linux-kernel - Re: [PATCH] ARM: fix race in for_each

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <64C83867-31FA-4243-A0EB-018AE9A83ACB@unisoc.com>
Date:   Tue, 12 Nov 2019 14:35:38 +0000
From:   黄吕强 (Lvqiang Huang) 
        <lvqiang.huang@...soc.com>
To:     Mark-PK Tsai <mark-pk.tsai@...iatek.com>
CC:     "linux@...linux.org.uk" <linux@...linux.org.uk>,
        "matthias.bgg@...il.com" <matthias.bgg@...il.com>,
        "kstewart@...uxfoundation.org" <kstewart@...uxfoundation.org>,
        "allison@...utok.net" <allison@...utok.net>,
        "gregkh@...uxfoundation.org" <gregkh@...uxfoundation.org>,
        "info@...ux.net" <info@...ux.net>,
        "tglx@...utronix.de" <tglx@...utronix.de>,
        "linux-arm-kernel@...ts.infradead.org" 
        <linux-arm-kernel@...ts.infradead.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "linux-mediatek@...ts.infradead.org" 
        <linux-mediatek@...ts.infradead.org>,
        "yj.chiang@...iatek.com" <yj.chiang@...iatek.com>,
        "alix.wu@...iatek.com" <alix.wu@...iatek.com>,
        "mike-sl.lin@...iatek.com" <mike-sl.lin@...iatek.com>,
        "eddy.lin@...iatek.com" <eddy.lin@...iatek.com>,
        "phil.chang@...iatek.com" <phil.chang@...iatek.com>,
        楚恩来 (Enlai Chu) <enlai.chu@...soc.com>
Subject: Re: [PATCH] ARM: fix race in for_each_frame

Dear Mark,
Thanks a lot for the reply. 

As said in last reply, sv_pc can be a module text, then more check needed.

And beside crash at 1003, we may also get crash at 1001, the frame is invalid. (The last sv_pv is valid and sv_frame is invalid), then more check needed. 

And we often show_data around the general proposal registers when kernel crash. When they contain an address mapping for a hw register but can’t access because clock gated, it will crash again because do_bad() is involved. (continuous crash in arm and hang at die_lock in arm64)

So, why not check the __ex_table in do_bad() ?

> 在 2019年11月12日，21:31，Mark-PK Tsai <mark-pk.tsai@...iatek.com> 写道：
> 
> The sv_pc, which is saved in the stack, may be an invalid address
> if the target thread is running on another processor in the meantime.
> It will cause kernel crash at `ldr r2, [sv_pc, #-4]`.
> 
> Check if sv_pc is valid before use it like unwind_frame in
> arch/arm/kernel/unwind.c.
> 
> Signed-off-by: Mike-SL Lin <mike-sl.lin@...iatek.com>
> Signed-off-by: Mark-PK Tsai <mark-pk.tsai@...iatek.com>
> ---
> arch/arm/lib/backtrace.S | 5 +++++
> 1 file changed, 5 insertions(+)
> 
> diff --git a/arch/arm/lib/backtrace.S b/arch/arm/lib/backtrace.S
> index 582925238d65..84f06381bbfb 100644
> --- a/arch/arm/lib/backtrace.S
> +++ b/arch/arm/lib/backtrace.S
> @@ -64,6 +64,11 @@ for_each_frame:    tst    frame, mask        @ Check for address exceptions
>        sub    sv_pc, sv_pc, offset    @ Correct PC for prefetching
>        bic    sv_pc, sv_pc, mask    @ mask PC/LR for the mode
> 
> +        mov    r0, sv_pc
> +        bl    kernel_text_address    @ check if sv_pc is valid
> +        cmp    r0, #0            @ if sv_pc is not kernel text
> +        beq    1006f            @ address, abort backtrace
> +
> 1003:        ldr    r2, [sv_pc, #-4]    @ if stmfd sp!, {args} exists,
>        ldr    r3, .Ldsi+4        @ adjust saved 'pc' back one
>        teq    r3, r2, lsr #11        @ instruction
> -- 
> 2.18.0

============================================================================
This email (including its attachments) is intended only for the person or entity to which it is addressed and may contain information that is privileged, confidential or otherwise protected from disclosure. Unauthorized use, dissemination, distribution or copying of this email or the information herein or taking any action in reliance on the contents of this email or the information herein, by anyone other than the intended recipient, or an employee or agent responsible for delivering the message to the intended recipient, is strictly prohibited. If you are not the intended recipient, please do not read, copy, use or disclose any part of this e-mail to others. Please notify the sender immediately and permanently delete this e-mail and any attachments if you received it in error. Internet communications cannot be guaranteed to be timely, secure, error-free or virus-free. The sender does not accept liability for any errors or omissions. 
本邮件及其附件具有保密性质，受法律保护不得泄露，仅发送给本邮件所指特定收件人。严禁非经授权使用、宣传、发布或复制本邮件或其内容。若非该特定收件人，请勿阅读、复制、 使用或披露本邮件的任何内容。若误收本邮件，请从系统中永久性删除本邮件及所有附件，并以回复邮件的方式即刻告知发件人。无法保证互联网通信及时、安全、无误或防毒。发件人对任何错漏均不承担责任。