WARNING: kernel stack regs at ffffc9000024fea8 in udevadm:92 has bad 'bp' value 00007fffc4614d30

WARNING: kernel stack regs at ffffc9000024fea8 in udevadm:92 has bad 'bp' value 00007fffc4614d30

[Borislav Petkov]

Hi,

the splat below started appearing on one of the boxes here with
rc7+tip/master from yesterday.

Ideas?

...
[    3.019118] x86/mm: Checked W+X mappings: passed, no W+X pages found.
[    3.024994] mkdir (73) used greatest stack depth: 14352 bytes left
[    3.065841] cat (84) used greatest stack depth: 14288 bytes left
[    3.074305] all_generic_ide (85) used greatest stack depth: 14128 bytes left
[    3.187019] WARNING: kernel stack regs at ffffc9000024fea8 in udevadm:92 has bad 'bp' value 00007fffc4614d30
[    3.187023] unwind stack type:0 next_sp:          (null) mask:0x6 graph_idx:0
[    3.187029] ffffc9000024fea8: 000055a6100e9b38 (0x55a6100e9b38)
[    3.187031] ffffc9000024feb0: 000055a6100e9b35 (0x55a6100e9b35)
[    3.187033] ffffc9000024feb8: 000055a6100e9f68 (0x55a6100e9f68)
[    3.187035] ffffc9000024fec0: 000055a6100e9f50 (0x55a6100e9f50)
[    3.187037] ffffc9000024fec8: 00007fffc4614d30 (0x7fffc4614d30)
[    3.187038] ffffc9000024fed0: 000055a6100eaf50 (0x55a6100eaf50)
[    3.187040] ffffc9000024fed8: 0000000000000000 ...
[    3.187042] ffffc9000024fee0: 0000000000000100 (0x100)
[    3.187043] ffffc9000024fee8: ffff8801187df488 (0xffff8801187df488)
[    3.187045] ffffc9000024fef0: 00007ffffffff000 (0x7ffffffff000)
[    3.187046] ffffc9000024fef8: 0000000000000000 ...
[    3.187048] ffffc9000024ff10: ffffc9000024fe98 (0xffffc9000024fe98)
[    3.187050] ffffc9000024ff18: 00007fffc4614d00 (0x7fffc4614d00)
[    3.187052] ffffc9000024ff20: ffffffffffffff10 (0xffffffffffffff10)
[    3.187058] ffffc9000024ff28: ffffffff811c6c1f (SyS_newlstat+0xf/0x10)
[    3.187060] ffffc9000024ff30: 0000000000000010 (0x10)
[    3.187062] ffffc9000024ff38: 0000000000000296 (0x296)
[    3.187064] ffffc9000024ff40: ffffc9000024ff50 (0xffffc9000024ff50)
[    3.187065] ffffc9000024ff48: 0000000000000018 (0x18)
[    3.187072] ffffc9000024ff50: ffffffff816b2e6a (entry_SYSCALL_64_fastpath+0x18/0xa8)
[    3.187073] ffffc9000024ff58: 00007fffc4614d40 (0x7fffc4614d40)
[    3.187075] ffffc9000024ff60: 0000000000001000 (0x1000)
[    3.187076] ffffc9000024ff68: 0000000000000000 ...
[    3.187078] ffffc9000024ff78: 00007f9734fe9440 (0x7f9734fe9440)
[    3.187080] ffffc9000024ff80: 000055a6100e9af0 (0x55a6100e9af0)
[    3.187081] ffffc9000024ff88: 0000000000000246 (0x246)
[    3.187083] ffffc9000024ff90: 0000000000000020 (0x20)
[    3.187084] ffffc9000024ff98: 0000000000001010 (0x1010)
[    3.187086] ffffc9000024ffa0: 0000000000000003 (0x3)
[    3.187088] ffffc9000024ffa8: ffffffffffffffda (0xffffffffffffffda)
[    3.187089] ffffc9000024ffb0: 00007f9734d2efe5 (0x7f9734d2efe5)
[    3.187091] ffffc9000024ffb8: 00007fffc4614c70 (0x7fffc4614c70)
[    3.187093] ffffc9000024ffc0: 00007fffc4614c70 (0x7fffc4614c70)
[    3.187094] ffffc9000024ffc8: 000055a6100e9f50 (0x55a6100e9f50)
[    3.187096] ffffc9000024ffd0: 0000000000000006 (0x6)
[    3.187097] ffffc9000024ffd8: 00007f9734d2efe5 (0x7f9734d2efe5)
[    3.187099] ffffc9000024ffe0: 0000000000000033 (0x33)
[    3.187101] ffffc9000024ffe8: 0000000000000246 (0x246)
[    3.187102] ffffc9000024fff0: 00007fffc4614c38 (0x7fffc4614c38)
[    3.187104] ffffc9000024fff8: 000000000000002b (0x2b)
[    3.333203] rtsx_pci 0000:03:00.0: rtsx_pci_acquire_irq: pcr->msi_en = 1, pci->irq = 26
[    3.338762] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
...

