commit f12d11c5c184626b4befdee3d573ec8237405a33 upstream.
Reset the KASAN shadow state of the task stack before rewinding RSP.
Without this, a kernel oops will leave parts of the stack poisoned, and
code running under do_exit() can trip over such poisoned regions and cause
nonsensical false-positive KASAN reports about stack-out-of-bounds bugs.
This does not wipe the exception stacks; if an oops happens on an exception
stack, it might result in random KASAN false-positives from other tasks
afterwards. This is probably relatively uninteresting, since if the kernel
oopses on an exception stack, there are most likely bigger things to worry
about. It'd be more interesting if vmapped stacks and KASAN were
compatible, since then handle_stack_overflow() would oops from exception
stack context.
Fixes: 2deb4be280
("x86/dumpstack: When OOPSing, rewind the stack before do_exit()")
Signed-off-by: Jann Horn <jannh@google.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: Andrey Ryabinin <aryabinin@virtuozzo.com>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Alexander Potapenko <glider@google.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: kasan-dev@googlegroups.com
Cc: stable@vger.kernel.org
Link: https://lkml.kernel.org/r/20180828184033.93712-1-jannh@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
332 lines
7.9 KiB
C
332 lines
7.9 KiB
C
/*
|
|
* Copyright (C) 1991, 1992 Linus Torvalds
|
|
* Copyright (C) 2000, 2001, 2002 Andi Kleen, SuSE Labs
|
|
*/
|
|
#include <linux/kallsyms.h>
|
|
#include <linux/kprobes.h>
|
|
#include <linux/uaccess.h>
|
|
#include <linux/utsname.h>
|
|
#include <linux/hardirq.h>
|
|
#include <linux/kdebug.h>
|
|
#include <linux/module.h>
|
|
#include <linux/ptrace.h>
|
|
#include <linux/ftrace.h>
|
|
#include <linux/kexec.h>
|
|
#include <linux/bug.h>
|
|
#include <linux/nmi.h>
|
|
#include <linux/sysfs.h>
|
|
#include <linux/kasan.h>
|
|
|
|
#include <asm/stacktrace.h>
|
|
#include <asm/unwind.h>
|
|
|
|
int panic_on_unrecovered_nmi;
|
|
int panic_on_io_nmi;
|
|
unsigned int code_bytes = 64;
|
|
int kstack_depth_to_print = 3 * STACKSLOTS_PER_LINE;
|
|
static int die_counter;
|
|
|
|
bool in_task_stack(unsigned long *stack, struct task_struct *task,
|
|
struct stack_info *info)
|
|
{
|
|
unsigned long *begin = task_stack_page(task);
|
|
unsigned long *end = task_stack_page(task) + THREAD_SIZE;
|
|
|
|
if (stack < begin || stack >= end)
|
|
return false;
|
|
|
|
info->type = STACK_TYPE_TASK;
|
|
info->begin = begin;
|
|
info->end = end;
|
|
info->next_sp = NULL;
|
|
|
|
return true;
|
|
}
|
|
|
|
static void printk_stack_address(unsigned long address, int reliable,
|
|
char *log_lvl)
|
|
{
|
|
touch_nmi_watchdog();
|
|
printk("%s [<%p>] %s%pB\n",
|
|
log_lvl, (void *)address, reliable ? "" : "? ",
|
|
(void *)address);
|
|
}
|
|
|
|
void printk_address(unsigned long address)
|
|
{
|
|
pr_cont(" [<%p>] %pS\n", (void *)address, (void *)address);
|
|
}
|
|
|
|
void show_trace_log_lvl(struct task_struct *task, struct pt_regs *regs,
|
|
unsigned long *stack, char *log_lvl)
|
|
{
|
|
struct unwind_state state;
|
|
struct stack_info stack_info = {0};
|
|
unsigned long visit_mask = 0;
|
|
int graph_idx = 0;
|
|
|
|
printk("%sCall Trace:\n", log_lvl);
|
|
|
|
unwind_start(&state, task, regs, stack);
|
|
|
|
/*
|
|
* Iterate through the stacks, starting with the current stack pointer.
|
|
* Each stack has a pointer to the next one.
|
|
*
|
|
* x86-64 can have several stacks:
|
|
* - task stack
|
|
* - interrupt stack
|
|
* - HW exception stacks (double fault, nmi, debug, mce)
|
|
*
|
|
* x86-32 can have up to three stacks:
|
|
* - task stack
|
|
* - softirq stack
|
|
* - hardirq stack
|
|
*/
|
|
for (; stack; stack = stack_info.next_sp) {
|
|
const char *str_begin, *str_end;
|
|
|
|
/*
|
|
* If we overflowed the task stack into a guard page, jump back
|
|
* to the bottom of the usable stack.
