linux-kernel - Re: [RFC 1/3] ftrace: adjust a function's pc to search for in check

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 15 Jul 2015 09:22:34 +0900
From:	AKASHI Takahiro <takahiro.akashi@...aro.org>
To:	Steven Rostedt <rostedt@...dmis.org>
CC:	catalin.marinas@....com, will.deacon@....com,
	jungseoklee85@...il.com, olof@...om.net, broonie@...nel.org,
	david.griego@...aro.org, linux-arm-kernel@...ts.infradead.org,
	linux-kernel@...r.kernel.org
Subject: Re: [RFC 1/3] ftrace: adjust a function's pc to search for in check_stack()
 for arm64

On 07/14/2015 12:24 AM, Steven Rostedt wrote:
> On Mon, 13 Jul 2015 14:29:33 +0900
> AKASHI Takahiro <takahiro.akashi@...aro.org> wrote:
>
>> Ftace's stack tracer on arm64 returns wrong information about call stacks:
>>
>>          Depth    Size   Location    (50 entries)
>>          -----    ----   --------
>>    0)     5256       0   notifier_call_chain+0x30/0x94
>>    1)     5256       0   ftrace_call+0x0/0x4
>>    2)     5256       0   notifier_call_chain+0x2c/0x94
>>    3)     5256       0   raw_notifier_call_chain+0x34/0x44
>>    4)     5256       0   timekeeping_update.constprop.9+0xb8/0x114
>>    5)     5256       0   update_wall_time+0x408/0x6dc
>>
>> Most of 'Size' fields are unexpectedly zero.
>>
>> This is because stack tracer fails to recognize each function's stack frame
>> in check_stack(). Stack tracer searches for a function's pc in the stack
>> based on the list returned by save_stack_trace(), but save_stack_trace() on
>> arm64 does not return the exact return address saved in a stack frame, but
>> a value decrmented by 4 (which means a branch instruction's address).
>> This behavior was introduced by
>>      commit e306dfd06fcb ("ARM64: unwind: Fix PC calculation")
>>
>> So the matching doesn't succeed in most cases.
>>
>> This problem can be fixed either by
>> a) reverting the commit above
>> b) adding an arm64-specific hack to check_patch()
>>
>> This patch does b).
>>
>> Signed-off-by: AKASHI Takahiro <takahiro.akashi@...aro.org>
>> ---
>>   kernel/trace/trace_stack.c |    4 ++++
>>   1 file changed, 4 insertions(+)
>>
>> diff --git a/kernel/trace/trace_stack.c b/kernel/trace/trace_stack.c
>> index 3f34496..7086fc3 100644
>> --- a/kernel/trace/trace_stack.c
>> +++ b/kernel/trace/trace_stack.c
>> @@ -143,7 +143,11 @@ check_stack(unsigned long ip, unsigned long *stack)
>>   		p = start;
>>
>>   		for (; p < top && i < max_stack_trace.nr_entries; p++) {
>> +#ifdef CONFIG_ARM64
>> +			if (*p == (stack_dump_trace[i] + 4)) {
>> +#else
>>   			if (*p == stack_dump_trace[i]) {
>> +#endif
>
> Instead of the ugly #ifdef in this code, please add a macro
> FTRACE_STACK_FRAME_OFFSET
>
> Then in include/linux/ftrace.h have:
>
> #ifndef FTRACE_STACK_FRAME_OFFSET
> # define FTRACE_STACK_FRAME_OFFSET 0
> #endif
>
> And in arch/arm64/include/asm/ftrace.h
>
> #define FTRACE_STACK_FRAME_OFFSET 4
>
> And then just do:
>
> 	if (*p == (stack_dump_trace[i] + FTRACE_STACK_FRAME_OFFSET)) {

Yes.

Thanks,
-Takahiro AKASHI

> -- Steve
>
>>   				this_size = stack_dump_index[i++] =
>>   					(top - p) * sizeof(unsigned long);
>>   				found = 1;
>
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/