linux-kernel - Re: [PATCH 02/16] x86/dumpstack: Add get_stack

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20171120215550.2yiukhcnts5g77ho@treble>
Date:   Mon, 20 Nov 2017 15:55:50 -0600
From:   Josh Poimboeuf <jpoimboe@...hat.com>
To:     Andy Lutomirski <luto@...nel.org>
Cc:     X86 ML <x86@...nel.org>, Borislav Petkov <bpetkov@...e.de>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        Brian Gerst <brgerst@...il.com>,
        Dave Hansen <dave.hansen@...el.com>,
        Linus Torvalds <torvalds@...ux-foundation.org>
Subject: Re: [PATCH 02/16] x86/dumpstack: Add get_stack_info() support for
 the SYSENTER stack

On Mon, Nov 20, 2017 at 01:30:12PM -0800, Andy Lutomirski wrote:
> On Mon, Nov 20, 2017 at 1:27 PM, Josh Poimboeuf <jpoimboe@...hat.com> wrote:
> > On Mon, Nov 20, 2017 at 01:07:16PM -0800, Andy Lutomirski wrote:
> >> >> but, more importantly, the OOPS unwinder will just bail without this
> >> >> patch.  With the patch, we get a valid unwind, except that everything
> >> >> has a ?  in front.
> >> >
> >> > Hm.  I can't even fathom how that's possible.  Are you talking about the
> >> > "unwind from NMI to SYSENTER stack" path?  Or any unwind to a syscall?
> >> > Either way I'm baffled...  If the unwinder only encounters the SYSENTER
> >> > stack at the end, how could that cause everything beforehand to have a
> >> > question mark?
> >>
> >> I mean that, if I put a ud2 or other bug in the code that runs on the
> >> SYSENTER stack, without this patch, I get a totally blank call trace.
> >
> > I would expect a blank call trace either way...
> 
> Try making sync_regs use a few kB of stack space or, better yet, call
> a non-inlined function that uses too much stack.

You mean overflow the exception stack?  I still don't see how that would
do it.

If you could show a specific example, with splats from before/after,
that would be helpful.  Because I still have no idea how this patch
could possibly help.

-- 
Josh