linux-kernel - [PATCH v2 37/44] x86/unwind: detect syscall entry regs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <41da7fc41abc1d4e0e59575b30acf87b93666104.1470345772.git.jpoimboe@redhat.com>
Date:	Thu,  4 Aug 2016 17:22:33 -0500
From:	Josh Poimboeuf <jpoimboe@...hat.com>
To:	Thomas Gleixner <tglx@...utronix.de>,
	Ingo Molnar <mingo@...nel.org>,
	"H . Peter Anvin" <hpa@...or.com>
Cc:	x86@...nel.org, linux-kernel@...r.kernel.org,
	Andy Lutomirski <luto@...capital.net>,
	Linus Torvalds <torvalds@...ux-foundation.org>,
	Steven Rostedt <rostedt@...dmis.org>,
	Brian Gerst <brgerst@...il.com>,
	Kees Cook <keescook@...omium.org>,
	Peter Zijlstra <peterz@...radead.org>,
	Frederic Weisbecker <fweisbec@...il.com>,
	Byungchul Park <byungchul.park@....com>
Subject: [PATCH v2 37/44] x86/unwind: detect syscall entry regs

The entry code doesn't encode pt_regs for syscalls.  But they're always
at the same location, so we can add a manual check for them.

Signed-off-by: Josh Poimboeuf <jpoimboe@...hat.com>
---
 arch/x86/kernel/unwind_frame.c | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/arch/x86/kernel/unwind_frame.c b/arch/x86/kernel/unwind_frame.c
index d24c192..f60a089 100644
--- a/arch/x86/kernel/unwind_frame.c
+++ b/arch/x86/kernel/unwind_frame.c
@@ -21,6 +21,14 @@ unsigned long unwind_get_return_address(struct unwind_state *state)
 }
 EXPORT_SYMBOL_GPL(unwind_get_return_address);
 
+static bool is_last_task_frame(struct unwind_state *state)
+{
+	unsigned long bp = (unsigned long)state->bp;
+	unsigned long regs = (unsigned long)task_pt_regs(state->task);
+
+	return bp == regs - FRAME_HEADER_SIZE;
+}
+
 #ifdef CONFIG_X86_64
 /*
  * This determines if the frame pointer actually contains an encoded pointer to
@@ -99,6 +107,20 @@ bool unwind_next_frame(struct unwind_state *state)
 	if (unwind_done(state))
 		return false;
 
+	/*
+	 * The entry code doesn't encode pt_regs on syscalls, so check for them
+	 * here.  The last frame pointer and associated syscall pt_regs (for
+	 * user tasks) are always at a standard location at the end of the task
+	 * stack.  If we've reached the end, go ahead and exit early to avoid
+	 * trying to decode an invalid frame pointer.
+	 */
+	if (is_last_task_frame(state)) {
+		if (!(state->task->flags & PF_KTHREAD))
+			state->regs = task_pt_regs(state->task);
+		state->stack_info.type = STACK_TYPE_UNKNOWN;
+		return false;
+	}
+
 	next_bp = (unsigned long *)*state->bp;
 
 	/*
-- 
2.7.4