lkml.org 
[lkml]   [2021]   [Feb]   [3]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
From
SubjectRe: BUG: KASAN: stack-out-of-bounds in unwind_next_frame+0x1df5/0x2650
On Wed, Feb 03, 2021 at 03:30:35PM -0800, Ivan Babrou wrote:
> > > > Can you recreate with this patch, and add "unwind_debug" to the cmdline?
> > > > It will spit out a bunch of stack data.
> > >
> > > Here's the three I'm building:
> > >
> > > * https://github.com/bobrik/linux/tree/ivan/static-call-5.9
> > >
> > > It contains:
> > >
> > > * v5.9 tag as the base
> > > * static_call-2020-10-12 tag
> > > * dm-crypt patches to reproduce the issue with KASAN
> > > * x86/unwind: Add 'unwind_debug' cmdline option
> > > * tracepoint: Fix race between tracing and removing tracepoint
> > >
> > > The very same issue can be reproduced on 5.10.11 with no patches,
> > > but I'm going with 5.9, since it boils down to static call changes.
> > >
> > > Here's the decoded stack from the kernel with unwind debug enabled:
> > >
> > > * https://gist.github.com/bobrik/ed052ac0ae44c880f3170299ad4af56b
> > >
> > > See my first email for the exact commands that trigger this.
> >
> > Thanks. Do you happen to have the original dmesg, before running it
> > through the post-processing script?
>
> Yes, here it is:
>
> * https://gist.github.com/bobrik/8c13e6a02555fb21cadabb74cdd6f9ab

It appears the unwinder is getting lost in crypto code. No idea what
this has to do with static calls though. Or maybe you're seeing
multiple issues.

Does this fix it?


diff --git a/arch/x86/crypto/Makefile b/arch/x86/crypto/Makefile
index a31de0c6ccde..36c55341137c 100644
--- a/arch/x86/crypto/Makefile
+++ b/arch/x86/crypto/Makefile
@@ -2,7 +2,14 @@
#
# x86 crypto algorithms

-OBJECT_FILES_NON_STANDARD := y
+OBJECT_FILES_NON_STANDARD_sha256-avx2-asm.o := y
+OBJECT_FILES_NON_STANDARD_sha512-ssse3-asm.o := y
+OBJECT_FILES_NON_STANDARD_sha512-avx-asm.o := y
+OBJECT_FILES_NON_STANDARD_sha512-avx2-asm.o := y
+OBJECT_FILES_NON_STANDARD_crc32c-pcl-intel-asm_64.o := y
+OBJECT_FILES_NON_STANDARD_camellia-aesni-avx2-asm_64.o := y
+OBJECT_FILES_NON_STANDARD_sha1_avx2_x86_64_asm.o := y
+OBJECT_FILES_NON_STANDARD_sha1_ni_asm.o := y

obj-$(CONFIG_CRYPTO_GLUE_HELPER_X86) += glue_helper.o

diff --git a/arch/x86/crypto/aesni-intel_avx-x86_64.S b/arch/x86/crypto/aesni-intel_avx-x86_64.S
index 5fee47956f3b..59c36b88954f 100644
--- a/arch/x86/crypto/aesni-intel_avx-x86_64.S
+++ b/arch/x86/crypto/aesni-intel_avx-x86_64.S
@@ -237,8 +237,8 @@ define_reg j %j
.noaltmacro
.endm

-# need to push 4 registers into stack to maintain
-STACK_OFFSET = 8*4
+# need to push 5 registers into stack to maintain
+STACK_OFFSET = 8*5

TMP1 = 16*0 # Temporary storage for AAD
TMP2 = 16*1 # Temporary storage for AES State 2 (State 1 is stored in an XMM register)
@@ -257,6 +257,8 @@ VARIABLE_OFFSET = 16*8

.macro FUNC_SAVE
#the number of pushes must equal STACK_OFFSET
+ push %rbp
+ mov %rsp, %rbp
push %r12
push %r13
push %r14
@@ -271,12 +273,14 @@ VARIABLE_OFFSET = 16*8
.endm

.macro FUNC_RESTORE
+ add $VARIABLE_OFFSET, %rsp
mov %r14, %rsp

pop %r15
pop %r14
pop %r13
pop %r12
+ pop %rbp
.endm

# Encryption of a single block
\
 
 \ /
  Last update: 2021-02-04 01:21    [W:0.105 / U:0.724 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site