From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752403AbcEQSGM (ORCPT ); Tue, 17 May 2016 14:06:12 -0400 Received: from mx1.redhat.com ([209.132.183.28]:40624 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752294AbcEQSGK (ORCPT ); Tue, 17 May 2016 14:06:10 -0400 Date: Tue, 17 May 2016 13:06:06 -0500 From: Josh Poimboeuf To: Linus Torvalds Cc: Ingo Molnar , Matt Fleming , Alex Thorlton , Linux Kernel Mailing List , Thomas Gleixner , "H. Peter Anvin" , Andrew Morton , Peter Zijlstra , Borislav Petkov , Andy Lutomirski , Steven Rostedt , Denys Vlasenko Subject: [PATCH v2] x86/asm/entry: fix stack return address retrieval in thunk Message-ID: <20160517180606.v5o7wcgdni7443ol@treble> References: <20160516144648.GA22999@gmail.com> <20160517090434.GA21993@codeblueprint.co.uk> <20160517094655.GB21993@codeblueprint.co.uk> <20160517102049.GB26924@gmail.com> <20160517144349.oldftkpo2prpqh56@treble> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.6.0.1 (2016-04-01) X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.39]); Tue, 17 May 2016 18:06:09 +0000 (UTC) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Tue, May 17, 2016 at 09:31:12AM -0700, Linus Torvalds wrote: > On Tue, May 17, 2016 at 7:43 AM, Josh Poimboeuf wrote: > > > > index 98df1fa..dae7ca0 100644 > > --- a/arch/x86/entry/thunk_64.S > > +++ b/arch/x86/entry/thunk_64.S > > @@ -15,9 +15,10 @@ > > .globl \name > > .type \name, @function > > \name: > > + /* push 1 register if frame pointers are enabled */ > > FRAME_BEGIN > > > > - /* this one pushes 9 elems, the next one would be %rIP */ > > + /* push 9 registers */ > > I don't hate this patch, but quite frankly, as with the other case, > I'd just make the frame pointer be unconditional in this case. > > If we push nine other registers, the frame pointer setup code is *not* > going to matter. > > The reason to avoid frame pointers in code generation is two-fold: > > 1) for small leaf functions, it often ends up dominating > > 2) it removes a register that is otherwise usable, which can be > particularly bad on 32-bit x86 due to the much more limited number of > registers (and was apparently really noticeable on the older on-order > atom cores) > > and in this case neither of them is really an issue. > > So I would suggest that any case that actually depends on a frame > access just make the frame pointer not just unconditional, but > _explicit_. > > So not just avoiding the macro because it's conditional, but write out > the sequence to actually set up the frame, and then use > > - movq 9*8(%rsp), %rdi > + movq 8(%rbp), %rdi # return address > > to entirely avoid all kind of "how many registers have we pushed" math. > > Considering that we got this wrong in two places, it's clearly too > subtle for our little brains as-is. Makes sense, thanks. Here's v2: --- From: Josh Poimboeuf Subject: [PATCH v2] x86/asm/entry: fix stack return address retrieval in thunk With CONFIG_FRAME_POINTER enabled, a thunk can pass a bad return address value to the called function. '9*8(%rsp)' actually gets the frame pointer, not the return address. The only users of the 'put_ret_addr_in_rdi' option are two functions which trace the enabling and disabling of interrupts, so this bug can result in bad debug or tracing information with CONFIG_IRQSOFF_TRACER or CONFIG_PROVE_LOCKING. Fixes: 058fb73274f9 ("x86/asm/entry: Create stack frames in thunk functions") Reported-by: Matt Fleming Signed-off-by: Josh Poimboeuf --- arch/x86/entry/thunk_64.S | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/arch/x86/entry/thunk_64.S b/arch/x86/entry/thunk_64.S index 98df1fa..027aec4 100644 --- a/arch/x86/entry/thunk_64.S +++ b/arch/x86/entry/thunk_64.S @@ -8,16 +8,15 @@ #include #include "calling.h" #include -#include /* rdi: arg1 ... normal C conventions. rax is saved/restored. */ .macro THUNK name, func, put_ret_addr_in_rdi=0 .globl \name .type \name, @function \name: - FRAME_BEGIN + pushq %rbp + movq %rsp, %rbp - /* this one pushes 9 elems, the next one would be %rIP */ pushq %rdi pushq %rsi pushq %rdx @@ -29,8 +28,8 @@ pushq %r11 .if \put_ret_addr_in_rdi - /* 9*8(%rsp) is return addr on stack */ - movq 9*8(%rsp), %rdi + /* 8(%rbp) is return addr on stack */ + movq 8(%rbp), %rdi .endif call \func @@ -65,7 +64,7 @@ restore: popq %rdx popq %rsi popq %rdi - FRAME_END + popq %rbp ret _ASM_NOKPROBE(restore) #endif -- 2.4.11