Home Home > GIT Browse
summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorTakashi Iwai <tiwai@suse.de>2019-08-21 23:28:09 +0200
committerTakashi Iwai <tiwai@suse.de>2019-08-21 23:28:09 +0200
commitf9b87167ae7af473764a87c0f3a33524749f619a (patch)
tree581c5a8f7f59c8f76781ff6591d28d6d4d828df9
parent9cbdd0c19b0296e7edd468b490d0dec90bfe1486 (diff)
parentafa99a4f2b590831cca2c25e8389b3835840bc82 (diff)
Merge branch 'users/bpetkov/SLE15/for-next' into SLE15
Pull x86 fixes from Borislav Petkov
-rw-r--r--blacklist.conf1
-rw-r--r--patches.arch/x86-unwind-handle-null-pointer-calls-better-in-frame-unwinder.patch126
-rw-r--r--series.conf1
3 files changed, 128 insertions, 0 deletions
diff --git a/blacklist.conf b/blacklist.conf
index 2340e21022..401883c75e 100644
--- a/blacklist.conf
+++ b/blacklist.conf
@@ -1317,3 +1317,4 @@ d065ee93aab6ef4c2a5af5c455b5044bd5136547 # config-only fix
1e1c50a929bc9e49bc3f9935b92450d9e69f8158 # affects only single core-machines
c2d1b3aae33605a61cbab445d8ae1c708ccd2698 # effectively reverted in upstream
ce02ef06fcf7a399a6276adb83f37373d10cbbe1 # fixed in gcc instead, see bsc#1131264
+a9d57ef15cbe327fe54416dd194ee0ea66ae53a4 # ditto
diff --git a/patches.arch/x86-unwind-handle-null-pointer-calls-better-in-frame-unwinder.patch b/patches.arch/x86-unwind-handle-null-pointer-calls-better-in-frame-unwinder.patch
new file mode 100644
index 0000000000..97a0fab515
--- /dev/null
+++ b/patches.arch/x86-unwind-handle-null-pointer-calls-better-in-frame-unwinder.patch
@@ -0,0 +1,126 @@
+From: Jann Horn <jannh@google.com>
+Date: Fri, 1 Mar 2019 04:12:00 +0100
+Subject: x86/unwind: Handle NULL pointer calls better in frame unwinder
+Git-commit: f4f34e1b82eb4219d8eaa1c7e2e17ca219a6a2b5
+Patch-mainline: v5.1-rc1
+References: bsc#1114279
+
+When the frame unwinder is invoked for an oops caused by a call to NULL, it
+currently skips the parent function because BP still points to the parent's
+stack frame; the (nonexistent) current function only has the first half of
+a stack frame, and BP doesn't point to it yet.
+
+Add a special case for IP==0 that calculates a fake BP from SP, then uses
+the real BP for the next frame.
+
+Note that this handles first_frame specially: Return information about the
+parent function as long as the saved IP is >=first_frame, even if the fake
+BP points below it.
+
+With an artificially-added NULL call in prctl_set_seccomp(), before this
+patch, the trace is:
+
+Call Trace:
+ ? prctl_set_seccomp+0x3a/0x50
+ __x64_sys_prctl+0x457/0x6f0
+ ? __ia32_sys_prctl+0x750/0x750
+ do_syscall_64+0x72/0x160
+ entry_SYSCALL_64_after_hwframe+0x44/0xa9
+
+After this patch, the trace is:
+
+Call Trace:
+ prctl_set_seccomp+0x3a/0x50
+ __x64_sys_prctl+0x457/0x6f0
+ ? __ia32_sys_prctl+0x750/0x750
+ do_syscall_64+0x72/0x160
+ entry_SYSCALL_64_after_hwframe+0x44/0xa9
+
+Signed-off-by: Jann Horn <jannh@google.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Acked-by: Josh Poimboeuf <jpoimboe@redhat.com>
+Cc: Borislav Petkov <bp@alien8.de>
+Cc: Andrew Morton <akpm@linux-foundation.org>
+Cc: syzbot <syzbot+ca95b2b7aef9e7cbd6ab@syzkaller.appspotmail.com>
+Cc: "H. Peter Anvin" <hpa@zytor.com>
+Cc: Masahiro Yamada <yamada.masahiro@socionext.com>
+Cc: Michal Marek <michal.lkml@markovi.net>
+Cc: linux-kbuild@vger.kernel.org
+Link: https://lkml.kernel.org/r/20190301031201.7416-1-jannh@google.com
+
+Acked-by: Borislav Petkov <bp@suse.de>
+---
+ arch/x86/include/asm/unwind.h | 6 ++++++
+ arch/x86/kernel/unwind_frame.c | 25 ++++++++++++++++++++++---
+ 2 files changed, 28 insertions(+), 3 deletions(-)
+
+diff --git a/arch/x86/include/asm/unwind.h b/arch/x86/include/asm/unwind.h
+index 1f86e1b0a5cd..499578f7e6d7 100644
+--- a/arch/x86/include/asm/unwind.h
++++ b/arch/x86/include/asm/unwind.h
+@@ -23,6 +23,12 @@ struct unwind_state {
+ #elif defined(CONFIG_UNWINDER_FRAME_POINTER)
+ bool got_irq;
+ unsigned long *bp, *orig_sp, ip;
++ /*
++ * If non-NULL: The current frame is incomplete and doesn't contain a
++ * valid BP. When looking for the next frame, use this instead of the
++ * non-existent saved BP.