|
|
*/
|
|
if (task_stack_page(task) - (void *)stack < PAGE_SIZE)
|
|
stack = task_stack_page(task);
|
|
|
|
if (get_stack_info(stack, task, &stack_info, &visit_mask))
|
|
break;
|
|
|
|
stack_type_str(stack_info.type, &str_begin, &str_end);
|
|
if (str_begin)
|
|
printk("%s <%s> ", log_lvl, str_begin);
|
|
|
|
/*
|
|
* Scan the stack, printing any text addresses we find. At the
|
|
* same time, follow proper stack frames with the unwinder.
|
|
*
|
|
* Addresses found during the scan which are not reported by
|
|
* the unwinder are considered to be additional clues which are
|
|
* sometimes useful for debugging and are prefixed with '?'.
|
|
* This also serves as a failsafe option in case the unwinder
|
|
* goes off in the weeds.
|
|
*/
|
|
for (; stack < stack_info.end; stack++) {
|
|
unsigned long real_addr;
|
|
int reliable = 0;
|
|
unsigned long addr = READ_ONCE_NOCHECK(*stack);
|
|
unsigned long *ret_addr_p =
|
|
unwind_get_return_address_ptr(&state);
|
|
|
|
if (!__kernel_text_address(addr))
|
|
continue;
|
|
|
|
if (stack == ret_addr_p)
|
|
reliable = 1;
|
|
|
|
/*
|
|
* When function graph tracing is enabled for a
|
|
* function, its return address on the stack is
|
|
* replaced with the address of an ftrace handler
|
|
* (return_to_handler). In that case, before printing
|
|
* the "real" address, we want to print the handler
|
|
* address as an "unreliable" hint that function graph
|
|
* tracing was involved.
|
|
*/
|
|
real_addr = ftrace_graph_ret_addr(task, &graph_idx,
|
|
addr, stack);
|
|
if (real_addr != addr)
|
|
printk_stack_address(addr, 0, log_lvl);
|
|
printk_stack_address(real_addr, reliable, log_lvl);
|
|
|
|
if (!reliable)
|
|
continue;
|
|
|
|
/*
|
|
* Get the next frame from the unwinder. No need to
|
|
* check for an error: if anything goes wrong, the rest
|
|
* of the addresses will just be printed as unreliable.
|
|
*/
|
|
unwind_next_frame(&state);
|
|
}
|
|
|
|
if (str_end)
|
|
printk("%s <%s> ", log_lvl, str_end);
|
|
}
|
|
}
|
|
|
|
void show_stack(struct task_struct *task, unsigned long *sp)
|
|
{
|
|
task = task ? : current;
|
|
|
|
/*
|
|
* Stack frames below this one aren't interesting. Don't show them
|
|
* if we're printing for %current.
|
|
*/
|
|
if (!sp && task == current)
|
|
sp = get_stack_pointer(current, NULL);
|
|
|
|
show_stack_log_lvl(task, NULL, sp, "");
|
|
}
|
|
|
|
void show_stack_regs(struct pt_regs *regs)
|
|
{
|
|
show_stack_log_lvl(current, regs, NULL, "");
|
|
}
|
|
|
|
static arch_spinlock_t die_lock = __ARCH_SPIN_LOCK_UNLOCKED;
|
|
static int die_owner = -1;
|
|
static unsigned int die_nest_count;
|
|
|
|
unsigned long oops_begin(void)
|
|
{
|
|
int cpu;
|
|
unsigned long flags;
|
|
|
|
oops_enter();
|
|
|
|
/* racy, but better than risking deadlock. */
|
|
raw_local_irq_save(flags);
|
|
cpu = smp_processor_id();
|
|
if (!arch_spin_trylock(&die_lock)) {
|
|
if (cpu == die_owner)
|
|
/* nested oops. should stop eventually */;
|
|
else
|
|
arch_spin_lock(&die_lock);
|
|
}
|
|
die_nest_count++;
|
|
die_owner = cpu;
|
|
console_verbose();
|
|
bust_spinlocks(1);
|
|
return flags;
|
|
}
|
|
EXPORT_SYMBOL_GPL(oops_begin);
|
|
NOKPROBE_SYMBOL(oops_begin);
|
|
|
|
void __noreturn rewind_stack_do_exit(int signr);
|
|
|
|
void oops_end(unsigned long flags, struct pt_regs *regs, int signr)
|
|
{
|
|
if (regs && kexec_should_crash(current))
|
|
crash_kexec(regs);
|
|
|
|
bust_spinlocks(0);
|
|
die_owner = -1;
|
|
add_taint(TAINT_DIE, LOCKDEP_NOW_UNRELIABLE);
|
|
die_nest_count--;
|
|
if (!die_nest_count)
|
|
/* Nest count reaches zero, release the lock. */
|
|
arch_spin_unlock(&die_lock);
|
|
raw_local_irq_restore(flags);
|
|
oops_exit();
|
|
|
|
if (!signr)
|
|
return;
|
|
if (in_interrupt())
|
|
panic("Fatal exception in interrupt");
|
|
if (panic_on_oops)
|
|
panic("Fatal exception");
|
|
|
|
/*
|
|
* We're not going to return, but we might be on an IST stack or
|
|
* have very little stack space left. Rewind the stack and kill
|
|
* the task.
