linux-kernel - Re: [PATCH v1] LoongArch: Handle special PC in unwind_next

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <658bb477-b3f1-97c1-ab37-5dafcb6215f5@loongson.cn>
Date: Tue, 25 Nov 2025 18:52:24 +0800
From: Jinyang He <hejinyang@...ngson.cn>
To: Tiezhu Yang <yangtiezhu@...ngson.cn>
Cc: Huacai Chen <chenhuacai@...nel.org>, Xi Zhang <zhangxi@...inos.cn>,
 Xianglai Li <lixianglai@...ngson.cn>, loongarch@...ts.linux.dev,
 linux-kernel@...r.kernel.org
Subject: Re: [PATCH v1] LoongArch: Handle special PC in unwind_next_frame()

On 2025-11-25 14:33, Tiezhu Yang wrote:

> When running virtual machine before testing the kernel live patching with
> "modprobe livepatch-sample", there is a timeout over 15 seconds, the dmesg
> command shows "unreliable stack" for user tasks in debug mode.
>
> The "unreliable stack" is because it can not unwind from kvm_handle_exit()
> to its previous frame kvm_exc_entry() due to the PC is not a valid kernel
> address, the root cause is that the code of kvm_exc_entry() was copied to
> the DMW area in kvm_loongarch_env_init(), so it should check the PC range
> and then finish unwinding for this special case.

Hi, Tiezhu,

Since kvm_loongarch_env_init copies kvm_exc_entry which similar to how
trap_init copies the exception handler. We should apply the same
offset-based adjustment to compute the shadow PC address:
  shadow_pc = kvm_exc_entry + (cur_pc − copied_base_address)
This allows the ORC unwinder to correctly locate the corresponding 
unwind info.

On the other hand, the address range [_end, XKVRANGE) is unreliable.
If an immediate value is in this range and pushed into the stack,
unwinder might mistakenly interpret once it get this value as pc.

Jinyang


>
> How to test:
>
> (1) Update kernel with LIVEPATCH
>
>    git clone https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
>    cd linux && make mrproper defconfig
>    scripts/config -e FTRACE -e FUNCTION_TRACER \
>    -e LIVEPATCH -e SAMPLES -m SAMPLE_LIVEPATCH
>    make olddefconfig all -j"$(nproc)"
>    sudo make modules_install
>    sudo make install
>    sudo reboot
>
> (2) Set up a VM with "-accel kvm", no need to specify kernel and initrd
>
>    sudo yum -y install edk2-loongarch64 qemu
>    qemu-system-loongarch64 -serial stdio \
>    -machine virt -cpu la464 -smp 8 -m 4G \
>    -bios /usr/share/edk2/loongarch64/QEMU_EFI.fd \
>    -nodefaults -no-reboot -nographic -accel kvm
>
> (3) Test the kernel live patching
>
>    cat /proc/cmdline
>    sudo modprobe livepatch-sample
>    cat /proc/cmdline
>    sudo sh -c "echo 0 > /sys/kernel/livepatch/livepatch_sample/enabled"
>    sudo rmmod livepatch_sample
>    cat /proc/cmdline
>    dmesg -T
>
> Cc: stable@...r.kernel.org # v6.9+
> Fixes: cb8a2ef0848c ("LoongArch: Add ORC stack unwinder support")
> Reported-by: Xi Zhang <zhangxi@...inos.cn>
> Reported-by: Xianglai Li <lixianglai@...ngson.cn>
> Signed-off-by: Tiezhu Yang <yangtiezhu@...ngson.cn>
> ---
>   arch/loongarch/kernel/unwind_orc.c | 3 +++
>   1 file changed, 3 insertions(+)
>
> diff --git a/arch/loongarch/kernel/unwind_orc.c b/arch/loongarch/kernel/unwind_orc.c
> index 0d5fa64a2225..1d60a593479a 100644
> --- a/arch/loongarch/kernel/unwind_orc.c
> +++ b/arch/loongarch/kernel/unwind_orc.c
> @@ -506,6 +506,9 @@ bool unwind_next_frame(struct unwind_state *state)
>   		goto err;
>   	}
>   
> +	if (pc >= (unsigned long)_end && pc < (unsigned long)XKVRANGE)
> +		goto end;
> +
>   	state->pc = bt_address(pc);
>   	if (!state->pc) {
>   		pr_err("cannot find unwind pc at %p\n", (void *)pc);