linux-kernel - Re: [PATCH v2] stackdepot: ignore junk last entry in case of switch from user mode.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <2bd4d082-a62a-f956-0764-9962d8c05d89@virtuozzo.com>
Date:   Fri, 13 Oct 2017 18:19:21 +0300
From:   Andrey Ryabinin <aryabinin@...tuozzo.com>
To:     Maninder Singh <maninder1.s@...sung.com>,
        akpm@...ux-foundation.org, dvyukov@...gle.com,
        chris@...is-wilson.co.uk, kasan-dev@...glegroups.com,
        mark.rutland@....com
Cc:     linux-kernel@...r.kernel.org, pankaj.m@...sung.com,
        a.sahrawat@...sung.com, Vaneet Narang <v.narang@...sung.com>
Subject: Re: [PATCH v2] stackdepot: ignore junk last entry in case of switch
 from user mode.

On 10/11/2017 03:43 PM, Maninder Singh wrote:
> Issue observed on ARM.
> 
> Whenever there is switch from user mode, we end up with invalid last entry
> with some user space address as below:-
> 
>  save_stack+0x40/0xec
>  __set_page_owner+0x2c/0x64
> ....
> ....
>  __handle_domain_irq+0x9c/0x130
>  gic_handle_irq+0x40/0x80
>  __irq_usr+0x4c/0x60
>  0xb6507818
> 

Sounds like an ARM issue to me.

...
 
> diff --git a/lib/stackdepot.c b/lib/stackdepot.c
> index f87d138..a045748 100644
> --- a/lib/stackdepot.c
> +++ b/lib/stackdepot.c
> @@ -214,6 +214,13 @@ depot_stack_handle_t depot_save_stack(struct stack_trace *trace,
>  	if (unlikely(trace->nr_entries == 0))
>  		goto fast_exit;
>  
> +	/* 
> +	 * Ignore last entry if it belongs to user space

And if it belongs to module too. NACK.


> +	 * in case of switch from user mode.
> +	 */
> +	if (!kernel_text_address(trace->entries[trace->nr_entries - 1]))
> +		trace->nr_entries--;
> +
>  	hash = hash_stack(trace->entries, trace->nr_entries);
>  	bucket = &stack_table[hash & STACK_HASH_MASK];
>  
>