mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-24 17:59:32 +00:00
![Kees Cook](/assets/img/avatar_default.png)
Commitb8347c2196
("x86/debug: Handle warnings before the notifier chain, to fix KGDB crash") changed the ordering of fixups, and did not take into account the case of x86 processing non-WARN() and non-BUG() exceptions. This would lead to output of a false BUG line with no other information. In the case of a refcount exception, it would be immediately followed by the refcount WARN(), producing very strange double-"cut here": lkdtm: attempting bad refcount_inc() overflow ------------[ cut here ]------------ Kernel BUG at 0000000065f29de5 [verbose debug info unavailable] ------------[ cut here ]------------ refcount_t overflow at lkdtm_REFCOUNT_INC_OVERFLOW+0x6b/0x90 in cat[3065], uid/euid: 0/0 WARNING: CPU: 0 PID: 3065 at kernel/panic.c:657 refcount_error_report+0x9a/0xa4 ... In the prior ordering, exceptions were searched first: do_trap_no_signal(struct task_struct *tsk, int trapnr, char *str, ... if (fixup_exception(regs, trapnr)) return 0; - if (fixup_bug(regs, trapnr)) - return 0; - As a result, fixup_bugs()'s is_valid_bugaddr() didn't take into account needing to search the exception list first, since that had already happened. So, instead of searching the exception list twice (once in is_valid_bugaddr() and then again in fixup_exception()), just add a simple sanity check to report_bug() that will immediately bail out if a BUG() (or WARN()) entry is not found. Link: http://lkml.kernel.org/r/20180301225934.GA34350@beast Fixes:b8347c2196
("x86/debug: Handle warnings before the notifier chain, to fix KGDB crash") Signed-off-by: Kees Cook <keescook@chromium.org> Cc: Ingo Molnar <mingo@kernel.org> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Borislav Petkov <bp@alien8.de> Cc: Richard Weinberger <richard.weinberger@gmail.com> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
223 lines
5.5 KiB
C
223 lines
5.5 KiB
C
// SPDX-License-Identifier: GPL-2.0
|
|
/*
|
|
Generic support for BUG()
|
|
|
|
This respects the following config options:
|
|
|
|
CONFIG_BUG - emit BUG traps. Nothing happens without this.
|
|
CONFIG_GENERIC_BUG - enable this code.
|
|
CONFIG_GENERIC_BUG_RELATIVE_POINTERS - use 32-bit pointers relative to
|
|
the containing struct bug_entry for bug_addr and file.
|
|
CONFIG_DEBUG_BUGVERBOSE - emit full file+line information for each BUG
|
|
|
|
CONFIG_BUG and CONFIG_DEBUG_BUGVERBOSE are potentially user-settable
|
|
(though they're generally always on).
|
|
|
|
CONFIG_GENERIC_BUG is set by each architecture using this code.
|
|
|
|
To use this, your architecture must:
|
|
|
|
1. Set up the config options:
|
|
- Enable CONFIG_GENERIC_BUG if CONFIG_BUG
|
|
|
|
2. Implement BUG (and optionally BUG_ON, WARN, WARN_ON)
|
|
- Define HAVE_ARCH_BUG
|
|
- Implement BUG() to generate a faulting instruction
|
|
- NOTE: struct bug_entry does not have "file" or "line" entries
|
|
when CONFIG_DEBUG_BUGVERBOSE is not enabled, so you must generate
|
|
the values accordingly.
|
|
|
|
3. Implement the trap
|
|
- In the illegal instruction trap handler (typically), verify
|
|
that the fault was in kernel mode, and call report_bug()
|
|
- report_bug() will return whether it was a false alarm, a warning,
|
|
or an actual bug.
|
|
- You must implement the is_valid_bugaddr(bugaddr) callback which
|
|
returns true if the eip is a real kernel address, and it points
|
|
to the expected BUG trap instruction.
|
|
|
|
Jeremy Fitzhardinge <jeremy@goop.org> 2006
|
|
*/
|
|
|
|
#define pr_fmt(fmt) fmt
|
|
|
|
#include <linux/list.h>
|
|
#include <linux/module.h>
|
|
#include <linux/kernel.h>
|
|
#include <linux/bug.h>
|
|
#include <linux/sched.h>
|
|
#include <linux/rculist.h>
|
|
|
|
extern struct bug_entry __start___bug_table[], __stop___bug_table[];
|
|
|
|
static inline unsigned long bug_addr(const struct bug_entry *bug)
|
|
{
|
|
#ifndef CONFIG_GENERIC_BUG_RELATIVE_POINTERS
|
|
return bug->bug_addr;
|
|
#else
|
|
return (unsigned long)bug + bug->bug_addr_disp;
|
|
#endif
|
|
}
|
|
|
|
#ifdef CONFIG_MODULES
|
|
/* Updates are protected by module mutex */
|
|
static LIST_HEAD(module_bug_list);
|
|
|
|
static struct bug_entry *module_find_bug(unsigned long bugaddr)
|
|
{
|
|
struct module *mod;
|
|
struct bug_entry *bug = NULL;
|
|
|
|
rcu_read_lock_sched();
|
|
list_for_each_entry_rcu(mod, &module_bug_list, bug_list) {
|
|
unsigned i;
|
|
|
|
bug = mod->bug_table;
|
|
for (i = 0; i < mod->num_bugs; ++i, ++bug)
|
|
if (bugaddr == bug_addr(bug))
|
|
goto out;
|
|
}
|
|
bug = NULL;
|
|
out:
|
|
rcu_read_unlock_sched();
|
|
|
|
return bug;
|
|
}
|
|
|
|
void module_bug_finalize(const Elf_Ehdr *hdr, const Elf_Shdr *sechdrs,
|
|
struct module *mod)
|
|
{
|
|
char *secstrings;
|
|
unsigned int i;
|
|
|
|
lockdep_assert_held(&module_mutex);
|
|
|
|
mod->bug_table = NULL;
|
|
mod->num_bugs = 0;
|
|
|
|
/* Find the __bug_table section, if present */
|
|
secstrings = (char *)hdr + sechdrs[hdr->e_shstrndx].sh_offset;
|
|
for (i = 1; i < hdr->e_shnum; i++) {
|
|
if (strcmp(secstrings+sechdrs[i].sh_name, "__bug_table"))
|
|
continue;
|
|
mod->bug_table = (void *) sechdrs[i].sh_addr;
|
|
mod->num_bugs = sechdrs[i].sh_size / sizeof(struct bug_entry);
|
|
break;
|
|
}
|
|
|
|
/*
|
|
* Strictly speaking this should have a spinlock to protect against
|
|
* traversals, but since we only traverse on BUG()s, a spinlock
|
|
* could potentially lead to deadlock and thus be counter-productive.
