mirror of https://lore.kernel.org/lkml/
 help / color / mirror / Atom feed
From: "Steven Rostedt (VMware)" <rostedt@goodmis.org>
To: LKML <linux-kernel@vger.kernel.org>
Cc: Ingo Molnar <mingo@kernel.org>,
	Thomas Gleixner <tglx@linutronix.de>,
	"H. Peter Anvin" <hpa@zytor.com>,
	Josh Poimboeuf <jpoimboe@redhat.com>,
	Masami Hiramatsu <mhiramat@kernel.org>,
	kernel test robot <fengguang.wu@intel.com>
Subject: [PATCH] x86/ftrace: Fix ebp in ftrace_regs_caller that screws up unwinder
Date: Thu, 20 Apr 2017 17:22:36 -0400	[thread overview]
Message-ID: <20170420172236.7af7f6e5@gandalf.local.home> (raw)

From: Steven Rostedt (VMware) <rostedt@goodmis.org>

Fengguang Wu's zero day bot triggered a stack unwinder dump. This can
be easily triggered when CONFIG_FRAME_POINTERS is enabled and -mfentry
is in use on x86_32.

 ># cd /sys/kernel/debug/tracing
 ># echo 'p:schedule schedule' > kprobe_events
 ># echo stacktrace > events/kprobes/schedule/trigger

This is because the code that implemented fentry in the
ftrace_regs_caller tried to use the least amount of #ifdefs, and
modified ebp when CC_USE_FENTRY was defined to point to the parent ip
as it does when CC_USE_FENTRY is not defined. But when
CONFIG_FRAME_POINTERS is set, it corrupts the ebp register for this
frame while doing the tracing.

NOTE, it does not corrupt ebp in any other way. It is just a bad
frame pointer when calling into the tracing infrastructure. The original
ebp is restored before returning from the fentry call. But if a stack
trace is performed inside the tracing, the unwinder will notice the bad
ebp.

Instead of toying with ebp with CC_USING_FENTRY, just slap the parent
ip into the second parameter (%edx), and have an #else that does it the
original way.

The unwinder will unfortunately miss the function being traced, as the
stack frame is not set up yet for it, as it is for x86_64. But fixing
that is a bit more complex and did not work before anyway.

This has been tested with and without FRAME_POINTERS being set while
using -mfentry, as well as using an older compiler that uses mcount.

Reported-by: kernel test robot <fengguang.wu@intel.com>
Analyzed-by: Josh Poimboeuf <jpoimboe@redhat.com>
Link: https://lists.01.org/pipermail/lkp/2017-April/006165.html
Fixes: 644e0e8dc76b ("x86/ftrace: Add -mfentry support to x86_32 with DYNAMIC_FTRACE set")
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
---
diff --git a/arch/x86/kernel/ftrace_32.S b/arch/x86/kernel/ftrace_32.S
index 07f4035..722a145 100644
--- a/arch/x86/kernel/ftrace_32.S
+++ b/arch/x86/kernel/ftrace_32.S
@@ -128,14 +128,14 @@ ENTRY(ftrace_regs_caller)
 	pushl	%edx
 	pushl	%ecx
 	pushl	%ebx
-#ifdef CC_USING_FENTRY
-	/* Load 4 off of the parent ip addr into ebp */
-	lea	14*4(%esp), %ebp
-#endif
 
 	movl	12*4(%esp), %eax		/* Load ip (1st parameter) */
 	subl	$MCOUNT_INSN_SIZE, %eax		/* Adjust ip */
+#ifdef CC_USING_FENTRY
+	movl	15*4(%esp), %edx		/* Load parent ip (2nd parameter) */
+#else
 	movl	0x4(%ebp), %edx			/* Load parent ip (2nd parameter) */
+#endif
 	movl	function_trace_op, %ecx		/* Save ftrace_pos in 3rd parameter */
 	pushl	%esp				/* Save pt_regs as 4th parameter */
 

             reply	other threads:[~2017-04-20 21:22 UTC|newest]

Thread overview: 3+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2017-04-20 21:22 Steven Rostedt (VMware) [this message]
2017-04-20 21:38 ` Josh Poimboeuf
2017-04-21  7:52 ` [tip:x86/asm] " tip-bot for Steven Rostedt (VMware)

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20170420172236.7af7f6e5@gandalf.local.home \
    --to=rostedt@goodmis.org \
    --cc=fengguang.wu@intel.com \
    --cc=hpa@zytor.com \
    --cc=jpoimboe@redhat.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=mhiramat@kernel.org \
    --cc=mingo@kernel.org \
    --cc=tglx@linutronix.de \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox

all inboxes | Powered by JetHome®