Received: by 2002:ad5:474a:0:0:0:0:0 with SMTP id i10csp430944imu; Thu, 8 Nov 2018 23:27:19 -0800 (PST) X-Google-Smtp-Source: AJdET5fJ5WFLinM1v7MDNT1i51BUrW/mZOiuc8/qDZKys+W/TW5sgF8gpGix34EH9GItt9HVK+Z1 X-Received: by 2002:a65:530c:: with SMTP id m12mr6418125pgq.224.1541748439117; Thu, 08 Nov 2018 23:27:19 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1541748439; cv=none; d=google.com; s=arc-20160816; b=tCkJrRPTB+x3tdFqcX/La481cHsySfn2Ip3TOV3o0G8K7Y/Bl4HH8wqpU1AhqDO8Zl sqKG4E2Znkl7H3TuD0vfKpLV7VE+y2FmjHXLnZq2WxiJrWQq5GPdnas3d1tVujGeAd6r P9ouQSY5S9zM4s3mxXugmMltWH9q5Gxi4z5XL7pm2oPHgG0z/AfF8HRvqJYiGhGZCYZn U3ZF3mdI3FZMLC8sZCcRJWvoCi10jSTa8Z+dyDeplfTl4j3ykG40T41ZpGcSStOYhiZL +Re2TrnkRG30ttEeBg4zCleGtwjcV4ELUQCBStYKFFat5sIkl1UiyObfUYf8fA1j/VMF MNeA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :references:in-reply-to:message-id:subject:cc:to:from:date :dkim-signature; bh=8W04iWdp/2GsmcH1qzp63e9c/GlL2lmBQnIUdtbKRC4=; b=AX0dOTZ5IgOdpPXUxvqIYISKKa1E+qOZ+N+NImP5UrNgaaz0IOHSaZ9XXDwqpxk7cU tBHo05/wCYUYeysZdOYdZHkQ9zWKMWZXdpIo/R+09yYcpxtnmKNWngEiprRY1gjJz620 DKTr3dK9qvp4tAwD/D4J5c4RYaIWFvBjs8AifffsPhDS8NvvQw/3YMxYwIsqPOXs+E9O wkXEZB1CoIipk89mCjLO3WpzndU3ORJE9AawSvAZUpkyLu7vWCdGN7Udkigw34uTb34m s5nrvSJ5d806DqC4H04eVXw3aTIJBB+lU0bR/GwwEWrqkKnb5u9pOoNyrdL83TOFRo/W YPMA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=zgdzlJMB; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id 30-v6si7273848pla.56.2018.11.08.23.27.02; Thu, 08 Nov 2018 23:27:19 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=zgdzlJMB; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728127AbeKIRF6 (ORCPT + 99 others); Fri, 9 Nov 2018 12:05:58 -0500 Received: from mail.kernel.org ([198.145.29.99]:41140 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727869AbeKIRF6 (ORCPT ); Fri, 9 Nov 2018 12:05:58 -0500 Received: from devnote (p19194-mobac01.tokyo.ocn.ne.jp [153.233.10.194]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 42FD620855; Fri, 9 Nov 2018 07:26:35 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1541748399; bh=M6T4E9xx/y9bpDP/2rpIU3wM9auGO38j8453Y/n0AA8=; h=Date:From:To:Cc:Subject:In-Reply-To:References:From; b=zgdzlJMB6EuPrfKyIoKfdMq58CeRYB7WQRZKRwmv0oaOFcCpJd0KwUC3CsUeHlgXT cnxQIzbnuFefgvIH0Bve/gfvSwkXmQ6Js7sqTbATBs5AeyEQ+4ShU4TuFVBLTsZJfK nvL4PVBarcoRc83jX2y2TkRcwMKuWTCU2RVF4fpQ= Date: Fri, 9 Nov 2018 16:26:32 +0900 From: Masami Hiramatsu To: Josh Poimboeuf Cc: Aleksa Sarai , Steven Rostedt , "Naveen N. Rao" , Anil S Keshavamurthy , "David S. Miller" , Masami Hiramatsu , Jonathan Corbet , Peter Zijlstra , Ingo Molnar , Arnaldo Carvalho de Melo , Alexander Shishkin , Jiri Olsa , Namhyung Kim , Shuah Khan , Alexei Starovoitov , Daniel Borkmann , Brendan Gregg , Christian Brauner , Aleksa Sarai , netdev@vger.kernel.org, linux-doc@vger.kernel.org, linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org Subject: Re: [PATCH v3 1/2] kretprobe: produce sane stack traces Message-Id: <20181109162632.9a3694eea8ac8056302a8262@kernel.org> In-Reply-To: <20181108144437.l3proaovfqm5osnr@treble> References: <20181101083551.3805-2-cyphar@cyphar.com> <20181101204720.6ed3fe37@vmware.local.home> <20181102050509.tw3dhvj5urudvtjl@yavin> <20181102065932.bdt4pubbrkvql4mp@yavin> <20181102091658.1bc979a4@gandalf.local.home> <20181103070253.ajrqzs5xu2vf5stu@yavin> <20181104115913.74l4yzecisvtt2j5@yavin> <20181106171501.59ccabbc@gandalf.local.home> <20181108074612.ldy6rozdpsdps6bf@yavin> <20181108080448.rggfn4zawi3por23@yavin> <20181108144437.l3proaovfqm5osnr@treble> X-Mailer: Sylpheed 3.5.0 (GTK+ 2.24.30; x86_64-pc-linux-gnu) Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Thu, 8 Nov 2018 08:44:37 -0600 Josh Poimboeuf wrote: > On Thu, Nov 08, 2018 at 07:04:48PM +1100, Aleksa Sarai wrote: > > On 2018-11-08, Aleksa Sarai wrote: > > > I will attach what I have at the moment to hopefully explain what the > > > issue I've found is (re-using the kretprobe architecture but with the > > > shadow-stack idea). > > > > Here is the patch I have at the moment (it works, except for the > > question I have about how to handle the top-level pt_regs -- I've marked > > that code with XXX). > > > > -- > > Aleksa Sarai > > Senior Software Engineer (Containers) > > SUSE Linux GmbH > > > > > > --8<--------------------------------------------------------------------- > > > > Since the return address is modified by kretprobe, the various unwinders > > can produce invalid and confusing stack traces. ftrace mostly solved > > this problem by teaching each unwinder how to find the original return > > address for stack trace purposes. This same technique can be applied to > > kretprobes by simply adding a pointer to where the return address was > > replaced in the stack, and then looking up the relevant > > kretprobe_instance when a stack trace is requested. > > > > [WIP: This is currently broken because the *first entry* will not be > > overwritten since it looks like the stack pointer is different > > when we are provided pt_regs. All other addresses are correctly > > handled.] > > When you see this problem, what does regs->ip point to? If it's > pointing to generated code, then we don't _currently_ have a way of > dealing with that. If it's pointing to a real function, we can fix that > with unwind hints. As I replied, If the stackdump is called from kretprobe event, regs->ip always points trampoline function. Otherwise (maybe from kprobe event, or panic, BUG etc.) it always be the address which the event occurs. So fixing regs->ip is correct. Thank you, -- Masami Hiramatsu