DMARC-Filter: OpenDMARC Filter v1.3.2 mx1.redhat.com 0CFE94B701
Date: Thu, 29 Jun 2017 12:53:33 -0500
From: Josh Poimboeuf <jpoimboe@redhat.com>
To: x86@kernel.org
Cc: linux-kernel@vger.kernel.org, live-patching@vger.kernel.org,
        Linus Torvalds <torvalds@linux-foundation.org>,
        Andy Lutomirski <luto@kernel.org>, Jiri Slaby <jslaby@suse.cz>,
        Ingo Molnar <mingo@kernel.org>, "H. Peter Anvin" <hpa@zytor.com>,
        Peter Zijlstra <peterz@infradead.org>, Mike Galbraith <efault@gmx.de>
Subject: Re: [PATCH v2 6/8] x86/entry: add unwind hint annotations
Message-ID: <20170629175333.bicpvbwo4d5pdbak@treble>
References: <cover.1498659915.git.jpoimboe@redhat.com>
 <f068d37f70b7f5d7cc2e3b2bdccec2a1932802ad.1498659915.git.jpoimboe@redhat.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
In-Reply-To: <f068d37f70b7f5d7cc2e3b2bdccec2a1932802ad.1498659915.git.jpoimboe@redhat.com>
User-Agent: Mutt/1.6.0.1 (2016-04-01)
Sender: linux-kernel-owner@vger.kernel.org
Content-Length: 1179
Lines: 31

There's a bug here that will need a small change to the entry code.

Mike Galbraith reported:

  WARNING: can't dereference registers at ffffc900089d7e08 for ip ffffffff81740bbb

After some looking I found that it's caused by the following code
snippet in the 'interrupt' macro in entry_64.S:

	/*
	 * Save previous stack pointer, optionally switch to interrupt stack.
	 * irq_count is used to check if a CPU is already on an interrupt stack
	 * or not. While this is essentially redundant with preempt_count it is
	 * a little cheaper to use a separate counter in the PDA (short of
	 * moving irq_enter into assembly, which would be too much work)
	 */
	movq	%rsp, %rdi
	incl	PER_CPU_VAR(irq_count)
	cmovzq	PER_CPU_VAR(irq_stack_ptr), %rsp
	UNWIND_HINT_REGS base=rdi
	pushq	%rdi
	UNWIND_HINT_REGS indirect=1

The problem is that it's changing the stack pointer *before* writing the
previous stack pointer (push %rdi).  So when unwinding from an NMI which
hit between the rsp write and the rdi push, the unwinder tries to access
the regs on the previous stack (by reading rdi), but the previous stack
pointer isn't there yet, so the access is considered out of bounds.

-- 
Josh