|
|
* Thus, this uses RCU to safely manipulate the bug list, since BUG
|
|
* must run in non-interruptive state.
|
|
*/
|
|
list_add_rcu(&mod->bug_list, &module_bug_list);
|
|
}
|
|
|
|
void module_bug_cleanup(struct module *mod)
|
|
{
|
|
lockdep_assert_held(&module_mutex);
|
|
list_del_rcu(&mod->bug_list);
|
|
}
|
|
|
|
#else
|
|
|
|
static inline struct bug_entry *module_find_bug(unsigned long bugaddr)
|
|
{
|
|
return NULL;
|
|
}
|
|
#endif
|
|
|
|
struct bug_entry *find_bug(unsigned long bugaddr)
|
|
{
|
|
struct bug_entry *bug;
|
|
|
|
for (bug = __start___bug_table; bug < __stop___bug_table; ++bug)
|
|
if (bugaddr == bug_addr(bug))
|
|
return bug;
|
|
|
|
return module_find_bug(bugaddr);
|
|
}
|
|
|
|
enum bug_trap_type report_bug(unsigned long bugaddr, struct pt_regs *regs)
|
|
{
|
|
struct bug_entry *bug;
|
|
const char *file;
|
|
unsigned line, warning, once, done;
|
|
|
|
if (!is_valid_bugaddr(bugaddr))
|
|
return BUG_TRAP_TYPE_NONE;
|
|
|
|
bug = find_bug(bugaddr);
|
|
if (!bug)
|
|
return BUG_TRAP_TYPE_NONE;
|
|
|
|
file = NULL;
|
|
line = 0;
|
|
warning = 0;
|
|
|
|
if (bug) {
|
|
#ifdef CONFIG_DEBUG_BUGVERBOSE
|
|
#ifndef CONFIG_GENERIC_BUG_RELATIVE_POINTERS
|
|
file = bug->file;
|
|
#else
|
|
file = (const char *)bug + bug->file_disp;
|
|
#endif
|
|
line = bug->line;
|
|
#endif
|
|
warning = (bug->flags & BUGFLAG_WARNING) != 0;
|
|
once = (bug->flags & BUGFLAG_ONCE) != 0;
|
|
done = (bug->flags & BUGFLAG_DONE) != 0;
|
|
|
|
if (warning && once) {
|
|
if (done)
|
|
return BUG_TRAP_TYPE_WARN;
|
|
|
|
/*
|
|
* Since this is the only store, concurrency is not an issue.
|
|
*/
|
|
bug->flags |= BUGFLAG_DONE;
|
|
}
|
|
}
|
|
|
|
if (warning) {
|
|
/* this is a WARN_ON rather than BUG/BUG_ON */
|
|
__warn(file, line, (void *)bugaddr, BUG_GET_TAINT(bug), regs,
|
|
NULL);
|
|
return BUG_TRAP_TYPE_WARN;
|
|
}
|
|
|
|
printk(KERN_DEFAULT CUT_HERE);
|
|
|
|
if (file)
|
|
pr_crit("kernel BUG at %s:%u!\n", file, line);
|
|
else
|
|
pr_crit("Kernel BUG at %pB [verbose debug info unavailable]\n",
|
|
(void *)bugaddr);
|
|
|
|
return BUG_TRAP_TYPE_BUG;
|
|
}
|
|
|
|
static void clear_once_table(struct bug_entry *start, struct bug_entry *end)
|
|
{
|
|
struct bug_entry *bug;
|
|
|
|
for (bug = start; bug < end; bug++)
|
|
bug->flags &= ~BUGFLAG_DONE;
|
|
}
|
|
|
|
void generic_bug_clear_once(void)
|
|
{
|
|
#ifdef CONFIG_MODULES
|
|
struct module *mod;
|
|
|
|
rcu_read_lock_sched();
|
|
list_for_each_entry_rcu(mod, &module_bug_list, bug_list)
|
|
clear_once_table(mod->bug_table,
|
|
mod->bug_table + mod->num_bugs);
|
|
rcu_read_unlock_sched();
|
|
#endif
|
|
|
|
clear_once_table(__start___bug_table, __stop___bug_table);
|
|
}
|