Messages in this thread | | | From | Dmitry Vyukov <> | Date | Fri, 14 Oct 2016 16:08:49 +0200 | Subject | Re: [PATCH v4] kprobes: unpoison stack in jprobe_return() for KASAN |
| |
On Fri, Oct 14, 2016 at 3:08 PM, Mark Rutland <mark.rutland@arm.com> wrote: > On Fri, Oct 14, 2016 at 01:54:30PM +0200, Dmitry Vyukov wrote: >> KASAN stack instrumentation poisons stack redzones on function entry >> and unpoisons them on function exit. If a function exits abnormally >> (e.g. with a longjmp like jprobe_return()), stack redzones are left >> poisoned. Later this leads to random KASAN false reports. >> >> Unpoison stack redzones in the frames we are going to jump over >> before doing actual longjmp in jprobe_return(). >> >> Signed-off-by: Dmitry Vyukov <dvyukov@google.com> >> Reviewed-by: Mark Rutland <mark.rutland@arm.com> > > ... judging by the kbuild test robot I spoke too soon, and should have > been more thorough. :/ > >> +/* >> + * Clear all poison for the region between the current SP and a provided >> + * watermark value, as is sometimes required prior to hand-crafted asm function >> + * returns in the middle of functions. >> + */ >> +void kasan_unpoison_stack_above_sp_to(const void *watermark) >> +{ >> + const void *sp = (void *)current_stack_pointer(); > > Aargh; it seems current_stack_pointer() is only function-like on some > arches, and not on others (arm64 included). I should have known better; > sorry for the bad suggestion. > > I'm not overjoyed about taking the address of a stack variable to > implement this ourselves. Can we use __builtin_frame_address(0) instead? > Or are there cases where that won't work on x86?
Mailed v5 with __builtin_frame_address(0). Built mm/kasan/kasan.o for arm64.
I see that __builtin_frame_address(0) is used on several arches including x86 and arm64. So I hope we are good here.
> >> + size_t size = watermark - sp; >> + >> + if (WARN_ON(sp > watermark)) >> + return; > > ... not a new problem, but we should also include <linux/bug.h> for > WARN_ON().
Done
| |