From patchwork Fri Apr 20 05:38:33 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ji Zhang X-Patchwork-Id: 10351829 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 6B2716023A for ; Fri, 20 Apr 2018 05:46:16 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 5B27F28609 for ; Fri, 20 Apr 2018 05:46:16 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 4ECEB28615; Fri, 20 Apr 2018 05:46:16 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-2.9 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID, MAILING_LIST_MULTI, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id AFAAE28609 for ; Fri, 20 Apr 2018 05:46:15 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20170209; h=Sender: Content-Transfer-Encoding:Content-Type:Cc:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:MIME-Version:Message-ID:Date:Subject:To :From:Reply-To:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References: List-Owner; bh=IVzjfop4tVwkixjpzVRKMveGaGYn3svknDZ9u6w4An0=; b=ppYEdeECP+lct8 LuTo5McVjbIpqZWJrxDwYteWGdrVFeCFTg1Ie5ELd9jPe8tLa/sqdB+muQwEt8A99by47pc/IoG6g hLgv1jSrj1MkPvQB9rloG0eOFsdYAKCGYOkZeMzyZiLAlHnfZ5QT+ZjXKYSvnyFlbYn97M2iTomCv JWOQ1MWjH1hWmjhJfsLatU33YhTjbXkZttdtCi3zs2v2qb91r7wAOCADs32y5AGELI+M9QpEC+uUL yFF23ZQumDxu+jsdNatCOq59NvSneW5x7Vo/6fC4qUHhnbSN/vR1EZXxl8h5qXYObuRCfKpT4QEgb WRl68q/8TFOHSZLEuK4w==; Received: from localhost ([127.0.0.1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.90_1 #2 (Red Hat Linux)) id 1f9Os2-00088f-KH; Fri, 20 Apr 2018 05:46:06 +0000 Received: from [210.61.82.183] (helo=mailgw01.mediatek.com) by bombadil.infradead.org with esmtps (Exim 4.90_1 #2 (Red Hat Linux)) id 1f9Oq3-0005z2-As; Fri, 20 Apr 2018 05:44:07 +0000 X-UUID: 8ae74d36432842bdac8950cae95fbb32-20180420 Received: from mtkexhb01.mediatek.inc [(172.21.101.102)] by mailgw01.mediatek.com (envelope-from ) (mhqrelay.mediatek.com ESMTP with TLS) with ESMTP id 1067863738; Fri, 20 Apr 2018 13:38:37 +0800 Received: from mtkcas09.mediatek.inc (172.21.101.178) by mtkmbs03n1.mediatek.inc (172.21.101.181) with Microsoft SMTP Server (TLS) id 15.0.1210.3; Fri, 20 Apr 2018 13:38:35 +0800 Received: from mtksdccf07.mediatek.inc (172.21.84.99) by mtkcas09.mediatek.inc (172.21.101.73) with Microsoft SMTP Server id 15.0.1210.3 via Frontend Transport; Fri, 20 Apr 2018 13:38:35 +0800 From: Ji Zhang To: Catalin Marinas , Will Deacon , Matthias Brugger , Mark Rutland , Ard Biesheuvel , Pratyush Anand , Kefeng Wang , James Morse , Andrew Morton , Dustin Brown , Prakash Gupta , Dave Martin , Michael Weiser , Julien Thierry , Marc Zyngier Subject: [PATCH] arm64: avoid potential infinity loop in dump_backtrace Date: Fri, 20 Apr 2018 13:38:33 +0800 Message-ID: <1524202713-31024-1-git-send-email-ji.zhang@mediatek.com> X-Mailer: git-send-email 1.9.1 MIME-Version: 1.0 X-MTK: N X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20180419_224403_562669_427CF272 X-CRM114-Status: GOOD ( 12.71 ) X-BeenThere: linux-mediatek@lists.infradead.