Re: [git pull] core, x86: make LIST_POISON less deadly

[Linus Torvalds <torvalds@linux-foundation.org>]

On Mon, 14 Jul 2008, Andi Kleen wrote:
> 
> How about if the page fault handler checks for the value and prints
> a obvious string? It could do this reliably, unlike the "grep
> all registers for poison on #GP" method that was earlier proposed.

The GP handler, you mean.

Sure, that might work. I'm not convinced it's worth it, but it's certainly 
not difficult to do either. Something like this (TOTALLY UNTESTED!) might 
work.

It puts it in the general "__die()" routine because it was easier this way 
(we do want it below the "oops" thing, so that it gets captured by Arjan's 
scripts!), in case the deathnotes are useful for other cases too.

It could perhaps be extended to allow negative offsets off the 0xdead000.. 
pointer (right now those would be ignored because the '0xdead00..' part 
would turns into '0xdeacff..') but that would not matter for the 
particular case of the list poisoning (since that one adds the 0x0100100 
thing to it anyway).

Again: totally untested.

			Linus

---
 arch/x86/kernel/traps_64.c |   24 ++++++++++++++++++++++++
 1 files changed, 24 insertions(+), 0 deletions(-)

diff --git a/arch/x86/kernel/traps_64.c b/arch/x86/kernel/traps_64.c
index f1a95d1..7487ce2 100644
--- a/arch/x86/kernel/traps_64.c
+++ b/arch/x86/kernel/traps_64.c
@@ -434,6 +434,29 @@ void dump_stack(void)
 
 EXPORT_SYMBOL(dump_stack);
 
+/*
+ * This depends intimately on the layout of pt_regs to
+ * show deathnotes in the GP registers.
+ */
+static void show_deathnotes(struct pt_regs *regs)
+{
+	static const char *names[16] = {
+		"r15", "r14", "r13", "r12",
+		"rbp", "rbx", "r11", "r10",
+		"r9",  "r8",  "rax", "rcx",
+		"rdx", "rsi", "rdi",
+	};
+	const unsigned long *r = &regs->r15;
+	int i;
+
+	for (i = 0; i < 15; i++) {
+		unsigned long value = r[i];
+		if ((value >> 48) != 0xdead)
+			continue;
+		printk("Deathnote %lx in register %s\n", value, names[i]);
+	}
+}
+
 void show_registers(struct pt_regs *regs)
 {
 	int i;
@@ -554,6 +577,7 @@ int __kprobes __die(const char * str, struct pt_regs * regs, long err)
 	printk("\n");
 	if (notify_die(DIE_OOPS, str, regs, err, current->thread.trap_no, SIGSEGV) == NOTIFY_STOP)
 		return 1;
+	show_deathnotes(regs);
 	show_registers(regs);
 	add_taint(TAINT_DIE);
 	/* Executive summary in case the oops scrolled away */