mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-12 21:57:43 +00:00
95bb5b617b
Currently, arch_stack_walk() can only get the full stack information including NMI. This is because the implementation of arch_stack_walk() is forced to ignore the information passed by the regs parameter and use the current stack information instead. For some detection systems like KFENCE, only partial stack information is needed. In particular, the stack frame where the interrupt occurred. To support KFENCE, this patch modifies the implementation of the arch_stack_walk() function so that if this function is called with the regs argument passed, it retains all the stack information in regs and uses it to provide accurate information. Before this patch: [ 1.531195 ] ================================================================== [ 1.531442 ] BUG: KFENCE: out-of-bounds read in stack_trace_save_regs+0x48/0x6c [ 1.531442 ] [ 1.531900 ] Out-of-bounds read at 0xffff800012267fff (1B left of kfence-#12): [ 1.532046 ] stack_trace_save_regs+0x48/0x6c [ 1.532169 ] kfence_report_error+0xa4/0x528 [ 1.532276 ] kfence_handle_page_fault+0x124/0x270 [ 1.532388 ] no_context+0x50/0x94 [ 1.532453 ] do_page_fault+0x1a8/0x36c [ 1.532524 ] tlb_do_page_fault_0+0x118/0x1b4 [ 1.532623 ] test_out_of_bounds_read+0xa0/0x1d8 [ 1.532745 ] kunit_generic_run_threadfn_adapter+0x1c/0x28 [ 1.532854 ] kthread+0x124/0x130 [ 1.532922 ] ret_from_kernel_thread+0xc/0xa4 <snip> After this patch: [ 1.320220 ] ================================================================== [ 1.320401 ] BUG: KFENCE: out-of-bounds read in test_out_of_bounds_read+0xa8/0x1d8 [ 1.320401 ] [ 1.320898 ] Out-of-bounds read at 0xffff800012257fff (1B left of kfence-#10): [ 1.321134 ] test_out_of_bounds_read+0xa8/0x1d8 [ 1.321264 ] kunit_generic_run_threadfn_adapter+0x1c/0x28 [ 1.321392 ] kthread+0x124/0x130 [ 1.321459 ] ret_from_kernel_thread+0xc/0xa4 <snip> Suggested-by: Jinyang He <hejinyang@loongson.cn> Signed-off-by: Enze Li <lienze@kylinos.cn> Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
80 lines
1.9 KiB
C
80 lines
1.9 KiB
C
// SPDX-License-Identifier: GPL-2.0
|
|
/*
|
|
* Stack trace management functions
|
|
*
|
|
* Copyright (C) 2022 Loongson Technology Corporation Limited
|
|
*/
|
|
#include <linux/sched.h>
|
|
#include <linux/stacktrace.h>
|
|
#include <linux/uaccess.h>
|
|
|
|
#include <asm/stacktrace.h>
|
|
#include <asm/unwind.h>
|
|
|
|
void arch_stack_walk(stack_trace_consume_fn consume_entry, void *cookie,
|
|
struct task_struct *task, struct pt_regs *regs)
|
|
{
|
|
unsigned long addr;
|
|
struct pt_regs dummyregs;
|
|
struct unwind_state state;
|
|
|
|
if (!regs) {
|
|
regs = &dummyregs;
|
|
|
|
if (task == current) {
|
|
regs->regs[3] = (unsigned long)__builtin_frame_address(0);
|
|
regs->csr_era = (unsigned long)__builtin_return_address(0);
|
|
} else {
|
|
regs->regs[3] = thread_saved_fp(task);
|
|
regs->csr_era = thread_saved_ra(task);
|
|
}
|
|
regs->regs[1] = 0;
|
|
}
|
|
|
|
for (unwind_start(&state, task, regs);
|
|
!unwind_done(&state) && !unwind_error(&state); unwind_next_frame(&state)) {
|
|
addr = unwind_get_return_address(&state);
|
|
if (!addr || !consume_entry(cookie, addr))
|
|
break;
|
|
}
|
|
}
|
|
|
|
static int
|
|
copy_stack_frame(unsigned long fp, struct stack_frame *frame)
|
|
{
|
|
int ret = 1;
|
|
unsigned long err;
|
|
unsigned long __user *user_frame_tail;
|
|
|
|
user_frame_tail = (unsigned long *)(fp - sizeof(struct stack_frame));
|
|
if (!access_ok(user_frame_tail, sizeof(*frame)))
|
|
return 0;
|
|
|
|
pagefault_disable();
|
|
err = (__copy_from_user_inatomic(frame, user_frame_tail, sizeof(*frame)));
|
|
if (err || (unsigned long)user_frame_tail >= frame->fp)
|
|
ret = 0;
|
|
pagefault_enable();
|
|
|
|
return ret;
|
|
}
|
|
|
|
void arch_stack_walk_user(stack_trace_consume_fn consume_entry, void *cookie,
|
|
const struct pt_regs *regs)
|
|
{
|
|
unsigned long fp = regs->regs[22];
|
|
|
|
while (fp && !((unsigned long)fp & 0xf)) {
|
|
struct stack_frame frame;
|
|
|
|
frame.fp = 0;
|
|
frame.ra = 0;
|
|
if (!copy_stack_frame(fp, &frame))
|
|
break;
|
|
if (!frame.ra)
|
|
break;
|
|
if (!consume_entry(cookie, frame.ra))
|
|
break;
|
|
fp = frame.fp;
|
|
}
|
|
}
|