++ */
++ unsigned long *next_bp;
+ struct pt_regs *regs;
+ #else
+ unsigned long *sp;
+diff --git a/arch/x86/kernel/unwind_frame.c b/arch/x86/kernel/unwind_frame.c
+index 3dc26f95d46e..9b9fd4826e7a 100644
+--- a/arch/x86/kernel/unwind_frame.c
++++ b/arch/x86/kernel/unwind_frame.c
+@@ -320,10 +320,14 @@ bool unwind_next_frame(struct unwind_state *state)
+ }
+
+ /* Get the next frame pointer: */
+- if (state->regs)
++ if (state->next_bp) {
++ next_bp = state->next_bp;
++ state->next_bp = NULL;
++ } else if (state->regs) {
+ next_bp = (unsigned long *)state->regs->bp;
+- else
++ } else {
+ next_bp = (unsigned long *)READ_ONCE_TASK_STACK(state->task, *state->bp);
++ }
+
+ /* Move to the next frame if it's safe: */
+ if (!update_stack_state(state, next_bp))
+@@ -398,6 +402,21 @@ void __unwind_start(struct unwind_state *state, struct task_struct *task,
+
+ bp = get_frame_pointer(task, regs);
+
++ /*
++ * If we crash with IP==0, the last successfully executed instruction
++ * was probably an indirect function call with a NULL function pointer.
++ * That means that SP points into the middle of an incomplete frame:
++ * *SP is a return pointer, and *(SP-sizeof(unsigned long)) is where we
++ * would have written a frame pointer if we hadn't crashed.
++ * Pretend that the frame is complete and that BP points to it, but save
++ * the real BP so that we can use it when looking for the next frame.
++ */
++ if (regs && regs->ip == 0 &&
++ (unsigned long *)kernel_stack_pointer(regs) >= first_frame) {
++ state->next_bp = bp;
++ bp = ((unsigned long *)kernel_stack_pointer(regs)) - 1;
++ }
++
+ /* Initialize stack info and make sure the frame data is accessible: */
+ get_stack_info(bp, state->task, &state->stack_info,
+ &state->stack_mask);
+@@ -410,7 +429,7 @@ void __unwind_start(struct unwind_state *state, struct task_struct *task,
+ */
+ while (!unwind_done(state) &&
+ (!on_stack(&state->stack_info, first_frame, sizeof(long)) ||
+- state->bp < first_frame))
++ (state->next_bp == NULL && state->bp < first_frame)))
+ unwind_next_frame(state);
+ }
+ EXPORT_SYMBOL_GPL(__unwind_start);
+
diff --git a/series.conf b/series.conf
index d70aa48a80..936d7f8487 100644
--- a/series.conf
+++ b/series.conf
@@ -21880,6 +21880,7 @@
patches.arch/0004-virtio-introduce-virtio_max_dma_size
patches.arch/0005-virtio-blk-consider-virtio_max_dma_size-for-maximum-segment-size
patches.fixes/s390-virtio-handle-find-on-invalid-queue-gracefully
+ patches.arch/x86-unwind-handle-null-pointer-calls-better-in-frame-unwinder.patch
patches.drivers/tpm-tpm_crb-Avoid-unaligned-reads-in-crb_recv.patch
patches.drivers/tpm-Fix-some-name-collisions-with-drivers-char-tpm.h.patch
patches.drivers/tpm-Unify-the-send-callback-behaviour.patch