Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Haibo Li <haibo.li@mediatek.com>
To:     <linus.walleij@linaro.org>
CC:     <a.anurag@samsung.com>, <alexander.sverdlin@nokia.com>,
        <angelogioacchino.delregno@collabora.com>, <ardb@kernel.org>,
        <catalin.marinas@arm.com>, <haibo.li@mediatek.com>,
        <linux-arm-kernel@lists.infradead.org>,
        <linux-kernel@vger.kernel.org>,
        <linux-mediatek@lists.infradead.org>, <linux@armlinux.org.uk>,
        <matthias.bgg@gmail.com>, <rmk+kernel@armlinux.org.uk>,
        <xiaoming.yu@mediatek.com>
Subject: Re: [PATCH] ARM:unwind:fix unwind abort for uleb128 case
Date:   Wed, 12 Apr 2023 10:44:06 +0800
Message-ID: <20230412024406.62187-1-haibo.li@mediatek.com>
In-Reply-To: <CACRpkda8qTuCmF_RDjtp26k_DMpME=0wAPjejh4ODkUr9SxVqg@mail.gmail.com>
References: <CACRpkda8qTuCmF_RDjtp26k_DMpME=0wAPjejh4ODkUr9SxVqg@mail.gmail.com>
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain
Precedence: bulk

> On Fri, Apr 7, 2023 at 5:33 AM Haibo Li <haibo.li@mediatek.com> wrote:=0D
> =0D
> > When unwind instruction is 0xb2,the subsequent instructions=0D
> > are uleb128 bytes.=0D
> > For now,it uses only the first uleb128 byte in code.=0D
> >=0D
> > For vsp increments of 0x204~0x400,use one uleb128 byte like below:=0D
> > 0xc06a00e4 <unwind_test_work>: 0x80b27fac=0D
> >   Compact model index: 0=0D
> >   0xb2 0x7f vsp =3D vsp + 1024=0D
> >   0xac      pop {r4, r5, r6, r7, r8, r14}=0D
> >=0D
> > For vsp increments larger than 0x400,use two uleb128 bytes like below:=
=0D
> > 0xc06a00e4 <unwind_test_work>: @0xc0cc9e0c=0D
> >   Compact model index: 1=0D
> >   0xb2 0x81 0x01 vsp =3D vsp + 1032=0D
> >   0xac      pop {r4, r5, r6, r7, r8, r14}=0D
> > The unwind works well since the decoded uleb128 byte is also 0x81.=0D
> >=0D
> > For vsp increments larger than 0x600,use two uleb128 bytes like below:=
=0D
> > 0xc06a00e4 <unwind_test_work>: @0xc0cc9e0c=0D
> >   Compact model index: 1=0D
> >   0xb2 0x81 0x02 vsp =3D vsp + 1544=0D
> >   0xac      pop {r4, r5, r6, r7, r8, r14}=0D
> > In this case,the decoded uleb128 result is 0x101(vsp=3D0x204+(0x101<<2)=
).=0D
> > While the uleb128 used in code is 0x81(vsp=3D0x204+(0x81<<2)).=0D
> > The unwind aborts at this frame since it gets incorrect vsp.=0D
> >=0D
> > To fix this,add uleb128 decode to cover all the above case.=0D
> >=0D
> > Signed-off-by: Haibo Li <haibo.li@mediatek.com>=0D
> =0D
> [Added people such as Catalin, Ard and Anurag who wrote the lion's=0D
> share of actual algorithms in this file]=0D
> =0D
> I would just link the wikipedia in the patch commit log actually:=0D
> =0D
> Link:https://en.wikipedia.org/wiki/LEB128=0D
> =0D
> for poor souls like me who need a primer on this encoding.=0D
> =0D
> It's great if you also have a reference to the spec where you=0D
> found this, but I take your word for that this appears in code.=0D
> Did compilers always emit this? Then we should have a Cc stable=0D
> to this patch. Unfortunately the link in the top of the file is dead.=0D
Yes.I also study uleb128 enc/dec format from this link.=0D
In experiment,Both Clang and GCC produces unwind instructions using ULEB128=
=0D
> =0D
> > +static unsigned long unwind_decode_uleb128(struct unwind_ctrl_block=0D
> *ctrl)=0D
> =0D
> So this decodes max an unsigned long? Are we sure that will always=0D
> suffice?=0D
For now,the maximum thread size of arm is 16KB(KASAN on).=0D
From below experiment(worse case while impossible),two uleb128 bytes is suf=
ficent for 16KB stack.=0D
0xc06a00e4 <unwind_test_work>: @0xc0cc9e0c=0D
  Compact model index: 1=0D
  0xb2 0xff 0x1e vsp =3D vsp + 16384=0D
  0xac      pop {r4, r5, r6, r7, r8, r14}=0D
From below experiment,the code picks maximum 4 uleb128 encoded bytes,=0D
correspoding to vsp increments of 1073742336,the unwind_decode_uleb128 retu=
rns 0xFFFFFFF.=0D
So unsigned long is suffice.=0D
0xc06a00e4 <unwind_test_work>: @0xc0cc9e0c=0D
  Compact model index: 1=0D
  0xb2 0xff 0xff 0xff 0x7f vsp =3D vsp + 1073742336=0D
  0xac      pop {r4, r5, r6, r7, r8, r14}=0D
> =0D
> > +{=0D
> > +       unsigned long result =3D 0;=0D
> > +       unsigned long insn;=0D
> > +       unsigned long bytes =3D 0;=0D
> > +=0D
> > +       do {=0D
> > +               insn =3D unwind_get_byte(ctrl);=0D
> > +               result |=3D (insn & 0x7f) << (bytes * 7);=0D
> > +               bytes++;=0D
> > +               if (bytes =3D=3D sizeof(result))=0D
> > +                       break;=0D
> > +       } while (!!(insn & 0x80));=0D
> =0D
> I suppose the documentation is in the commit message, but something terse=
=0D
> and nice that make us understand this code would be needed here as well.=
=0D
> Could you fold in a comment of how the do {} while-loop works and th expe=
cted=0D
> outcome? Something like:=0D
> =0D
> "unwind_get_byte() will advance ctrl one instruction at a time, we loop=0D
> until we get an instruction byte where bit 7 is not set."=0D
> =0D
I will add a comment in later patch.=0D
> Is there a risk that this will loop forever or way too long if it happens=
=0D
> to point at some corrupted memory containing say 0xff 0xff 0xff ...?=0D
> =0D
> Since we're decoding a 32 bit unsigned long maybe break the loop after ma=
x=0D
> 5 bytes (35 bits)? Or are we sure this will not happen?=0D
in case of some corrupted memory containing say 0xff 0xff 0xff ...,the loop=
 breaks after =0D
max 4 bytes(decode as max 28 bits)=0D
> =0D
> > @@ -361,7 +376,7 @@ static int unwind_exec_insn(struct=0D
> unwind_ctrl_block *ctrl)=0D
> >                 if (ret)=0D
> >                         goto error;=0D
> >         } else if (insn =3D=3D 0xb2) {=0D
> > -               unsigned long uleb128 =3D unwind_get_byte(ctrl);=0D
> > +               unsigned long uleb128 =3D unwind_decode_uleb128(ctrl);=
=0D
> =0D
> Is unsigned long always enough? We are sure?=0D
For the patch,it can cover single frame up to 1073742336 Bytes.So it is eno=
ugh.=0D
>=0D
> Yours,=0D
> Linus Walleij=0D