From patchwork Wed Apr 13 19:26:45 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: andrey.konovalov@linux.dev X-Patchwork-Id: 12812528 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 97625C433F5 for ; Wed, 13 Apr 2022 19:28:21 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 376226B0074; Wed, 13 Apr 2022 15:28:19 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 2FBEE6B0078; Wed, 13 Apr 2022 15:28:19 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 151116B007B; Wed, 13 Apr 2022 15:28:19 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0091.hostedemail.com [216.40.44.91]) by kanga.kvack.org (Postfix) with ESMTP id EEFA16B0074 for ; Wed, 13 Apr 2022 15:28:18 -0400 (EDT) Received: from smtpin26.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay01.hostedemail.com (Postfix) with ESMTP id AC148183F79A9 for ; Wed, 13 Apr 2022 19:28:18 +0000 (UTC) X-FDA: 79352841876.26.02F973C Received: from out2.migadu.com (out2.migadu.com [188.165.223.204]) by imf30.hostedemail.com (Postfix) with ESMTP id F420880003 for ; Wed, 13 Apr 2022 19:28:17 +0000 (UTC) X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1649878096; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=1W/iPGxZZe0dTxtRIT/L4inWkaCNOxDFyHeQ0vhNfa0=; b=gnwkJMKPPygIVkZ/9Wh1mh3OT1cMRRjuS5qS8IK6a6j48F8Mu3vVEr6wfetKEVn+G0kwVH VpnSFOGe6lHZ16nJIfVYj83+P9+IFGSaJ9oP5g4LZ79gI0ZQ4hAcFfPGXw47pP2GkGazjs X7uQvydkAJIrVzsEfjwJGtTH9md0qaI= From: andrey.konovalov@linux.dev To: Marco Elver , Alexander Potapenko , Mark Rutland Cc: Andrey Konovalov , Dmitry Vyukov , Andrey Ryabinin , kasan-dev@googlegroups.com, Catalin Marinas , Will Deacon , Vincenzo Frascino , Sami Tolvanen , linux-arm-kernel@lists.infradead.org, Peter Collingbourne , Evgenii Stepanov , Florian Mayer , Andrew Morton , linux-mm@kvack.org, linux-kernel@vger.kernel.org, Andrey Konovalov Subject: [PATCH v3 2/3] kasan, arm64: implement stack_trace_save_shadow Date: Wed, 13 Apr 2022 21:26:45 +0200 Message-Id: <78cd352296ceb14da1d0136ff7d0a6818e594ab7.1649877511.git.andreyknvl@google.com> In-Reply-To: References: MIME-Version: 1.0 X-Migadu-Flow: FLOW_OUT X-Migadu-Auth-User: linux.dev Authentication-Results: imf30.hostedemail.com; dkim=pass header.d=linux.dev header.s=key1 header.b=gnwkJMKP; spf=pass (imf30.hostedemail.com: domain of andrey.konovalov@linux.dev designates 188.165.223.204 as permitted sender) smtp.mailfrom=andrey.konovalov@linux.dev; dmarc=pass (policy=none) header.from=linux.dev X-Rspam-User: X-Rspamd-Server: rspam10 X-Rspamd-Queue-Id: F420880003 X-Stat-Signature: uyd6azfjmerdcpmo8go8y6z3uujx9s8i X-HE-Tag: 1649878097-728953 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: From: Andrey Konovalov Implement stack_trace_save_shadow() that collects stack traces based on the Shadow Call Stack (SCS) for arm64 by copiing the frames from SCS. The implementation is best-effort and thus has limitations. stack_trace_save_shadow() fully handles task and softirq contexts, which are both processed on the per-task SCS. For hardirqs, the support is limited: stack_trace_save_shadow() does not collect the task part of the stack trace. For KASAN, this is not a problem, as stack depot only saves the interrupt part of the stack anyway. Otherwise, stack_trace_save_shadow() also takes a best-effort approach with a focus on performance. Thus, it: - Does not try to collect stack traces from other exceptions like SDEI. - Does not try to recover frames modified by KRETPROBES or by FTRACE. However, stack_trace_save_shadow() does strip PTR_AUTH tags to avoid leaking them in stack traces. The -ENOSYS return value is deliberatly used to match stack_trace_save_tsk_reliable(). Signed-off-by: Andrey Konovalov --- mm/kasan/common.c | 62 +++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 62 insertions(+) diff --git a/mm/kasan/common.c b/mm/kasan/common.c index d9079ec11f31..23b30fa6e270 100644 --- a/mm/kasan/common.c +++ b/mm/kasan/common.c @@ -30,6 +30,68 @@ #include "kasan.h" #include "../slab.h" +#ifdef CONFIG_SHADOW_CALL_STACK +#include +#include + +/* + * Collect the stack trace from the Shadow Call Stack in a best-effort manner: + * + * - Do not collect the task part of the stack trace when in a hardirq. + * - Do not collect stack traces from other exception levels like SDEI. + * - Do not recover frames modified by KRETPROBES or by FTRACE. + * + * Note that marking the function with __noscs leads to unnacceptable + * performance impact, as helper functions stop being inlined. + */ +static inline int stack_trace_save_shadow(unsigned long *store, + unsigned int size) +{ + unsigned long *scs_top, *scs_base, *frame; + unsigned int len = 0; + + /* Get the SCS base. */ + if (in_task() || in_serving_softirq()) { + /* Softirqs reuse the task SCS area. */ + scs_base = task_scs(current); + } else if (in_hardirq()) { + /* Hardirqs use a per-CPU SCS area. */ + scs_base = *this_cpu_ptr(&irq_shadow_call_stack_ptr); + } else { + /* Ignore other exception levels. */ + return 0; + } + + /* + * Get the SCS pointer. + * + * Note that this assembly might be placed before the function's + * prologue. In this case, the last stack frame will be lost. This is + * acceptable: the lost frame will correspond to an internal KASAN + * function, which is not relevant to identify the external call site. + */ + asm volatile("mov %0, x18" : "=&r" (scs_top)); + + /* The top SCS slot is empty. */ + scs_top -= 1; + + for (frame = scs_top; frame >= scs_base; frame--) { + if (len >= size) + break; + /* Do not leak PTR_AUTH tags in stack traces. */ + store[len++] = ptrauth_strip_insn_pac(*frame); + } + + return len; +} +#else /* CONFIG_SHADOW_CALL_STACK */ +static inline int stack_trace_save_shadow(unsigned long *store, + unsigned int size) +{ + return -ENOSYS; +} +#endif /* CONFIG_SHADOW_CALL_STACK */ + depot_stack_handle_t kasan_save_stack(gfp_t flags, bool can_alloc) { unsigned long entries[KASAN_STACK_DEPTH];