lkml.org 
[lkml]   [2019]   [Mar]   [26]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.14 26/41] x86/unwind: Add hardcoded ORC entry for NULL
    Date
    4.14-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Jann Horn <jannh@google.com>

    commit ac5ceccce5501e43d217c596e4ee859f2a3fef79 upstream.

    When the ORC unwinder is invoked for an oops caused by IP==0,
    it currently has no idea what to do because there is no debug information
    for the stack frame of NULL.

    But if RIP is NULL, it is very likely that the last successfully executed
    instruction was an indirect CALL/JMP, and it is possible to unwind out in
    the same way as for the first instruction of a normal function. Hardcode
    a corresponding ORC entry.

    With an artificially-added NULL call in prctl_set_seccomp(), before this
    patch, the trace is:

    Call Trace:
    ? __x64_sys_prctl+0x402/0x680
    ? __ia32_sys_prctl+0x6e0/0x6e0
    ? __do_page_fault+0x457/0x620
    ? do_syscall_64+0x6d/0x160
    ? entry_SYSCALL_64_after_hwframe+0x44/0xa9

    After this patch, the trace looks like this:

    Call Trace:
    __x64_sys_prctl+0x402/0x680
    ? __ia32_sys_prctl+0x6e0/0x6e0
    ? __do_page_fault+0x457/0x620
    do_syscall_64+0x6d/0x160
    entry_SYSCALL_64_after_hwframe+0x44/0xa9

    prctl_set_seccomp() still doesn't show up in the trace because for some
    reason, tail call optimization is only disabled in builds that use the
    frame pointer unwinder.

    Signed-off-by: Jann Horn <jannh@google.com>
    Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
    Acked-by: Josh Poimboeuf <jpoimboe@redhat.com>
    Cc: Borislav Petkov <bp@alien8.de>
    Cc: Andrew Morton <akpm@linux-foundation.org>
    Cc: syzbot <syzbot+ca95b2b7aef9e7cbd6ab@syzkaller.appspotmail.com>
    Cc: "H. Peter Anvin" <hpa@zytor.com>
    Cc: Masahiro Yamada <yamada.masahiro@socionext.com>
    Cc: Michal Marek <michal.lkml@markovi.net>
    Cc: linux-kbuild@vger.kernel.org
    Link: https://lkml.kernel.org/r/20190301031201.7416-2-jannh@google.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    arch/x86/kernel/unwind_orc.c | 17 +++++++++++++++++
    1 file changed, 17 insertions(+)

    --- a/arch/x86/kernel/unwind_orc.c
    +++ b/arch/x86/kernel/unwind_orc.c
    @@ -74,11 +74,28 @@ static struct orc_entry *orc_module_find
    }
    #endif

    +/*
    + * If we crash with IP==0, the last successfully executed instruction
    + * was probably an indirect function call with a NULL function pointer,
    + * and we don't have unwind information for NULL.
    + * This hardcoded ORC entry for IP==0 allows us to unwind from a NULL function
    + * pointer into its parent and then continue normally from there.
    + */
    +static struct orc_entry null_orc_entry = {
    + .sp_offset = sizeof(long),
    + .sp_reg = ORC_REG_SP,
    + .bp_reg = ORC_REG_UNDEFINED,
    + .type = ORC_TYPE_CALL
    +};
    +
    static struct orc_entry *orc_find(unsigned long ip)
    {
    if (!orc_init)
    return NULL;

    + if (ip == 0)
    + return &null_orc_entry;
    +
    /* For non-init vmlinux addresses, use the fast lookup table: */
    if (ip >= LOOKUP_START_IP && ip < LOOKUP_STOP_IP) {
    unsigned int idx, start, stop;

    \
     
     \ /
      Last update: 2019-03-26 07:35    [W:5.167 / U:0.692 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site