linux-kernel - Re: [PATCH v12 02/14] unwind_user: Add frame pointer support

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <a6a460e6-8cff-4353-a9e1-2e071d28e993@linux.ibm.com>
Date: Tue, 1 Jul 2025 17:36:55 +0200
From: Jens Remus <jremus@...ux.ibm.com>
To: Steven Rostedt <rostedt@...dmis.org>
Cc: Linus Torvalds <torvalds@...ux-foundation.org>,
        linux-kernel@...r.kernel.org, linux-trace-kernel@...r.kernel.org,
        bpf@...r.kernel.org, x86@...nel.org,
        Masami Hiramatsu <mhiramat@...nel.org>,
        Mathieu Desnoyers <mathieu.desnoyers@...icios.com>,
        Josh Poimboeuf <jpoimboe@...nel.org>,
        Peter Zijlstra <peterz@...radead.org>, Ingo Molnar <mingo@...nel.org>,
        Jiri Olsa <jolsa@...nel.org>, Namhyung Kim <namhyung@...nel.org>,
        Thomas Gleixner <tglx@...utronix.de>,
        Andrii Nakryiko <andrii@...nel.org>,
        Indu Bhagat <indu.bhagat@...cle.com>,
        "Jose E. Marchesi" <jemarch@....org>,
        Beau Belgrave <beaub@...ux.microsoft.com>,
        Andrew Morton <akpm@...ux-foundation.org>,
        Jens Axboe <axboe@...nel.dk>, Florian Weimer <fweimer@...hat.com>
Subject: Re: [PATCH v12 02/14] unwind_user: Add frame pointer support

On 01.07.2025 04:56, Steven Rostedt wrote:
> On Mon, 30 Jun 2025 19:10:09 -0700
> Linus Torvalds <torvalds@...ux-foundation.org> wrote:
>> On Mon, 30 Jun 2025 at 17:54, Steven Rostedt <rostedt@...dmis.org> wrote:
>>>
>>> +       /* stack going in wrong direction? */
>>> +       if (cfa <= state->sp)
>>> +               goto done;  
>>
>> I suspect this should do a lot more testing.
> 
> Sure.

The above assumes:

	curr_frame_sp = state->sp
	prev_frame_sp = cfa   // for arches that define CFA as SP at call site

On s390 the prev_frame_sp may be equal to curr_frame_sp for the topmost
frame, as long as the topmost function did not allocate any stack.  For
instance when early in the prologue or when in a leaf function that does
not require any stack space.  My s390 sframe support patches would
therefore currently change above check to:

	/* stack going in wrong direction? */
	if (sp <= state->sp - topmost)
		goto done;

I assume that should be the case for all architectures whose function
call instruction does not modify the SP, unlike x86-64's CALL does.

>>> +       if (frame->fp_off && get_user(fp, (unsigned long __user *)(cfa + frame->fp_off)))
>>> +               goto done;  
>>
>> .. and this should check the frame for validity too.  At a minimum it
>> should be properly aligned, but things like "it had better be above
>> the current frame" to avoid having some loop would seem to be a good
>> idea.
> 
> Makes sense.

On s390 the FP (register) value does not necessarily need to be above
the SP value, as the s390x ELF ABI does only designate a "preferred" FP
register, so that the FP register may be used for other purposes, when a
FP is not required in a function.

So the output FP value cannot be checked on s390.  But the input FP
value could probably be checked as follows before computing the CFA:

	if (frame->use_fp && state->fp < state->sp)
		goto done;

	/* Get the Canonical Frame Address (CFA) */
	cfa = (frame->use_fp ? state->fp : state->sp) + frame->cfa_off;

>> Maybe even check that it's the same vma?
> 
> Hmm, I call on to Jens Remus and ask if s390 can do anything whacky here?
> Where something that isn't allowed on other architectures may be allowed
> there? I know s390 has some strange type of stack usage.

On s390, if a FP is required for dynamic stack allocation, it is only
initialized as late as possible, that is usually after static stack
allocation.  Therefore SP == FP is rather seldom the case.

Regards,
Jens
-- 
Jens Remus
Linux on Z Development (D3303)
+49-7031-16-1128 Office
jremus@...ibm.com

IBM

IBM Deutschland Research & Development GmbH; Vorsitzender des Aufsichtsrats: Wolfgang Wendt; Geschäftsführung: David Faller; Sitz der Gesellschaft: Böblingen; Registergericht: Amtsgericht Stuttgart, HRB 243294
IBM Data Privacy Statement: https://www.ibm.com/privacy/