<ffffffff8145b062>]  [<ffffffff8145b062>] __clear_user+0x42/0x70
> RSP: 0018:ffff880079c4fd38  EFLAGS: 00010202
> RAX: 0000000000000000 RBX: 0000000000000138 RCX: 0000000000000138
> RDX: 0000000000000000 RSI: 0000000000000008 RDI: 000000000061b640
> RBP: ffff880079c4fd48 R08: 0000002198feefd7 R09: ffffffff82a40928
> R10: 0000000000000001 R11: 0000000000000000 R12: 000000000061b640
> R13: 0000000000000000 R14: ffff880079c50000 R15: ffff8800791d7400
>  [<ffffffff8145b043>] ? __clear_user+0x23/0x70
>  [<ffffffff8145b0fb>] clear_user+0x2b/0x40
>  [<ffffffff812fbda2>] load_elf_binary+0x1472/0x1750
>  [<ffffffff8129a591>] search_binary_handler+0xa1/0x200
>  [<ffffffff8129b69b>] do_execveat_common.isra.36+0x6cb/0x9f0
>  [<ffffffff8129b5f3>] ? do_execveat_common.isra.36+0x623/0x9f0
>  [<ffffffff8129bcaa>] SyS_execve+0x3a/0x50
>  [<ffffffff81003f5c>] do_syscall_64+0x6c/0x1e0
>  [<ffffffff818afa3f>] entry_SYSCALL64_slow_path+0x25/0x25
> RIP: 0033:[<00007fd2e2f2e537>]  [<00007fd2e2f2e537>] 0x7fd2e2f2e537
> RSP: 002b:00007ffc449c5fc8  EFLAGS: 00000246
> RAX: ffffffffffffffda RBX: 00007ffc449c8860 RCX: 00007fd2e2f2e537
> RDX: 000000000127cc40 RSI: 00007ffc449c8860 RDI: 00007ffc449c6029
> RBP: 00007ffc449c60b0 R08: 65726f632d667265 R09: 00007ffc449c5e20
> R10: 00000000000005a7 R11: 0000000000000246 R12: 000000000127cc40
> R13: 000000000127ce05 R14: 00007ffc449c6029 R15: 000000000127ce01

I really like this, and I think it'll be quite useful for future debugging.

Some day I want to teach this thing to print gsbase as well, but it's
not quite obvious to me how to do that except maybe by using DWARF and
a lot of special case code.

--Andy