| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20260127151926.2805123-13-jremus@linux.ibm.com>
Date: Tue, 27 Jan 2026 16:19:25 +0100
From: Jens Remus <jremus@...ux.ibm.com>
To: linux-kernel@...r.kernel.org, linux-trace-kernel@...r.kernel.org,
linux-s390@...r.kernel.org, bpf@...r.kernel.org, x86@...nel.org,
Steven Rostedt <rostedt@...nel.org>
Cc: Jens Remus <jremus@...ux.ibm.com>, Heiko Carstens <hca@...ux.ibm.com>,
Vasily Gorbik <gor@...ux.ibm.com>,
Ilya Leoshkevich <iii@...ux.ibm.com>,
Josh Poimboeuf <jpoimboe@...nel.org>,
Masami Hiramatsu <mhiramat@...nel.org>,
Mathieu Desnoyers <mathieu.desnoyers@...icios.com>,
Peter Zijlstra <peterz@...radead.org>, Ingo Molnar <mingo@...nel.org>,
Jiri Olsa <jolsa@...nel.org>,
Arnaldo Carvalho de Melo <acme@...nel.org>,
Namhyung Kim <namhyung@...nel.org>,
Thomas Gleixner <tglx@...utronix.de>,
Andrii Nakryiko <andrii@...nel.org>,
Indu Bhagat <indu.bhagat@...cle.com>,
"Jose E. Marchesi" <jemarch@....org>,
Beau Belgrave <beaub@...ux.microsoft.com>,
Linus Torvalds <torvalds@...ux-foundation.org>,
Andrew Morton <akpm@...ux-foundation.org>,
Florian Weimer <fweimer@...hat.com>, Kees Cook <kees@...nel.org>,
"Carlos O'Donell" <codonell@...hat.com>, Sam James <sam@...too.org>,
Dylan Hatch <dylanbhatch@...gle.com>
Subject: [PATCH v4 12/12] s390/unwind_user/fp: Enable back chain unwinding of user space
Unwinding of user space using frame pointer (FP) is virtually impossible
on s390 for the following reasons: The s390 64-bit (s390x) ELF ABI [1]
does only designate a "preferred" FP register and does not mandate fixed
FP and return address (RA) stack save slots. Therefore neither the FP
register nor the FP/RA stack save slot offsets from CFA are known.
Compilers, such as GCC and Clang, do not necessarily setup a FP register
early in the function prologue, even not with compiler option
-fno-omit-frame-pointer. Therefore the CFA offset from FP register is
not known.
This could be resolved by having compiler option -no-omit-frame-pointer
enforce all of the following: Use the preferred FP register 11 as frame
pointer, use fixed FP/RA stack slot offsets from CFA (e.g. -72 for FP
and -48 for RA), and setup the FP register immediately after saving the
call saved registers.
Fortunately s390 provides an alternative to frame pointer: back chain,
which can be enabled using s390-specific compiler option -mbackchain.
The back chain is very similar to a frame pointer on the stack.
Leverage the unwind user fp infrastructure to enable unwinding of user
space using back chain. Enable HAVE_UNWIND_USER_FP and provide a s390-
specific implementation of unwind_user_fp_get_frame(), which uses the
back chain.
Signed-off-by: Jens Remus <jremus@...ux.ibm.com>
---
Notes (jremus):
Changes in v4:
- Remove flawed heuristic to detect if topmost IP in early prologue.
While it may resolve the caller getting skipped it may erroneously
inject a callee as caller.
- Fix outermost frame indication.
- Adjust to flexible CFA and FP/RA rules.
- Remove superfluous unwind_user_fp_get_frame define.
