linux-kernel - Re: [PATCH] perf: fix kernel panic when parsing user space CS saved in pt

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20140605073321.GA14869@lskakaxi-intel>
Date:	Thu, 5 Jun 2014 15:33:21 +0800
From:	Liu ShuoX <shuox.liu@...el.com>
To:	Peter Zijlstra <peterz@...radead.org>
Cc:	linux-kernel@...r.kernel.org, "H. Peter Anvin" <hpa@...or.com>,
	Ingo Molnar <mingo@...hat.com>,
	Zhang Yanmin <yanmin.zhang@...el.com>,
	yanmin_zhang@...ux.intel.com
Subject: Re: [PATCH] perf: fix kernel panic when parsing user space CS saved
 in pt_regs

On Thu  5.Jun'14 at  9:19:19 +0200, Peter Zijlstra wrote:
>On Thu, Jun 05, 2014 at 10:36:10AM +0800, Liu ShuoX wrote:
>> From: Zhang Yanmin <yanmin.zhang@...el.com>
>>
>> We hit a kernel panic when running perf to collect some performance data.
>> kenel is x86_64 and user space apps are 32bit.
>>
>> [   71.965351, 1] [       Binder_2] BUG: unable to handle kernel NULL pointer dereference at 0000000000000004
>> [   71.965360, 1] [       Binder_2] IP: [<ffffffff82012091>] get_segment_base+0x71/0xc0
>> [   71.965367, 1] [       Binder_2] PGD 6c65f067 PUD 0
>> [   71.965375, 1] [       Binder_2] Oops: 0000 [#1] PREEMPT SMP
>> [   71.965413, 1] [       Binder_2] Modules linked in: ddrgx snd_merr_dpcm_wm8958 snd_intel_sst snd_soc_sst_platform snd_soc_wm8994 snd_soc_wm_hubs lm3559 imx1x5 atomisp_css2401a0_v21 libmsrlisthelper rmi4 bcm_bt_lpm videobuf_vmalloc videobuf_core fps_throttle hdmi_audio pn544(O) tngdisp bcm4335(O) cfg80211
>> [   71.965420, 1] [       Binder_2] CPU: 1 PID: 304 Comm: Binder_2 Tainted: G        W  O 3.10.20-263902-g184bfbc-dirty #14
>> [   71.965426, 1] [       Binder_2] task: ffff8800764dc300 ti: ffff88006c6e8000 task.ti: ffff88006c6e8000
>> [   71.965439, 1] [       Binder_2] RIP: 0010:[<ffffffff82012091>]  [<ffffff?f82012091>] get_segment_base+0x71/0xc0
>                                                                              ^
>> [   71.965<44, 1] [       Binder_2] RSP: 0018:ffff^X8007ea87b98  EFLAGS: 00010092
>            ^                                       ^
>> [   71.965447, 1] [      !Binder_2] RAX: 0000000000000024 RBX: 0000000000000000 RCX: 0000000000000000
>                           ^
>> [   71.965450, 1] [       Binder_2] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000009
>> [   71.965454, 1] [       Binder_2] RBP: ffff88007ea87ba8 R08: ffffffff83143b3c R09: ffffffff831848a8
>> [   71.965458, 1] [       Binder_2] R10: 0000000000000000 R11: 00000000001bf2d8 R12: 0000000000000000
>> [   71.965462, 1] [       Binder_2] R13: ffff88006c6e9fd8 R14: ffff88006c6e9f58 R15: ffff8800764dc300
>> [   71.965468, 1_ [       Binder_2] FS:  0000000000000000(0000) GS:ffff88007ea80000(006b) knlGS:00000000f704add0
>                  ^
>
>Are you suffering some serious corruption?
The log captured by pstore after rebooting, so there are some
corruption. Please ignore those.
>
>> Basically, ia32 uses sysenter to start system calls.
>>
>> sysexit_from_sys_call=>trace_hardirqs_on_thunk. Before calling,
>> sysexit_from_sys_call already pops up pt_regs, then trace_hardirqs_on_thunk
>> would reuse pt_regs space. If perf NMI happens here, perf might use a bad pt_regs.
>>
>> The patch fixes it  by moving the calling to trace_hardirqs_on_thunk ahead of
>> the stack popup.
>>
>> Change-Id: I6c4fc46b009ea056f2321ce5b8f54cf8769a7bdd
>
>No idea what that is, but it needs to go.
>
>I'll leave the actual patch to hpa, this isn't something I'm too
>familiar with.
Thanks. I will send out v2. We changed the code in v2.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/