2020-02-07 04:42:33

by Eric Dumazet

Subject: [PATCH] x86/traps: do not hash pointers in handle_stack_overflow()

Mangling stack pointers in handle_stack_overflow() is moot,
as registers (including RSP/RBP) are clear anyway.

BUG: stack guard page was hit at 0000000063381e80 (stack is 000000008edc5696..0000000012256c50)
kernel stack overflow (double-fault): 0000 [#1] PREEMPT SMP KASAN
...
RSP: 0018:ffffc90002c1ffc0 EFLAGS: 00010802
RAX: 1ffff11004a0094c RBX: ffff888025004180 RCX: c9d82d1007bb146c
RDX: dffffc0000000000 RSI: ffff888025004a40 RDI: ffff888025004180
RBP: ffffc90002c201c0 R08: dffffc0000000000 R09: fffffbfff1405915
R10: fffffbfff1405915 R11: 0000000000000000 R12: ffff888025004a60
R13: ffff888025004a10 R14: c9d82d1007bb146c R15: ffff888025004180
...

Signed-off-by: Eric Dumazet <[email protected]>
Cc: Andy Lutomirski <[email protected]>
---
arch/x86/kernel/traps.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c
index 6ef00eb6fbb925e86109f86845e2b3ccef4023ec..44873df292bd3f9f77bb721c53cb8a1c40994cca 100644
--- a/arch/x86/kernel/traps.c
+++ b/arch/x86/kernel/traps.c
@@ -296,7 +296,7 @@ __visible void __noreturn handle_stack_overflow(const char *message,
struct pt_regs *regs,
unsigned long fault_address)
{
- printk(KERN_EMERG "BUG: stack guard page was hit at %p (stack is %p..%p)\n",
+ printk(KERN_EMERG "BUG: stack guard page was hit at %px (stack is %px..%px)\n",
(void *)fault_address, current->stack,
(char *)current->stack + THREAD_SIZE - 1);
die(message, regs, 0);
--
2.25.0.341.g760bfbb309-goog

2020-02-07 14:45:57

by Thomas Gleixner

Subject: Re: [PATCH] x86/traps: do not hash pointers in handle_stack_overflow()

Eric Dumazet <[email protected]> writes:

> Mangling stack pointers in handle_stack_overflow() is moot,
> as registers (including RSP/RBP) are clear anyway.
>
> BUG: stack guard page was hit at 0000000063381e80 (stack is
> 000000008edc5696..0000000012256c50)

To illustrate your argument above it would be useful to provide the post
patch output as well.

> kernel stack overflow (double-fault): 0000 [#1] PREEMPT SMP KASAN
> ...
> RSP: 0018:ffffc90002c1ffc0 EFLAGS: 00010802
> RAX: 1ffff11004a0094c RBX: ffff888025004180 RCX: c9d82d1007bb146c
> RDX: dffffc0000000000 RSI: ffff888025004a40 RDI: ffff888025004180
> RBP: ffffc90002c201c0 R08: dffffc0000000000 R09: fffffbfff1405915
> R10: fffffbfff1405915 R11: 0000000000000000 R12: ffff888025004a60
> R13: ffff888025004a10 R14: c9d82d1007bb146c R15: ffff888025004180
> ...
>
> Signed-off-by: Eric Dumazet <[email protected]>
> Cc: Andy Lutomirski <[email protected]>
> ---
> arch/x86/kernel/traps.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c
> index 6ef00eb6fbb925e86109f86845e2b3ccef4023ec..44873df292bd3f9f77bb721c53cb8a1c40994cca 100644
> --- a/arch/x86/kernel/traps.c
> +++ b/arch/x86/kernel/traps.c
> @@ -296,7 +296,7 @@ __visible void __noreturn handle_stack_overflow(const char *message,
> struct pt_regs *regs,
> unsigned long fault_address)
> {
> - printk(KERN_EMERG "BUG: stack guard page was hit at %p (stack is %p..%p)\n",
> + printk(KERN_EMERG "BUG: stack guard page was hit at %px (stack
> is %px..%px)\n",

While touching this, can you please switch it to pr_emerg() ?

Thanks,

tglx

2020-02-07 15:19:52

by Eric Dumazet

Subject: Re: [PATCH] x86/traps: do not hash pointers in handle_stack_overflow()

On Fri, Feb 7, 2020 at 6:44 AM Thomas Gleixner <[email protected]> wrote:
>
> Eric Dumazet <[email protected]> writes:
>
> > Mangling stack pointers in handle_stack_overflow() is moot,
> > as registers (including RSP/RBP) are clear anyway.
> >
> > BUG: stack guard page was hit at 0000000063381e80 (stack is
> > 000000008edc5696..0000000012256c50)
>
> To illustrate your argument above it would be useful to provide the post
> patch output as well.

Unfortunately this KASAN report has no repro yet. I have no idea what
triggered the fault ;)

>
> > kernel stack overflow (double-fault): 0000 [#1] PREEMPT SMP KASAN
> > ...
> > RSP: 0018:ffffc90002c1ffc0 EFLAGS: 00010802
> > RAX: 1ffff11004a0094c RBX: ffff888025004180 RCX: c9d82d1007bb146c
> > RDX: dffffc0000000000 RSI: ffff888025004a40 RDI: ffff888025004180
> > RBP: ffffc90002c201c0 R08: dffffc0000000000 R09: fffffbfff1405915
> > R10: fffffbfff1405915 R11: 0000000000000000 R12: ffff888025004a60
> > R13: ffff888025004a10 R14: c9d82d1007bb146c R15: ffff888025004180
> > ...
> >
> > Signed-off-by: Eric Dumazet <[email protected]>
> > Cc: Andy Lutomirski <[email protected]>
> > ---
> > arch/x86/kernel/traps.c | 2 +-
> > 1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c
> > index 6ef00eb6fbb925e86109f86845e2b3ccef4023ec..44873df292bd3f9f77bb721c53cb8a1c40994cca 100644
> > --- a/arch/x86/kernel/traps.c
> > +++ b/arch/x86/kernel/traps.c
> > @@ -296,7 +296,7 @@ __visible void __noreturn handle_stack_overflow(const char *message,
> > struct pt_regs *regs,
> > unsigned long fault_address)
> > {
> > - printk(KERN_EMERG "BUG: stack guard page was hit at %p (stack is %p..%p)\n",
> > + printk(KERN_EMERG "BUG: stack guard page was hit at %px (stack
> > is %px..%px)\n",
>
> While touching this, can you please switch it to pr_emerg() ?
>


Sure I will, thanks.