Changes in RFC v3:
- New patch. Implement unwind user fp using back chain on s390. Reuses
logic from RFC v2 patch "unwind_user/backchain: Introduce back chain
user space unwinding". (Josh)
arch/s390/Kconfig | 1 +
arch/s390/include/asm/unwind_user.h | 62 +++++++++++++++++++++++++++++
2 files changed, 63 insertions(+)
diff --git a/arch/s390/Kconfig b/arch/s390/Kconfig
index 063f0c857600..5f7e83ba54b2 100644
--- a/arch/s390/Kconfig
+++ b/arch/s390/Kconfig
@@ -250,6 +250,7 @@ config S390
select HAVE_SOFTIRQ_ON_OWN_STACK
select HAVE_STACKPROTECTOR if CC_HAS_STACKPROTECTOR_GLOBAL
select HAVE_SYSCALL_TRACEPOINTS
+ select HAVE_UNWIND_USER_FP
select HAVE_UNWIND_USER_SFRAME
select HAVE_VIRT_CPU_ACCOUNTING
select HAVE_VIRT_CPU_ACCOUNTING_IDLE
diff --git a/arch/s390/include/asm/unwind_user.h b/arch/s390/include/asm/unwind_user.h
index 941aa3f0f70f..a7b97ea01c26 100644
--- a/arch/s390/include/asm/unwind_user.h
+++ b/arch/s390/include/asm/unwind_user.h
@@ -3,8 +3,12 @@
#define _ASM_S390_UNWIND_USER_H
#include <linux/sched/task_stack.h>
+#include <linux/security.h>
#include <linux/types.h>
+#include <asm/asm-offsets.h>
#include <asm/fpu.h>
+#include <asm/stacktrace.h>
+#include <linux/unwind_user_types.h>
#ifdef CONFIG_UNWIND_USER
@@ -65,6 +69,64 @@ static inline int arch_unwind_user_get_reg(unsigned long *val,
#endif /* CONFIG_UNWIND_USER */
+#ifdef CONFIG_HAVE_UNWIND_USER_FP
+
+static inline bool ip_within_vdso(unsigned long ip)
+{
+ return in_range(ip, current->mm->context.vdso_base, vdso_text_size());
+}
+
+static inline int unwind_user_fp_get_frame(struct unwind_user_state *state,
+ struct unwind_user_frame *frame)
+{
+ struct stack_frame_user __user *sf;
+ unsigned long __user *ra_addr;
+ unsigned long sp;
+
+ sf = (void __user *)state->sp;
+ if (__get_user(sp, (unsigned long __user *)&sf->back_chain))
+ return -EINVAL;
+ if (!sp && ip_within_vdso(state->ip)) {
+ /*
+ * Assume non-standard vDSO user wrapper stack frame.
+ * See vDSO user wrapper code for details.
+ */
+ struct stack_frame_vdso_wrapper *sf_vdso = (void __user *)sf;
+
+ ra_addr = (unsigned long __user *)&sf_vdso->return_address;
+ sf = (void __user *)((unsigned long)sf + STACK_FRAME_VDSO_OVERHEAD);
+ if (__get_user(sp, (unsigned long __user *)&sf->back_chain))
+ return -EINVAL;
+ } else if (!sp) {
+ /*
+ * Assume outermost frame reached. unwind_user_next_common()
+ * disregards all other fields in outermost frame.
+ */
+ frame->outermost = true;
+ return 0;
+ } else {
+ /*
+ * Assume IP past prologue and new stack frame allocated.
+ * Follow back chain, which then equals the SP at entry.
+ * Skips caller if wrong in topmost frame.
+ */
+ sf = (void __user *)sp;
+ ra_addr = (unsigned long __user *)&sf->gprs[8];
+ }
+
+ frame->cfa.rule = UNWIND_USER_CFA_RULE_SP_OFFSET;
+ frame->cfa.offset = sp - state->sp + 160;
+ frame->sp_off = -160;
+ frame->fp.rule = UNWIND_USER_RULE_ZERO; /* Cannot unwind FP. */
+ frame->ra.rule = UNWIND_USER_RULE_CFA_OFFSET_DEREF;
+ frame->ra.offset = (unsigned long)ra_addr - (state->sp + frame->cfa.offset);
+ frame->outermost = false;
+
+ return 0;
+}
+
+#endif /* CONFIG_HAVE_UNWIND_USER_FP */
+
#include <asm-generic/unwind_user.h>
#endif /* _ASM_S390_UNWIND_USER_H */
--
2.51.0
Powered by blists - more mailing lists