lkml.org 
[lkml]   [2019]   [Mar]   [1]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    From
    Date
    SubjectRe: [PATCH 1/2] x86/unwind: handle NULL pointer calls better in frame unwinder
    On Fri, Mar 1, 2019 at 4:33 PM Sean Christopherson
    <sean.j.christopherson@intel.com> wrote:
    > On Fri, Mar 01, 2019 at 04:12:00AM +0100, Jann Horn wrote:
    > > When the frame unwinder is invoked for an oops caused by a call to NULL,
    > > it currently skips the parent function because BP still points to the
    > > parent's stack frame; the (nonexistent) current function only has the first
    > > half of a stack frame, and BP doesn't point to it yet.
    > >
    > > Add a special case for IP==0 that calculates a fake BP from SP, then uses
    > > the real BP for the next frame.
    > >
    > > Note that this handles first_frame specially: We return information about
    > > the parent function as long as the saved IP is >=first_frame, even if the
    > > fake BP points below it.
    > >
    > > With an artificially-added NULL call in prctl_set_seccomp(), before this
    > > patch, the trace is:
    > >
    > > Call Trace:
    > > ? prctl_set_seccomp+0x3a/0x50
    > > __x64_sys_prctl+0x457/0x6f0
    > > ? __ia32_sys_prctl+0x750/0x750
    > > do_syscall_64+0x72/0x160
    > > entry_SYSCALL_64_after_hwframe+0x44/0xa9
    > >
    > > After this patch, the trace is:
    > >
    > > Call Trace:
    > > prctl_set_seccomp+0x3a/0x50
    > > __x64_sys_prctl+0x457/0x6f0
    > > ? __ia32_sys_prctl+0x750/0x750
    > > do_syscall_64+0x72/0x160
    > > entry_SYSCALL_64_after_hwframe+0x44/0xa9
    > >
    > > Signed-off-by: Jann Horn <jannh@google.com>
    > > ---
    > > arch/x86/include/asm/unwind.h | 6 ++++++
    > > arch/x86/kernel/unwind_frame.c | 25 ++++++++++++++++++++++---
    > > 2 files changed, 28 insertions(+), 3 deletions(-)
    > >
    > > diff --git a/arch/x86/include/asm/unwind.h b/arch/x86/include/asm/unwind.h
    > > index 1f86e1b0a5cd..499578f7e6d7 100644
    > > --- a/arch/x86/include/asm/unwind.h
    > > +++ b/arch/x86/include/asm/unwind.h
    > > @@ -23,6 +23,12 @@ struct unwind_state {
    > > #elif defined(CONFIG_UNWINDER_FRAME_POINTER)
    > > bool got_irq;
    > > unsigned long *bp, *orig_sp, ip;
    > > + /*
    > > + * If non-NULL: The current frame is incomplete and doesn't contain a
    > > + * valid BP. When looking for the next frame, use this instead of the
    > > + * non-existent saved BP.
    > > + */
    > > + unsigned long *next_bp;
    > > struct pt_regs *regs;
    > > #else
    > > unsigned long *sp;
    > > diff --git a/arch/x86/kernel/unwind_frame.c b/arch/x86/kernel/unwind_frame.c
    > > index 3dc26f95d46e..9b9fd4826e7a 100644
    > > --- a/arch/x86/kernel/unwind_frame.c
    > > +++ b/arch/x86/kernel/unwind_frame.c
    > > @@ -320,10 +320,14 @@ bool unwind_next_frame(struct unwind_state *state)
    > > }
    > >
    > > /* Get the next frame pointer: */
    > > - if (state->regs)
    > > + if (state->next_bp) {
    > > + next_bp = state->next_bp;
    > > + state->next_bp = NULL;
    > > + } else if (state->regs) {
    > > next_bp = (unsigned long *)state->regs->bp;
    > > - else
    > > + } else {
    > > next_bp = (unsigned long *)READ_ONCE_TASK_STACK(state->task, *state->bp);
    > > + }
    > >
    > > /* Move to the next frame if it's safe: */
    > > if (!update_stack_state(state, next_bp))
    > > @@ -398,6 +402,21 @@ void __unwind_start(struct unwind_state *state, struct task_struct *task,
    > >
    > > bp = get_frame_pointer(task, regs);
    > >
    > > + /*
    > > + * If we crash with IP==0, the last successfully executed instruction
    > > + * was probably an indirect function call with a NULL function pointer.
    > > + * That means that SP points into the middle of an incomplete frame:
    > > + * *SP is a return pointer, and *(SP-sizeof(unsigned long)) is where we
    > > + * would have written a frame pointer if we hadn't crashed.
    > > + * Pretend that the frame is complete and that BP points to it, but save
    > > + * the real BP so that we can use it when looking for the next frame.
    > > + */
    > > + if (regs && regs->ip == 0 &&
    >
    > Would it make sense to do 'regs->ip < PAGE_SIZE', a la show_fault_oops()?
    > E.g. to handle bugs where a function pointer gets loaded with NULL+offset.

    I don't think near-NULL function pointers make sense or are likely to
    occur in practice. Near-NULL pointer dereferences happen when you add
    a struct member offset to a NULL pointer, or something like that; but
    functions are never inline in structs/arrays, so there isn't really a
    reason to compute a function pointer by adding an offset to a (NULL)
    pointer.

    \
     
     \ /
      Last update: 2019-03-01 17:00    [W:5.075 / U:0.004 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site