lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 20 Mar 2024 23:41:34 +0800
From: Jiangfeng Xiao <xiaojiangfeng@...wei.com>
To: <linux@...linux.org.uk>, <linus.walleij@...aro.org>, <arnd@...db.de>,
	<keescook@...omium.org>, <rmk+kernel@...linux.org.uk>,
	<haibo.li@...iatek.com>, <angelogioacchino.delregno@...labora.com>,
	<amergnat@...libre.com>, <xiaojiangfeng@...wei.com>
CC: <akpm@...ux-foundation.org>, <dave.hansen@...ux.intel.com>,
	<douzhaolei@...wei.com>, <gustavoars@...nel.org>, <jpoimboe@...nel.org>,
	<kepler.chenxin@...wei.com>, <kirill.shutemov@...ux.intel.com>,
	<linux-hardening@...r.kernel.org>, <linux-kernel@...r.kernel.org>,
	<linux-mm@...ck.org>, <linux-arm-kernel@...ts.infradead.org>,
	<nixiaoming@...wei.com>, <peterz@...radead.org>, <wangbing6@...wei.com>,
	<wangfangpeng1@...wei.com>, <jannh@...gle.com>, <willy@...radead.org>,
	<David.Laight@...LAB.COM>
Subject: [PATCH v3] ARM: unwind: improve unwinders for noreturn case

This is an off-by-one bug which is common in unwinders,
due to the fact that the address on the stack points
to the return address rather than the call address.

So, for example, when the last instruction of a function
is a function call (e.g., to a noreturn function), it can
cause the unwinder to incorrectly try to unwind from
the function after the callee.

foo:
..
    bl      bar
.. end of function and thus next function ...

which results in LR pointing into the next function.

Fixed this by subtracting 1 from frmae->pc in the call frame
like ORC on x86 does.

Refer to the unwind_next_frame function in the unwind_orc.c

Suggested-by: Josh Poimboeuf <jpoimboe@...nel.org>
Link: https://lkml.kernel.org/lkml/20240305175846.qnyiru7uaa7itqba@treble/
Suggested-by: "Russell King (Oracle)" <linux@...linux.org.uk>
Link: https://lkml.kernel.org/lkml/Zeg8wRYFemMjcCxG@shell.armlinux.org.uk/
Signed-off-by: Jiangfeng Xiao <xiaojiangfeng@...wei.com>
---
ChangeLog v1->v2
- stay printk("%s...", loglvl, ...)
ChangeLog v2->v3
- Redundant code is deleted to simplify the code
---
 arch/arm/kernel/unwind.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/arch/arm/kernel/unwind.c b/arch/arm/kernel/unwind.c
index 9d21921..abfa8e9 100644
--- a/arch/arm/kernel/unwind.c
+++ b/arch/arm/kernel/unwind.c
@@ -514,6 +514,14 @@ int unwind_frame(struct stackframe *frame)
 	frame->sp = ctrl.vrs[SP];
 	frame->lr = ctrl.vrs[LR];
 	frame->pc = ctrl.vrs[PC];
+	/*
+	 * When the last instruction of a function is a function call
+	 * (e.g., to a noreturn function), it can cause the unwinder
+	 * incorrectly try to unwind from the function after the callee,
+	 * fixed this by subtracting 1 from frame->pc in the call frame
+	 * like ORC on x86 does.
+	 */
+	frame->pc = frame->pc - 1;
 	frame->lr_addr = ctrl.lr_addr;
 
 	return URC_OK;
-- 
1.8.5.6


Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