From patchwork Mon Sep 21 16:28:14 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "gregkh@linuxfoundation.org" X-Patchwork-Id: 309365 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-14.2 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 679F4C43468 for ; Mon, 21 Sep 2020 16:54:49 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 36A1B2076E for ; Mon, 21 Sep 2020 16:54:49 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1600707289; bh=zRnzcd8ZM9DjUcGJxi3Jq0JAUPtuMZiw6U8QenmZGaY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=wXLmiKP31ODhhbUtsKTlbndI+Cp0gqbyEEX9vLyqtBid7VVjZRTRqfOns5g/Rr0ce H5FvXbpdkNpcbL57icRk6NphOHt0zF3YZE4jHG3Sp1srwiH9TovUew/2CKTuCk9hKf CpnIg8QBIdi4oJKVgMG2dr8RJ83ISGH8NmLAg7Uc= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728429AbgIUQqH (ORCPT ); Mon, 21 Sep 2020 12:46:07 -0400 Received: from mail.kernel.org ([198.145.29.99]:52076 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727302AbgIUQp7 (ORCPT ); Mon, 21 Sep 2020 12:45:59 -0400 Received: from localhost (83-86-74-64.cable.dynamic.v4.ziggo.nl [83.86.74.64]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id D7875206B2; Mon, 21 Sep 2020 16:45:57 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1600706758; bh=zRnzcd8ZM9DjUcGJxi3Jq0JAUPtuMZiw6U8QenmZGaY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Mj/eBapIaXy6teW4glIWiayfLhz/2JBzXL59FRwgGJfG4WDZDS4JgRmiEs+fKokF1 0vViPvxM50gAzTPM7OOcf4EaTmFgaQMG7GyfTEISMDAPiEJiW3kWvBOXnlpMHJmJxY /QhLq9aH06z9Sfjgz0iOi105boPxtpA7DU8+8o58= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Naresh Kamboju , Logan Gunthorpe , Josh Poimboeuf , Borislav Petkov , "Peter Zijlstra (Intel)" , Thomas Gleixner , Sasha Levin Subject: [PATCH 5.8 082/118] x86/unwind/fp: Fix FP unwinding in ret_from_fork Date: Mon, 21 Sep 2020 18:28:14 +0200 Message-Id: <20200921162040.146732002@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20200921162036.324813383@linuxfoundation.org> References: <20200921162036.324813383@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Josh Poimboeuf [ Upstream commit 6f9885a36c006d798319661fa849f9c2922223b9 ] There have been some reports of "bad bp value" warnings printed by the frame pointer unwinder: WARNING: kernel stack regs at 000000005bac7112 in sh:1014 has bad 'bp' value 0000000000000000 This warning happens when unwinding from an interrupt in ret_from_fork(). If entry code gets interrupted, the state of the frame pointer (rbp) may be undefined, which can confuse the unwinder, resulting in warnings like the above. There's an in_entry_code() check which normally silences such warnings for entry code. But in this case, ret_from_fork() is getting interrupted. It recently got moved out of .entry.text, so the in_entry_code() check no longer works. It could be moved back into .entry.text, but that would break the noinstr validation because of the call to schedule_tail(). Instead, initialize each new task's RBP to point to the task's entry regs via an encoded frame pointer. That will allow the unwinder to reach the end of the stack gracefully. Fixes: b9f6976bfb94 ("x86/entry/64: Move non entry code into .text section") Reported-by: Naresh Kamboju Reported-by: Logan Gunthorpe Signed-off-by: Josh Poimboeuf Signed-off-by: Borislav Petkov Acked-by: Peter Zijlstra (Intel) Acked-by: Thomas Gleixner Link: https://lkml.kernel.org/r/f366bbf5a8d02e2318ee312f738112d0af74d16f.1600103007.git.jpoimboe@redhat.com Signed-off-by: Sasha Levin --- arch/x86/include/asm/frame.h | 19 +++++++++++++++++++ arch/x86/kernel/process.c | 3 ++- 2 files changed, 21 insertions(+), 1 deletion(-) diff --git a/arch/x86/include/asm/frame.h b/arch/x86/include/asm/frame.h index 296b346184b27..fb42659f6e988 100644 --- a/arch/x86/include/asm/frame.h +++ b/arch/x86/include/asm/frame.h @@ -60,12 +60,26 @@ #define FRAME_END "pop %" _ASM_BP "\n" #ifdef CONFIG_X86_64 + #define ENCODE_FRAME_POINTER \ "lea 1(%rsp), %rbp\n\t" + +static inline unsigned long encode_frame_pointer(struct pt_regs *regs) +{ + return (unsigned long)regs + 1; +} + #else /* !CONFIG_X86_64 */ + #define ENCODE_FRAME_POINTER \ "movl %esp, %ebp\n\t" \ "andl $0x7fffffff, %ebp\n\t" + +static inline unsigned long encode_frame_pointer(struct pt_regs *regs) +{ + return (unsigned long)regs & 0x7fffffff; +} + #endif /* CONFIG_X86_64 */ #endif /* __ASSEMBLY__ */ @@ -83,6 +97,11 @@ #define ENCODE_FRAME_POINTER +static inline unsigned long encode_frame_pointer(struct pt_regs *regs) +{ + return 0; +} + #endif #define FRAME_BEGIN diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c index fe67dbd76e517..bff502e779e44 100644 --- a/arch/x86/kernel/process.c +++ b/arch/x86/kernel/process.c @@ -42,6 +42,7 @@ #include #include #include +#include #include "process.h" @@ -133,7 +134,7 @@ int copy_thread_tls(unsigned long clone_flags, unsigned long sp, fork_frame = container_of(childregs, struct fork_frame, regs); frame = &fork_frame->frame; - frame->bp = 0; + frame->bp = encode_frame_pointer(childregs); frame->ret_addr = (unsigned long) ret_from_fork; p->thread.sp = (unsigned long) fork_frame; p->thread.io_bitmap = NULL;