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: wsd_upstream@mediatek.com, linux-kernel@vger.kernel.org, linux-mediatek@lists.infradead.org, Ji Zhang , shadanji@163.com, linux-arm-kernel@lists.infradead.org Sender: "Linux-mediatek" Errors-To: linux-mediatek-bounces+patchwork-linux-mediatek=patchwork.kernel.org@lists.infradead.org X-Virus-Scanned: ClamAV using ClamSMTP When we dump the backtrace of some tasks there is a potential infinity loop if the content of the stack changed, no matter the change is because the task is running or other unexpected cases. This patch add stronger check on frame pointer and set the max number of stack spanning to avoid infinity loop. Signed-off-by: Ji Zhang --- arch/arm64/include/asm/stacktrace.h | 25 +++++++++++++++++++++++++ arch/arm64/kernel/stacktrace.c | 8 ++++++++ arch/arm64/kernel/traps.c | 1 + 3 files changed, 34 insertions(+) diff --git a/arch/arm64/include/asm/stacktrace.h b/arch/arm64/include/asm/stacktrace.h index 902f9ed..f235b86 100644 --- a/arch/arm64/include/asm/stacktrace.h +++ b/arch/arm64/include/asm/stacktrace.h @@ -24,9 +24,18 @@ #include #include +#ifndef CONFIG_VMAP_STACK +#define MAX_NR_STACKS 2 +#elif !defined(CONFIG_ARM_SDE_INTERFACE) +#define MAX_NR_STACKS 3 +#else +#define MAX_NR_STACKS 4 +#endif + struct stackframe { unsigned long fp; unsigned long pc; + int nr_stacks; #ifdef CONFIG_FUNCTION_GRAPH_TRACER int graph; #endif @@ -92,4 +101,20 @@ static inline bool on_accessible_stack(struct task_struct *tsk, unsigned long sp return false; } + +static inline bool on_same_stack(struct task_struct *tsk, + unsigned long sp1, unsigned long sp2) +{ + if (on_task_stack(tsk, sp1) && on_task_stack(tsk, sp2)) + return true; + if (on_irq_stack(sp1) && on_irq_stack(sp2)) + return true; + if (on_overflow_stack(sp1) && on_overflow_stack(sp2)) + return true; + if (on_sdei_stack(sp1) && on_sdei_stack(sp2)) + return true; + + return false; +} + #endif /* __ASM_STACKTRACE_H */ diff --git a/arch/arm64/kernel/stacktrace.c b/arch/arm64/kernel/stacktrace.c index d5718a0..d75f59d 100644 --- a/arch/arm64/kernel/stacktrace.c +++ b/arch/arm64/kernel/stacktrace.c @@ -43,6 +43,7 @@ int notrace unwind_frame(struct task_struct *tsk, struct stackframe *frame) { unsigned long fp = frame->fp; + bool same_stack; if (fp & 0xf) return -EINVAL; @@ -56,6 +57,13 @@ int notrace unwind_frame(struct task_struct *tsk, struct stackframe *frame) frame->fp = READ_ONCE_NOCHECK(*(unsigned long *)(fp)); frame->pc = READ_ONCE_NOCHECK(*(unsigned long *)(fp + 8)); + same_stack = on_same_stack(tsk, fp, frame->fp); + + if (fp <= frame->fp && same_stack) + return -EINVAL; + if (!same_stack && ++frame->nr_stacks > MAX_NR_STACKS) + return -EINVAL; + #ifdef CONFIG_FUNCTION_GRAPH_TRACER if (tsk->ret_stack && (frame->pc == (unsigned long)return_to_handler)) { diff --git a/arch/arm64/kernel/traps.c b/arch/arm64/kernel/traps.c index ba964da..ee0403d 100644 --- a/arch/arm64/kernel/traps.c +++ b/arch/arm64/kernel/traps.c @@ -121,6 +121,7 @@ void dump_backtrace(struct pt_regs *regs, struct task_struct *tsk) frame.fp = thread_saved_fp(tsk); frame.pc = thread_saved_pc(tsk); } + frame.nr_stacks = 1; #ifdef CONFIG_FUNCTION_GRAPH_TRACER frame.graph = tsk->curr_ret_stack; #endif