From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754114AbcESJOH (ORCPT ); Thu, 19 May 2016 05:14:07 -0400 Received: from terminus.zytor.com ([198.137.202.10]:57742 "EHLO terminus.zytor.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753433AbcESJOB (ORCPT ); Thu, 19 May 2016 05:14:01 -0400 Date: Thu, 19 May 2016 02:12:42 -0700 From: tip-bot for Josh Poimboeuf Message-ID: Cc: hpa@zytor.com, mingo@kernel.org, dvlasenk@redhat.com, brgerst@gmail.com, torvalds@linux-foundation.org, a.p.zijlstra@chello.nl, jpoimboe@redhat.com, matt@codeblueprint.co.uk, bp@alien8.de, akpm@linux-foundation.org, peterz@infradead.org, tglx@linutronix.de, luto@kernel.org, rostedt@goodmis.org, athorlton@sgi.com, linux-kernel@vger.kernel.org Reply-To: a.p.zijlstra@chello.nl, torvalds@linux-foundation.org, brgerst@gmail.com, matt@codeblueprint.co.uk, jpoimboe@redhat.com, mingo@kernel.org, hpa@zytor.com, dvlasenk@redhat.com, tglx@linutronix.de, athorlton@sgi.com, linux-kernel@vger.kernel.org, luto@kernel.org, rostedt@goodmis.org, bp@alien8.de, peterz@infradead.org, akpm@linux-foundation.org In-Reply-To: <20160517180606.v5o7wcgdni7443ol@treble> References: <20160517180606.v5o7wcgdni7443ol@treble> To: linux-tip-commits@vger.kernel.org Subject: [tip:x86/urgent] x86/entry/64: Fix stack return address retrieval in thunk Git-Commit-ID: d4bf7078c43e11097e0d6f04d3fb999bf92c4fb0 X-Mailer: tip-git-log-daemon Robot-ID: Robot-Unsubscribe: Contact to get blacklisted from these emails MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Content-Type: text/plain; charset=UTF-8 Content-Disposition: inline Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Commit-ID: d4bf7078c43e11097e0d6f04d3fb999bf92c4fb0 Gitweb: http://git.kernel.org/tip/d4bf7078c43e11097e0d6f04d3fb999bf92c4fb0 Author: Josh Poimboeuf AuthorDate: Tue, 17 May 2016 13:06:06 -0500 Committer: Ingo Molnar CommitDate: Thu, 19 May 2016 09:12:34 +0200 x86/entry/64: Fix stack return address retrieval in thunk With CONFIG_FRAME_POINTER enabled, a thunk can pass a bad return address value to the called function. '9*8(%rsp)' actually gets the frame pointer, not the return address. The only users of the 'put_ret_addr_in_rdi' option are two functions which trace the enabling and disabling of interrupts, so this bug can result in bad debug or tracing information with CONFIG_IRQSOFF_TRACER or CONFIG_PROVE_LOCKING. Fix this by implementing the suggestion of Linus: explicitly push the frame pointer all the time and constify the stack offsets that way. This is both correct and easier to read. Reported-by: Matt Fleming Signed-off-by: Josh Poimboeuf [ Extended the changelog a bit. ] Acked-by: Linus Torvalds Cc: Alex Thorlton Cc: Andrew Morton Cc: Andy Lutomirski Cc: Borislav Petkov Cc: Brian Gerst Cc: Denys Vlasenko Cc: H. Peter Anvin Cc: Peter Zijlstra Cc: Peter Zijlstra Cc: Steven Rostedt Cc: Thomas Gleixner Fixes: 058fb73274f9 ("x86/asm/entry: Create stack frames in thunk functions") Link: http://lkml.kernel.org/r/20160517180606.v5o7wcgdni7443ol@treble Signed-off-by: Ingo Molnar --- arch/x86/entry/thunk_64.S | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/arch/x86/entry/thunk_64.S b/arch/x86/entry/thunk_64.S index 98df1fa..027aec4 100644 --- a/arch/x86/entry/thunk_64.S +++ b/arch/x86/entry/thunk_64.S @@ -8,16 +8,15 @@ #include #include "calling.h" #include -#include /* rdi: arg1 ... normal C conventions. rax is saved/restored. */ .macro THUNK name, func, put_ret_addr_in_rdi=0 .globl \name .type \name, @function \name: - FRAME_BEGIN + pushq %rbp + movq %rsp, %rbp - /* this one pushes 9 elems, the next one would be %rIP */ pushq %rdi pushq %rsi pushq %rdx @@ -29,8 +28,8 @@ pushq %r11 .if \put_ret_addr_in_rdi - /* 9*8(%rsp) is return addr on stack */ - movq 9*8(%rsp), %rdi + /* 8(%rbp) is return addr on stack */ + movq 8(%rbp), %rdi .endif call \func @@ -65,7 +64,7 @@ restore: popq %rdx popq %rsi popq %rdi - FRAME_END + popq %rbp ret _ASM_NOKPROBE(restore) #endif