mirror of https://lore.kernel.org/lkml/
 help / color / mirror / Atom feed
From: Josh Poimboeuf <jpoimboe@redhat.com>
To: x86@kernel.org
Cc: Fengguang Wu <fengguang.wu@intel.com>,
	Thomas Gleixner <tglx@linutronix.de>,
	Ingo Molnar <mingo@redhat.com>, "H. Peter Anvin" <hpa@zytor.com>,
	Thiago Jung Bauermann <bauerman@linux.vnet.ibm.com>,
	Linux Kernel Mailing List <linux-kernel@vger.kernel.org>,
	Linus Torvalds <torvalds@linux-foundation.org>
Subject: [PATCH] x86/unwind: Disable KASAN checking in the ORC unwinder
Date: Tue, 7 Nov 2017 20:19:34 -0600	[thread overview]
Message-ID: <20171108021934.zbl6unh5hpugybc5@treble> (raw)
In-Reply-To: <20171107172401.tmjllqfnkqxvq3x4@treble>


Fengguang reported a KASAN warning:

  Kprobe smoke test: started
  ==================================================================
  BUG: KASAN: stack-out-of-bounds in deref_stack_reg+0xb5/0x11a
  Read of size 8 at addr ffff8800001c7cd8 by task swapper/1

  CPU: 0 PID: 1 Comm: swapper Not tainted 4.14.0-rc8 #26
  Call Trace:
   <#DB>
   ...
   save_trace+0xd9/0x1d3
   mark_lock+0x5f7/0xdc3
   __lock_acquire+0x6b4/0x38ef
   ? kretprobe_table_lock+0x1a/0x42
   ? debug_show_all_locks+0x222/0x222
   ? get_usage_char+0x36/0x36
   ? lock_acquire+0x1a1/0x2aa
   lock_acquire+0x1a1/0x2aa
   ? kretprobe_table_lock+0x1a/0x42
   _raw_spin_lock_irqsave+0x46/0x55
   ? kretprobe_table_lock+0x1a/0x42
   kretprobe_table_lock+0x1a/0x42
   pre_handler_kretprobe+0x3f5/0x521
   ? __unregister_kprobe_bottom+0x1eb/0x1eb
   ? rcu_nmi_exit+0x70/0x98
   ? paranoid_exit_no_swapgs+0x10/0x10
   ? kprobe_target+0x1/0x11
   kprobe_int3_handler+0x19c/0x25f
   do_int3+0x61/0x142
   int3+0x30/0x60
  RIP: 0010:kprobe_target+0x1/0x11
  RSP: 0000:ffff8800001c7cd0 EFLAGS: 00000246
  RAX: 0000000000000000 RBX: 1ffff10000038f9b RCX: 0000000000000000
  RDX: ffffed0000038f6f RSI: 0000000000000000 RDI: 00000000bd9f051f
  RBP: ffff8800001c7cf8 R08: fffffbffffeaf26e R09: fffffbffffeaf26d
  R10: ffff8800001c7c80 R11: 0000000000000001 R12: ffffffff8208b990
  R13: ffffffff8208b980 R14: 0000000000000001 R15: dffffc0000000000
   </#DB>
   bzImage64_load+0xea5/0xea5
   ? j_kprobe_target+0x33/0x33
   ? up_write+0x1c/0x31
   ? blocking_notifier_chain_register+0x97/0xa1
   ? init_kprobes+0x410/0x43d
   ...

The ORC unwinder got confused by some kprobes changes, which isn't
surprising since the runtime code no longer matches vmlinux and the
stack was modified for kretprobes.

Until we have a way for generated code to register changes with the
unwinder, these types of warnings are inevitable.  So just disable KASAN
checks for stack accesses in the ORC unwinder.

Reported-by: Fengguang Wu <fengguang.wu@intel.com>
Signed-off-by: Josh Poimboeuf <jpoimboe@redhat.com>
---
 arch/x86/kernel/unwind_orc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/x86/kernel/unwind_orc.c b/arch/x86/kernel/unwind_orc.c
index b95007e7c1b3..a3f973b2c97a 100644
--- a/arch/x86/kernel/unwind_orc.c
+++ b/arch/x86/kernel/unwind_orc.c
@@ -279,7 +279,7 @@ static bool deref_stack_reg(struct unwind_state *state, unsigned long addr,
 	if (!stack_access_ok(state, addr, sizeof(long)))
 		return false;
 
-	*val = READ_ONCE_TASK_STACK(state->task, *(unsigned long *)addr);
+	*val = READ_ONCE_NOCHECK(*(unsigned long *)addr);
 	return true;
 }
 
-- 
2.13.6

  reply	other threads:[~2017-11-08  2:19 UTC|newest]

Thread overview: 5+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2017-11-07  9:32 [bzImage64_load] BUG: KASAN: stack-out-of-bounds in deref_stack_reg+0xb5/0x11a Fengguang Wu
2017-11-07 16:32 ` Linus Torvalds
2017-11-07 17:24   ` Josh Poimboeuf
2017-11-08  2:19     ` Josh Poimboeuf [this message]
2017-11-08  9:46       ` [tip:x86/urgent] x86/unwind: Disable KASAN checking in the ORC unwinder tip-bot for Josh Poimboeuf

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20171108021934.zbl6unh5hpugybc5@treble \
    --to=jpoimboe@redhat.com \
    --cc=bauerman@linux.vnet.ibm.com \
    --cc=fengguang.wu@intel.com \
    --cc=hpa@zytor.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=mingo@redhat.com \
    --cc=tglx@linutronix.de \
    --cc=torvalds@linux-foundation.org \
    --cc=x86@kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox

all inboxes | Powered by JetHome®