From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752324AbdHHS6N (ORCPT ); Tue, 8 Aug 2017 14:58:13 -0400 Received: from mx1.redhat.com ([209.132.183.28]:49902 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752149AbdHHS6L (ORCPT ); Tue, 8 Aug 2017 14:58:11 -0400 DMARC-Filter: OpenDMARC Filter v1.3.2 mx1.redhat.com 386733E2A1 Authentication-Results: ext-mx06.extmail.prod.ext.phx2.redhat.com; dmarc=none (p=none dis=none) header.from=redhat.com Authentication-Results: ext-mx06.extmail.prod.ext.phx2.redhat.com; spf=fail smtp.mailfrom=jpoimboe@redhat.com Date: Tue, 8 Aug 2017 13:58:09 -0500 From: Josh Poimboeuf To: "Levin, Alexander (Sasha Levin)" Cc: "x86@kernel.org" , "linux-kernel@vger.kernel.org" , "live-patching@vger.kernel.org" , Linus Torvalds , Andy Lutomirski , Jiri Slaby , Ingo Molnar , "H. Peter Anvin" , Peter Zijlstra , Mike Galbraith Subject: Re: [PATCH v4 1/2] x86/unwind: add ORC unwinder Message-ID: <20170808185809.qaug762cj7nw3bcd@treble> References: <0a6cbfb40f8da99b7a45a1a8302dc6aef16ec812.1500938583.git.jpoimboe@redhat.com> <20170728164844.tee7ujqluv2fgarf@sasha-lappy> <20170728175234.pmou7z6dosbi7krh@treble> <20170728182954.imivl45vrc7toarp@sasha-lappy> <20170728185720.fwczcezbkrlxmwqb@treble> <20170728195912.panyn4p6e6ovueey@sasha-lappy> <20170729035437.fmnxmeedrq55bpwm@treble> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: <20170729035437.fmnxmeedrq55bpwm@treble> User-Agent: Mutt/1.6.0.1 (2016-04-01) X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.30]); Tue, 08 Aug 2017 18:58:11 +0000 (UTC) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Fri, Jul 28, 2017 at 10:54:37PM -0500, Josh Poimboeuf wrote: > On Fri, Jul 28, 2017 at 07:59:12PM +0000, Levin, Alexander (Sasha Levin) wrote: > > On Fri, Jul 28, 2017 at 01:57:20PM -0500, Josh Poimboeuf wrote: > > >Thanks, that's much better. I'm relieved the unwinder didn't screw that > > >up, at least. > > > > > >This looks like a tricky one. Is it easily recreatable? > > > > Yeah, I just hit it again with slightly different initial calls: > > Sasha sent me some data privately. As I suspected, the cause is some > bad ORC data. Objtool incorrectly assumes that once the frame pointer > is set up, it no longer gets touched. So as it turns out, my pre-vacation self was completely wrong. The problem is actually some runtime instruction patching which affects the accuracy of the ORC data. Take for example the lock_is_held_type() function. In vmlinux, it has the following instruction: callq *0xffffffff85a94880 (pv_irq_ops.save_fl) At runtime, that instruction is patched and replaced with a fast inline version of arch_local_save_flags() which eliminates the call: pushfq pop %rax The problem is when an interrupt hits after the push: pushfq --- irq --- pop %rax The push offsets the stack pointer by 8 bytes, confusing the ORC unwinder when it tries to unwind from the IRQ. The race should be somewhat rare, though Sasha has no problems hitting it with syzkaller. I'm not sure what the solution should be. It will probably need to be one of the following: a) either don't allow runtime "alternative" patches to mess with the stack pointer (objtool could enforce this); or b) come up with some way to register such patches with the ORC unwinder at runtime. I haven't looked much at either option to see how feasible they would be. Any thoughts/opinions? -- Josh