linux-kernel - Re: [patch V2 03/29] x86/irq/64: Remove a hardcoded irq_stack

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 5 Apr 2019 09:37:27 -0700
From:   Sean Christopherson <sean.j.christopherson@...el.com>
To:     Thomas Gleixner <tglx@...utronix.de>
Cc:     LKML <linux-kernel@...r.kernel.org>, x86@...nel.org,
        Andy Lutomirski <luto@...nel.org>,
        Josh Poimboeuf <jpoimboe@...hat.com>
Subject: Re: [patch V2 03/29] x86/irq/64: Remove a hardcoded irq_stack_union
 access

On Fri, Apr 05, 2019 at 05:07:01PM +0200, Thomas Gleixner wrote:
> From: Andy Lutomirski <luto@...nel.org>
> 
> stack_overflow_check() is using both irq_stack_ptr and irq_stack_union to
> find the IRQ stack. That's going to break when vmapped irq stacks are
> introduced.
> 
> Change it to just use irq_stack_ptr.
> 
> Signed-off-by: Andy Lutomirski <luto@...nel.org>
> Signed-off-by: Thomas Gleixner <tglx@...utronix.de>
> 
> ---
>  arch/x86/kernel/irq_64.c |    3 +--
>  1 file changed, 1 insertion(+), 2 deletions(-)
> 
> --- a/arch/x86/kernel/irq_64.c
> +++ b/arch/x86/kernel/irq_64.c
> @@ -55,9 +55,8 @@ static inline void stack_overflow_check(
>  	    regs->sp <= curbase + THREAD_SIZE)
>  		return;
>  
> -	irq_stack_top = (u64)this_cpu_ptr(irq_stack_union.irq_stack) +
> -			STACK_TOP_MARGIN;
>  	irq_stack_bottom = (u64)__this_cpu_read(irq_stack_ptr);
> +	irq_stack_top = irq_stack_bottom - IRQ_STACK_SIZE + STACK_TOP_MARGIN;

Not introduced in this patch, but the names for top and bottom are flipped,
both for irq_stack and estack.  STACK_TOP_MARGIN should also be
STACK_BOTTOM_MARGIN.  The actual checks are functionally correct, but holy
hell does it make reading the code confusing, and the WARN prints backwards
information.

E.g.:

  swapper/10 has overflown the kernel stack

    cur:ffffc900000bc000,sp:ffff888277b03f78
    irq stk top-bottom:ffff888277b00080-ffff888277b04000
    exception stk top-bottom:fffffe00001b4080-fffffe00001b9000


Printing out top-bottom for "cur" would also probably be helpful.

Let me know if you'd like me to send a patch, or if you'll fold a change
into this series.


For this patch,

Reviewed-by: Sean Christopherson <sean.j.christopherson@...el.com>

>  	if (regs->sp >= irq_stack_top && regs->sp <= irq_stack_bottom)
>  		return;
>  
> 
>