linux-kernel - Re: [PATCH] [ARM] Fix stack alignment when processing backtraces

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20161028175749.GB28451@obsidianresearch.com>
Date:   Fri, 28 Oct 2016 11:57:49 -0600
From:   Jason Gunthorpe <jgunthorpe@...idianresearch.com>
To:     Russell King <linux@...linux.org.uk>,
        linux-arm-kernel@...ts.infradead.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] [ARM] Fix stack alignment when processing backtraces

On Tue, Oct 18, 2016 at 11:05:10AM -0600, Jason Gunthorpe wrote:
> The dumpstm helper within c_backtrace pushed 5 dwords onto the stack
> causing the stack to become unaligned and then calls printk. This
> causes memory corruption in the kernel which assumes AAPCS calling
> convention.
> 
> Since this bit of asm doesn't use the standard prologue just add
> another register to restore alignment.
> 
> Fixes: 7ab3f8d595a1b ("[ARM] Add ability to dump exception stacks to kernel backtraces")
> Signed-off-by: Jason Gunthorpe <jgunthorpe@...idianresearch.com>
>  arch/arm/lib/backtrace.S | 5 +++--
>  1 file changed, 3 insertions(+), 2 deletions(-)
> 
> In my case the kernel was hitting a WARN_ON during boot and then
> reliably failed to start the compiled-in initramfs.
> 
> I'm inferring that the stack misalignment caused some kind of memory
> corruption which wiped out the unpacked initramfs.
> 
> Saw with gcc 5.4.0 on a kirkwood armv5te

Since there are no comments, I will send this to RMK's patch system..

Thanks,
Jason

> diff --git a/arch/arm/lib/backtrace.S b/arch/arm/lib/backtrace.S
> index fab5a50503ae..25e1cce19991 100644
> +++ b/arch/arm/lib/backtrace.S
> @@ -116,7 +116,8 @@ ENDPROC(c_backtrace)
>  #define reg   r5
>  #define stack r6
>  
> -.Ldumpstm:	stmfd	sp!, {instr, reg, stack, r7, lr}
> +	        /* Must maintain 8 byte stack alignment */
> +.Ldumpstm:	stmfd	sp!, {r3, instr, reg, stack, r7, lr}
>  		mov	stack, r0
>  		mov	instr, r1
>  		mov	reg, #10
> @@ -140,7 +141,7 @@ ENDPROC(c_backtrace)
>  		teq	r7, #0
>  		adrne	r0, .Lcr
>  		blne	printk
> -		ldmfd	sp!, {instr, reg, stack, r7, pc}
> +		ldmfd	sp!, {r3, instr, reg, stack, r7, pc}
>  
>  .Lfp:		.asciz	" r%d:%08x%s"
>  .Lcr:		.asciz	"\n"