linux-kernel - Re: [PATCH 1/5] ARM: stacktrace: Skip frame pointer boundary check for call_with

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <ab843b1e-9a4f-7b2c-a9bb-670797f7da34@huawei.com>
Date:   Tue, 26 Jul 2022 16:10:25 +0800
From:   Li Huafei <lihuafei1@...wei.com>
To:     Linus Walleij <linus.walleij@...aro.org>
CC:     <linux@...linux.org.uk>, <rmk+kernel@...linux.org.uk>,
        <ardb@...nel.org>, <will@...nel.org>, <mark.rutland@....com>,
        <broonie@...nel.org>, <peterz@...radead.org>, <mingo@...hat.com>,
        <acme@...nel.org>, <alexander.shishkin@...ux.intel.com>,
        <jolsa@...nel.org>, <namhyung@...nel.org>, <arnd@...db.de>,
        <rostedt@...dmis.org>, <nick.hawkins@....com>, <john@...ozen.org>,
        <mhiramat@...nel.org>, <ast@...nel.org>, <linyujun809@...wei.com>,
        <ndesaulniers@...gle.com>, <linux-arm-kernel@...ts.infradead.org>,
        <linux-kernel@...r.kernel.org>, <linux-perf-users@...r.kernel.org>,
        Li Huafei <lihuafei1@...wei.com>
Subject: Re: [PATCH 1/5] ARM: stacktrace: Skip frame pointer boundary check
 for call_with_stack()

Hi Linus, sorry for the late reply.

On 2022/7/18 16:57, Linus Walleij wrote:
> On Tue, Jul 12, 2022 at 4:18 AM Li Huafei <lihuafei1@...wei.com> wrote:
>
>> When using the frame pointer unwinder, it was found that the stack trace
>> output of stack_trace_save() is incomplete if the stack contains
>> call_with_stack():
>>
>>   [0x7f00002c] dump_stack_task+0x2c/0x90 [hrtimer]
>>   [0x7f0000a0] hrtimer_hander+0x10/0x18 [hrtimer]
>>   [0x801a67f0] __hrtimer_run_queues+0x1b0/0x3b4
>>   [0x801a7350] hrtimer_run_queues+0xc4/0xd8
>>   [0x801a597c] update_process_times+0x3c/0x88
>>   [0x801b5a98] tick_periodic+0x50/0xd8
>>   [0x801b5bf4] tick_handle_periodic+0x24/0x84
>>   [0x8010ffc4] twd_handler+0x38/0x48
>>   [0x8017d220] handle_percpu_devid_irq+0xa8/0x244
>>   [0x80176e9c] generic_handle_domain_irq+0x2c/0x3c
>>   [0x8052e3a8] gic_handle_irq+0x7c/0x90
>>   [0x808ab15c] generic_handle_arch_irq+0x60/0x80
>>   [0x8051191c] call_with_stack+0x1c/0x20
>>
>> For the frame pointer unwinder, unwind_frame() checks stackframe::fp by
>> stackframe::sp. Since call_with_stack() switches the SP from one stack
>> to another, stackframe::fp and stackframe: :sp will point to different
>> stacks, so we can no longer check stackframe::fp by stackframe::sp. Skip
>> checking stackframe::fp at this point to avoid this problem.
>>
>> Signed-off-by: Li Huafei <lihuafei1@...wei.com>
> Very nice catch! Took me some time to realize what was
> going on here.

Yeah, it took me some time to discover the cause of the problem too.

>
> Reviewed-by: Linus Walleij <linus.walleij@...aro.org>

Thanks!

>
> Nitpick below:
>
>> +       /*
>> +        * call_with_stack() is the only place we allow SP to jump from one
>> +        * stack to another, with FP and SP pointing to different stacks,
>> +        * skipping the FP boundary check at this point.
>> +        */
>> +       if (pc >= (unsigned long)&call_with_stack &&
>> +                       pc < (unsigned long)&call_with_stack_end)
>> +               return 0;
> Can we create a local helper macro to do this, if it needs to happen
> some other time?

Hopefully this won't come up again.:(

Maybe it would be better to define a macro when this happens?


Thanks,

Huafei

>
> #define ARM_PC_IN_FUNCTION(pc, func) (pc >=. ...)
>
> Yours,
> Linus Walleij
> .