linux-kernel - [PATCH] ARM: fix the incorrect value of sp in _

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 18 Apr 2022 03:45:16 +0000
From:   Yuanzheng Song <songyuanzheng@...wei.com>
To:     <linux@...linux.org.uk>, <ardb@...nel.org>,
        <rmk+kernel@...linux.org.uk>, <arnd@...db.de>,
        <linus.walleij@...aro.org>, <akpm@...ux-foundation.org>,
        <ebiederm@...ssion.com>, <wangkefeng.wang@...wei.com>
CC:     <linux-arm-kernel@...ts.infradead.org>,
        <linux-kernel@...r.kernel.org>,
        Yuanzheng Song <songyuanzheng@...wei.com>
Subject: [PATCH] ARM: fix the incorrect value of sp in __die()

The dump_mem() will output useless content that exceed the stack
in __die(), because sp will exceed the top of stack when the
CONFIG_VMAP_STACK=y.

Insufficient stack space to handle exception!
Task stack:     [0xf09dc000..0xf09de000]
IRQ stack:      [0xf0800000..0xf0802000]
Overflow stack: [0xc210e000..0xc210f000]
Internal error: kernel stack overflow: 0 [#1] SMP ARM
Modules linked in:
CPU: 0 PID: 81 Comm: sh Not tainted 5.18.0-rc3 #4
Hardware name: ARM-Versatile Express
PC is at mmioset+0x20/0xa8
LR is at recursive_loop+0x34/0x9c
pc : [<c0777080>]    lr : [<c0a90c6c>]    psr: 20000013
sp : f09dbf48  ip : f09dbf4c  fp : 00219644
...
Stack: (0xf09dbf48 to 0xf09de000)
bf40:                   ???????? ???????? ???????? ???????? ???????? ????????
bf60: ???????? ???????? ???????? ???????? ???????? ???????? ???????? ????????
bf80: ???????? ???????? ???????? ???????? ???????? ???????? ???????? ????????
bfa0: ???????? ???????? ???????? ???????? ???????? ???????? ???????? ????????
bfc0: ???????? ???????? ???????? ???????? ???????? ???????? ???????? ????????
bfe0: ???????? ???????? ???????? ???????? ???????? ???????? ???????? ????????
c000: 57ac6e9d 00000000 00000000 00000000 00000000 00000000 00000000 00000000
...

So fix it by adding check for sp and modifying the value of sp
when sp exceed the top of stack.

Insufficient stack space to handle exception!
Task stack:     [0xf09d8000..0xf09da000]
IRQ stack:      [0xf0800000..0xf0802000]
Overflow stack: [0xc210e000..0xc210f000]
Internal error: kernel stack overflow: 0 [#1] SMP ARM
Modules linked in:
CPU: 0 PID: 81 Comm: sh Not tainted 5.18.0-rc3-dirty #3
Hardware name: ARM-Versatile Express
PC is at mmioset+0x20/0xa8
LR is at recursive_loop+0x34/0x9c
pc : [<c0777080>]    lr : [<c0a90c6c>]    psr: 20000013
sp : f09d7f48  ip : f09d7f4c  fp : 00219644
...
Stack: (0xf09d8000 to 0xf09da000)
8000: 57ac6e9d 00000000 00000000 00000000 00000000 00000000 00000000 00000000
8020: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
8040: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
8060: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
...

Fixes: a1c510d0adc6 ("ARM: implement support for vmap'ed stacks")
Signed-off-by: Yuanzheng Song <songyuanzheng@...wei.com>
---
 arch/arm/kernel/traps.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/arch/arm/kernel/traps.c b/arch/arm/kernel/traps.c
index 9283dc65be31..e93d8f2296be 100644
--- a/arch/arm/kernel/traps.c
+++ b/arch/arm/kernel/traps.c
@@ -277,6 +277,7 @@ static int __die(const char *str, int err, struct pt_regs *regs)
 	struct task_struct *tsk = current;
 	static int die_counter;
 	int ret;
+	unsigned long sp;
 
 	pr_emerg("Internal error: %s: %x [#%d]" S_PREEMPT S_SMP S_ISA "\n",
 	         str, err, ++die_counter);
@@ -293,8 +294,11 @@ static int __die(const char *str, int err, struct pt_regs *regs)
 		 TASK_COMM_LEN, tsk->comm, task_pid_nr(tsk), end_of_stack(tsk));
 
 	if (!user_mode(regs) || in_interrupt()) {
-		dump_mem(KERN_EMERG, "Stack: ", regs->ARM_sp,
-			 ALIGN(regs->ARM_sp - THREAD_SIZE, THREAD_ALIGN)
+		sp = regs->ARM_sp;
+		if (sp < (unsigned long)tsk->stack)
+			sp = (unsigned long)tsk->stack;
+		dump_mem(KERN_EMERG, "Stack: ", sp,
+			 ALIGN(sp - THREAD_SIZE, THREAD_ALIGN)
 			 + THREAD_SIZE);
 		dump_backtrace(regs, tsk, KERN_EMERG);
 		dump_instr(KERN_EMERG, regs);
-- 
2.25.1