linux-kernel - RE: [PATCH 6/9] x86/bpf: Fix JIT frame pointer usage

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 14 Jun 2019 13:58:21 +0000
From:   David Laight <David.Laight@...LAB.COM>
To:     'Josh Poimboeuf' <jpoimboe@...hat.com>
CC:     'Alexei Starovoitov' <alexei.starovoitov@...il.com>,
        "x86@...nel.org" <x86@...nel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        Alexei Starovoitov <ast@...nel.org>,
        "Daniel Borkmann" <daniel@...earbox.net>,
        "netdev@...r.kernel.org" <netdev@...r.kernel.org>,
        "bpf@...r.kernel.org" <bpf@...r.kernel.org>,
        "Peter Zijlstra" <peterz@...radead.org>,
        Song Liu <songliubraving@...com>,
        "Kairui Song" <kasong@...hat.com>
Subject: RE: [PATCH 6/9] x86/bpf: Fix JIT frame pointer usage

From: Josh Poimboeuf
> Sent: 14 June 2019 14:44
> 
> On Fri, Jun 14, 2019 at 10:50:23AM +0000, David Laight wrote:
> > On Thu, Jun 13, 2019 at 08:21:03AM -0500, Josh Poimboeuf wrote:
> > > The BPF JIT code clobbers RBP.  This breaks frame pointer convention and
> > > thus prevents the FP unwinder from unwinding through JIT generated code.
> > >
> > > RBP is currently used as the BPF stack frame pointer register.  The
> > > actual register used is opaque to the user, as long as it's a
> > > callee-saved register.  Change it to use R12 instead.
> >
> > Could you maintain the system %rbp chain through the BPF stack?
> 
> Do you mean to save RBP again before changing it again, so that we
> create another stack frame inside the BPF stack?  That might work.

The unwinder will (IIRC) expect *%rbp to be the previous %rbp value.
If you maintain that it will probably all work.

> > It might even be possible to put something relevant in the %rip
> > location.
> 
> I'm not sure what you mean here.

The return address is (again IIRC) %rbp[-8] so the unwinder will
expect that address to be a symbol.

I do remember a stack trace printer for x86 this didn't need
any annotation of the object code and didn't need frame pointers.
The only downside was that it had to 'guess' (ie scan the stack)
to get out of functions that couldn't return.
Basically it followed the control flow forwards tracking the
values of %sp and %bp until it found a return instuction.
All it has to do is detect loops and retry from the other
target of conditional branches.

	David

-
Registered Address Lakeside, Bramley Road, Mount Farm, Milton Keynes, MK1 1PT, UK
Registration No: 1397386 (Wales)