linux-kernel - Re: [PATCH V3 0/3] riscv: Add perf callchain support

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 19 Aug 2019 18:56:19 +0800
From:   Mao Han <han_mao@...ky.com>
To:     Paul Walmsley <paul.walmsley@...ive.com>
Cc:     linux-kernel@...r.kernel.org, linux-riscv@...ts.infradead.org
Subject: Re: [PATCH V3 0/3] riscv: Add perf callchain support

On Mon, Aug 19, 2019 at 04:18:01PM +0800, Mao Han wrote:
> Hi Paul,
> On Fri, Aug 16, 2019 at 10:14:01AM -0700, Paul Walmsley wrote:
> > Hello Mao Han,
> > 
> > On Fri, 17 May 2019, Mao Han wrote:
> > 
> > > This patch set add perf callchain(FP/DWARF) support for RISC-V.
> > > It comes from the csky version callchain support with some
> > > slight modifications. The patchset base on Linux 5.1.
> > > 
> > > CC: Palmer Dabbelt <palmer@...ive.com>
> > > CC: linux-riscv <linux-riscv@...ts.infradead.org>
> > > CC: Christoph Hellwig <hch@....de>
> > > CC: Guo Ren <guoren@...nel.org>
> > 
> > I tried these patches on v5.3-rc4, both on the HiFive Unleashed board 
> > with a Debian-based rootfs and QEMU rv64 with a Fedora-based rootfs.  For 
> > QEMU, I used defconfig, and for the HiFive Unleashed, I added a few more 
> > Kconfig directives; and on both, I enabled CONFIG_PERF_EVENTS.  I built 
> > the perf tools from the kernel tree.
> > 
> > Upon running "/root/bin/perf record -e cpu-clock --call-graph fp 
> > /bin/ls", I see the backtraces below.  The first is on the HiFive 
> > Unleashed, the second is on QEMU.  
> > 
> > Could you take a look and tell me if you see similar issues?  And if not, 
> > could you please walk me through your process for testing these patches on 
> > rv64, so I can reproduce it here?
> >
> 
> I'v tried the command line above and got similar issues with probability.
> unwind_frame_kernel can not stop unwind when fp is a quite large
> value(like 0x70aac93ff0eff584) which can pass the simple stack check.
>         if (kstack_end((void *)frame->fp))
>                 return -EPERM;
>         if (frame->fp & 0x3 || frame->fp < TASK_SIZE)
>                 return -EPERM;
> handle_exception from arch/riscv/kernel/entry.S will use s0(fp) as temp
> register. The context for this frame is unpredictable. We may add more
> strict check in unwind_frame_kernel or keep s0 always 0 in handle_exception
> to fix this issue.
> 

perf record -e cpu-clock --call-graph fp /bin/ls seems can work stably
with this change applied.
diff --git a/arch/riscv/kernel/perf_callchain.c b/arch/riscv/kernel/perf_callchain.c
index 8b57903..dd27c67 100644
--- a/arch/riscv/kernel/perf_callchain.c
+++ b/arch/riscv/kernel/perf_callchain.c
@@ -16,6 +16,8 @@ static int unwind_frame_kernel(struct stackframe *frame)
                return -EPERM;
        if (frame->fp & 0x3 || frame->fp < TASK_SIZE)
                return -EPERM;
+        if (frame->fp < CONFIG_PAGE_OFFSET)
+                return -EPERM;
 
        *frame = *((struct stackframe *)frame->fp - 1);
        if (__kernel_text_address(frame->ra)) {


PS: I got some compile error while compiling glibc 2.30 with linux
v5.3-rc4 header. vfork.S include linux/sched.h(./include/uapi/linux/sched.h)
which has a struct clone_args inside, added by
7f192e3cd316ba58c88dfa26796cf77789dd9872.