Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
From:   Lvqiang <Lvqiang.Huang@unisoc.com>
To:     <linux@armlinux.org.uk>, <ebiederm@xmission.com>,
        <dave.hansen@linux.intel.com>, <anshuman.khandual@arm.com>,
        <akpm@linux-foundation.org>, <Lvqiang.Huang@unisoc.com>,
        <f.fainelli@gmail.com>, <will@kernel.org>, <tglx@linutronix.de>,
        <linux-arm-kernel@lists.infradead.org>,
        <linux-kernel@vger.kernel.org>
Subject: [PATCH] ARM: check __ex_table in do_bad()
Date:   Thu, 7 Nov 2019 15:45:13 +0800
Message-ID: <1573112713-10115-1-git-send-email-Lvqiang.Huang@unisoc.com>
MIME-Version: 1.0
Content-Type: text/plain
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk


We got many crashs in for_each_frame+0x18 arch/arm/lib/backtrace.S
    1003: ldr r2, [sv_pc, #-4]

The backtrace is
    dump_backtrace
    show_stack
    sched_show_task
    show_state_filter
    sysrq_handle_showstate_blocked
    __handle_sysrq
    write_sysrq_trigger
    proc_reg_write
    __vfs_write
    vfs_write
    sys_write

Related Kernel config
    CONFIG_CPU_SW_DOMAIN_PAN=y
    # CONFIG_ARM_UNWIND is not set
    CONFIG_FRAME_POINTER=y

The task A was dumping the stack of an UN task B. However, the task B
scheduled to run on another CPU, which cause it stack content changed.
Then, task A may hit a page domain fault and die().
    [520.661314] Unhandled fault: page domain fault (0x01b) at 0x32848c02

The addr 0x32848c02 is a valid user-space address.
    PAGE DIRECTORY: d1854000
      PGD: d1854ca0 => bb21e835
      PMD: d1854ca0 => bb21e835
      PTE: bb21e120 => afffa79f

With CONFIG_CPU_SW_DOMAIN_PAN=y, a page domain fault occurred.
    { do_bad, SIGSEGV, SEGV_ACCERR, "page domain fault"},

Without check the __ex_table entry, do_bad() just return fault and die().
    .pushsection __ex_table,"a"
    .long	1003b, 1006b

This patch try __ex_table in do_bad(), the same as in __do_kernel_fault().

Signed-off-by: Lvqiang <Lvqiang.Huang@unisoc.com>
---
 arch/arm/mm/fault.c |    5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/arch/arm/mm/fault.c b/arch/arm/mm/fault.c
index bd0f482..22f45df 100644
--- a/arch/arm/mm/fault.c
+++ b/arch/arm/mm/fault.c
@@ -487,11 +487,14 @@ static inline bool access_error(unsigned int fsr, struct vm_area_struct *vma)
 #endif /* CONFIG_ARM_LPAE */
 
 /*
- * This abort handler always returns "fault".
+ * Checks __ex_table before returns "fault".
  */
 static int
 do_bad(unsigned long addr, unsigned int fsr, struct pt_regs *regs)
 {
+	if (fixup_exception(regs))
+		return 0;
+
 	return 1;
 }
 
-- 
1.7.9.5