|
|
* Before we rewind the stack, we have to tell KASAN that we're going to
|
|
* reuse the task stack and that existing poisons are invalid.
|
|
*/
|
|
kasan_unpoison_task_stack(current);
|
|
rewind_stack_do_exit(signr);
|
|
}
|
|
NOKPROBE_SYMBOL(oops_end);
|
|
|
|
int __die(const char *str, struct pt_regs *regs, long err)
|
|
{
|
|
#ifdef CONFIG_X86_32
|
|
unsigned short ss;
|
|
unsigned long sp;
|
|
#endif
|
|
printk(KERN_DEFAULT
|
|
"%s: %04lx [#%d]%s%s%s%s\n", str, err & 0xffff, ++die_counter,
|
|
IS_ENABLED(CONFIG_PREEMPT) ? " PREEMPT" : "",
|
|
IS_ENABLED(CONFIG_SMP) ? " SMP" : "",
|
|
debug_pagealloc_enabled() ? " DEBUG_PAGEALLOC" : "",
|
|
IS_ENABLED(CONFIG_KASAN) ? " KASAN" : "");
|
|
|
|
if (notify_die(DIE_OOPS, str, regs, err,
|
|
current->thread.trap_nr, SIGSEGV) == NOTIFY_STOP)
|
|
return 1;
|
|
|
|
print_modules();
|
|
show_regs(regs);
|
|
#ifdef CONFIG_X86_32
|
|
if (user_mode(regs)) {
|
|
sp = regs->sp;
|
|
ss = regs->ss & 0xffff;
|
|
} else {
|
|
sp = kernel_stack_pointer(regs);
|
|
savesegment(ss, ss);
|
|
}
|
|
printk(KERN_EMERG "EIP: [<%08lx>] ", regs->ip);
|
|
print_symbol("%s", regs->ip);
|
|
printk(" SS:ESP %04x:%08lx\n", ss, sp);
|
|
#else
|
|
/* Executive summary in case the oops scrolled away */
|
|
printk(KERN_ALERT "RIP ");
|
|
printk_address(regs->ip);
|
|
printk(" RSP <%016lx>\n", regs->sp);
|
|
#endif
|
|
return 0;
|
|
}
|
|
NOKPROBE_SYMBOL(__die);
|
|
|
|
/*
|
|
* This is gone through when something in the kernel has done something bad
|
|
* and is about to be terminated:
|
|
*/
|
|
void die(const char *str, struct pt_regs *regs, long err)
|
|
{
|
|
unsigned long flags = oops_begin();
|
|
int sig = SIGSEGV;
|
|
|
|
if (!user_mode(regs))
|
|
report_bug(regs->ip, regs);
|
|
|
|
if (__die(str, regs, err))
|
|
sig = 0;
|
|
oops_end(flags, regs, sig);
|
|
}
|
|
|
|
static int __init kstack_setup(char *s)
|
|
{
|
|
ssize_t ret;
|
|
unsigned long val;
|
|
|
|
if (!s)
|
|
return -EINVAL;
|
|
|
|
ret = kstrtoul(s, 0, &val);
|
|
if (ret)
|
|
return ret;
|
|
kstack_depth_to_print = val;
|
|
return 0;
|
|
}
|
|
early_param("kstack", kstack_setup);
|
|
|
|
static int __init code_bytes_setup(char *s)
|
|
{
|
|
ssize_t ret;
|
|
unsigned long val;
|
|
|
|
if (!s)
|
|
return -EINVAL;
|
|
|
|
ret = kstrtoul(s, 0, &val);
|
|
if (ret)
|
|
return ret;
|
|
|
|
code_bytes = val;
|
|
if (code_bytes > 8192)
|
|
code_bytes = 8192;
|
|
|
|
return 1;
|
|
}
|
|
__setup("code_bytes=", code_bytes_setup);
|