linux-kernel - Re: WARNING: can't dereference registers at ffffc90004dfff60 for ip error_entry+0x7d/0xd0 (Re: [PATCH v2 00/18] Entry stack switching)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 22 Nov 2017 16:56:18 +0100
From:   Ingo Molnar <mingo@...nel.org>
To:     Andy Lutomirski <luto@...nel.org>
Cc:     Josh Poimboeuf <jpoimboe@...hat.com>, X86 ML <x86@...nel.org>,
        Borislav Petkov <bpetkov@...e.de>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        Brian Gerst <brgerst@...il.com>,
        Dave Hansen <dave.hansen@...el.com>,
        Linus Torvalds <torvalds@...ux-foundation.org>
Subject: Re: WARNING: can't dereference registers at ffffc90004dfff60 for ip
 error_entry+0x7d/0xd0 (Re: [PATCH v2 00/18] Entry stack switching)


* Andy Lutomirski <luto@...nel.org> wrote:

> >  .Lerror_entry_from_usermode_after_swapgs:
> >         /* Put us onto the real thread stack. */
> > -       leaq    8(%rsp), %rdi                   /* pt_regs pointer */
> > -       movq    (%rsp), %r12
> > +       popq    %r12                            /* function return address */
> > +       leaq    (%rsp), %rdi                    /* pt_regs pointer */
> >         call    sync_regs
> >         movq    %rax, %rsp                      /* switch stack */
> >         ENCODE_FRAME_POINTER
> 
> Ah, I see -- SAVE_C_REGS contains an UNWIND_HINT_REGS hint.  I had
> thought I needed to fix it differently.
> 
> Ingo, if you want to apply this, I attached it.  I'll fold it in next
> time I resend the whole  series.

Ok.

Also please fold back the minor fixes below - spelling fix plus ugly line breaks 
elimination.

Thanks,

	Ingo

=======>

 arch/x86/include/asm/fixmap.h | 2 +-
 arch/x86/kernel/cpu/common.c  | 7 ++-----
 arch/x86/kernel/dumpstack.c   | 6 ++----
 arch/x86/kernel/traps.c       | 3 +--
 4 files changed, 6 insertions(+), 12 deletions(-)

diff --git a/arch/x86/include/asm/fixmap.h b/arch/x86/include/asm/fixmap.h
index a40820216f66..8562356213cd 100644
--- a/arch/x86/include/asm/fixmap.h
+++ b/arch/x86/include/asm/fixmap.h
@@ -54,7 +54,7 @@ struct cpu_entry_area
 	char gdt[PAGE_SIZE];
 
 	/*
-	 * The gdt is just below cpu_tss and thus serves (on x86_64) as a
+	 * The GDT is just below cpu_tss and thus serves (on x86_64) as a
 	 * a read-only guard page for the SYSENTER stack at the bottom
 	 * of the TSS region.
 	 */
diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
index 3c0b69a6792b..6b949e6ea0f9 100644
--- a/arch/x86/kernel/cpu/common.c
+++ b/arch/x86/kernel/cpu/common.c
@@ -490,14 +490,12 @@ void load_percpu_segment(int cpu)
 	load_stack_canary_segment();
 }
 
-static void set_percpu_fixmap_pages(int fixmap_index, void *ptr, int pages,
-				    pgprot_t prot)
+static void set_percpu_fixmap_pages(int fixmap_index, void *ptr, int pages, pgprot_t prot)
 {
 	int i;
 
 	for (i = 0; i < pages; i++)
-		__set_fixmap(fixmap_index - i,
-			     per_cpu_ptr_to_phys(ptr + i*PAGE_SIZE), prot);
+		__set_fixmap(fixmap_index - i, per_cpu_ptr_to_phys(ptr + i*PAGE_SIZE), prot);
 }
 
 #ifdef CONFIG_X86_32
@@ -546,7 +544,6 @@ static inline void setup_cpu_entry_area(int cpu)
 	__set_fixmap(get_cpu_entry_area_index(cpu, gdt), get_cpu_gdt_paddr(cpu), gdt_prot);
 
 	/*
-	 *
 	 * The Intel SDM says (Volume 3, 7.2.1):
 	 *
 	 *  Avoid placing a page boundary in the part of the TSS that the
diff --git a/arch/x86/kernel/dumpstack.c b/arch/x86/kernel/dumpstack.c
index def64a91bd68..e9e70bce52ec 100644
--- a/arch/x86/kernel/dumpstack.c
+++ b/arch/x86/kernel/dumpstack.c
@@ -109,10 +109,8 @@ void show_trace_log_lvl(struct task_struct *task, struct pt_regs *regs,
 			 * See if the next page up is valid to that we can
 			 * generate some kind of backtrace if this happens.
 			 */
-			stack = (unsigned long *)
-				PAGE_ALIGN((unsigned long)stack);
-			if (get_stack_info(stack, task, &stack_info,
-					   &visit_mask))
+			stack = (unsigned long *)PAGE_ALIGN((unsigned long)stack);
+			if (get_stack_info(stack, task, &stack_info, &visit_mask))
 				break;
 		}
 
diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c
index 03f2bc1cbb30..cbc4272bb9dd 100644
--- a/arch/x86/kernel/traps.c
+++ b/arch/x86/kernel/traps.c
@@ -359,8 +359,7 @@ dotraplinkage void do_double_fault(struct pt_regs *regs, long error_code)
 		regs->cs == __KERNEL_CS &&
 		regs->ip == (unsigned long)native_irq_return_iret)
 	{
-		struct pt_regs *normal_regs =
-			(struct pt_regs *)this_cpu_read(cpu_tss.x86_tss.sp0) - 1;
+		struct pt_regs *normal_regs = (struct pt_regs *)this_cpu_read(cpu_tss.x86_tss.sp0) - 1;
 
 		/* Fake a #GP(0) from userspace. */
 		memmove(&normal_regs->ip, (void *)regs->sp, 5*8);