From: Paul Burton <paulburton@kernel.org>
To: "Jason A. Donenfeld" <Jason@zx2c4.com>
Cc: linux-mips@vger.kernel.org, linux-kernel@vger.kernel.org,
arnd@arndb.de, Vincenzo Frascino <vincenzo.frascino@arm.com>
Subject: Re: vdso-related userspace crashes on 5.5 mips64
Date: Mon, 23 Dec 2019 15:29:45 -0800 [thread overview]
Message-ID: <20191223232945.a3sbzfj6uw2sokba@lantea.localdomain> (raw)
In-Reply-To: <20191223130834.GA102399@zx2c4.com>
Hi Jason,
Copying Vincenzo.
On Mon, Dec 23, 2019 at 02:08:34PM +0100, Jason A. Donenfeld wrote:
> I'm experiencing VDSO-related crashes on 5.5 with MIPS64. The MIPS64
> builders on build.wireguard.com are all red at the moment.
>
> It looks like libc is crashing with a null pointer dereference when
> doing any work after returning from clock_gettime. This manifests
> itself, for me, with calls to clock_gettime(CLOCK_PROCESS_CPUTIME_ID),
> because CLOCK_PROCESS_CPUTIME_ID is not in the VDSO. It looks in the
> VDSO, doesn't find it, and then proceeds to make the real syscall, when
> it crashes. I can simulate the same crash by simply adding a printf
> after a successful call to the vdso before returning. For example:
>
> int __clock_gettime(clockid_t clk, struct timespec *ts)
> {
> int r;
>
> #ifdef VDSO_CGT_SYM
> int (*f)(clockid_t, struct timespec *) =
> (int (*)(clockid_t, struct timespec *))vdso_func;
> printf("vdso %p\n", f); // <-- this line does NOT crash.
> if (f) {
> r = f(clk, ts);
> if (!r) {
> printf("ret %d\n", r); // <-- this line DOES crash.
> return r;
> }
> if (r == -EINVAL)
> return __syscall_ret(r);
> }
> #endif
> printf("falling through\n"); // <--- this line DOES crash.
> r = __syscall(SYS_clock_gettime, clk, ts); // <-- also, this line will crash too
> if (r == -ENOSYS) {
> if (clk == CLOCK_REALTIME) {
> __syscall(SYS_gettimeofday, ts, 0);
> ts->tv_nsec = (int)ts->tv_nsec * 1000;
> return 0;
> }
> r = -EINVAL;
> }
> return __syscall_ret(r);
> }
>
> It seems like somehow the stack frame is corrupted/unusable after a call
> to the vdso. But, returning immediately from clock_gettime after a call
> to the vdso allows the program to continue. Thus, this problem only
> manifests itself when using clocks that aren't handled by the vdso.
>
> It's possible this is due to some compiler ABI mismatch situation
> between userspace and kernelspace. However, I've only started seeing
> this happen with 5.5 and not on 5.4.
>
> Does the above description immediately point to some recognizable
> change? If not, I'll keep debugging.
There is one pending fix for the VDSO in mips-fixes, commit 7d2aa4bb90f5
("mips: Fix gettimeofday() in the vdso library") but your symptoms sound
different to the problem fixed there...
Could you share your kernel config & tell us which platform you're
running on? (QEMU Malta?)
Thanks,
Paul
next prev parent reply other threads:[~2019-12-23 23:27 UTC|newest]
Thread overview: 24+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-12-23 13:08 vdso-related userspace crashes on 5.5 mips64 Jason A. Donenfeld
2019-12-23 21:44 ` Jason A. Donenfeld
2019-12-23 23:29 ` Paul Burton [this message]
2019-12-24 13:37 ` Jason A. Donenfeld
2019-12-30 15:58 ` Arnd Bergmann
2019-12-24 14:19 ` Jason A. Donenfeld
2019-12-24 13:54 ` [PATCH] mips: vdso: conditionalize 32-bit time functions on COMPAT_32BIT_TIME Jason A. Donenfeld
2019-12-30 11:57 ` Arnd Bergmann
2019-12-30 12:26 ` Jason A. Donenfeld
2019-12-30 12:34 ` Arnd Bergmann
2019-12-30 14:37 ` Jason A. Donenfeld
2019-12-30 15:10 ` Jason A. Donenfeld
2019-12-30 15:37 ` Arnd Bergmann
2019-12-30 15:39 ` Jason A. Donenfeld
2019-12-30 15:47 ` Arnd Bergmann
2019-12-30 15:58 ` Jason A. Donenfeld
2019-12-30 17:33 ` Arnd Bergmann
2019-12-30 21:09 ` Jason A. Donenfeld
2019-12-30 21:42 ` Jason A. Donenfeld
2019-12-31 16:14 ` Jason A. Donenfeld
2020-01-01 4:10 ` Paul Burton
2020-01-01 4:25 ` Paul Burton
2020-01-01 9:47 ` Jason A. Donenfeld
2020-01-01 9:47 ` Jason A. Donenfeld
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20191223232945.a3sbzfj6uw2sokba@lantea.localdomain \
--to=paulburton@kernel.org \
--cc=Jason@zx2c4.com \
--cc=arnd@arndb.de \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mips@vger.kernel.org \
--cc=vincenzo.frascino@arm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).