-- 
Regards/Gruss,
    Boris.

Good mailing practices for 400: avoid top-posting and trim the reply.

Re: WARNING: kernel stack regs at ffffc9000024fea8 in udevadm:92 has bad 'bp' value 00007fffc4614d30

[Josh Poimboeuf]

On Thu, Apr 20, 2017 at 01:06:10PM +0200, Borislav Petkov wrote:
> Hi,
> 
> the splat below started appearing on one of the boxes here with
> rc7+tip/master from yesterday.
> 
> Ideas?

Thanks for reporting it.  This is another false positive.  It unwinded
from an interrupt which came in right after calling into C code, but
before it could set up the frame pointer.  This needs another unwinder
check.

-- 
Josh

Re: WARNING: kernel stack regs at ffffc9000024fea8 in udevadm:92 has bad 'bp' value 00007fffc4614d30

[Josh Poimboeuf]

On Thu, Apr 20, 2017 at 08:30:21AM -0500, Josh Poimboeuf wrote:
> On Thu, Apr 20, 2017 at 01:06:10PM +0200, Borislav Petkov wrote:
> > Hi,
> > 
> > the splat below started appearing on one of the boxes here with
> > rc7+tip/master from yesterday.
> > 
> > Ideas?
> 
> Thanks for reporting it.  This is another false positive.  It unwinded
> from an interrupt which came in right after calling into C code, but
> before it could set up the frame pointer.  This needs another unwinder
> check.

If it's recreatable, can you test with the following patch?


diff --git a/arch/x86/kernel/unwind_frame.c b/arch/x86/kernel/unwind_frame.c
index bda82df..abe36ff 100644
--- a/arch/x86/kernel/unwind_frame.c
+++ b/arch/x86/kernel/unwind_frame.c
@@ -91,16 +91,26 @@ static bool in_entry_code(unsigned long ip)
 	return false;
 }
 
+static inline unsigned long *last_frame(struct unwind_state *state)
+{
+	return (unsigned long *)task_pt_regs(state->task) - 2;
+}
+
 #ifdef CONFIG_X86_32
 #define GCC_REALIGN_WORDS 3
 #else
 #define GCC_REALIGN_WORDS 1
 #endif
 
+static inline unsigned long *last_aligned_frame(struct unwind_state *state)
+{
+	return last_frame(state) - GCC_REALIGN_WORDS;
+}
+
 static bool is_last_task_frame(struct unwind_state *state)
 {
-	unsigned long *last_bp = (unsigned long *)task_pt_regs(state->task) - 2;
-	unsigned long *aligned_bp = last_bp - GCC_REALIGN_WORDS;
+	unsigned long *last_bp = last_frame(state);
+	unsigned long *aligned_bp = last_aligned_frame(state);
 
 	/*
 	 * We have to check for the last task frame at two different locations
@@ -277,10 +287,12 @@ bool unwind_next_frame(struct unwind_state *state)
 
 	/*
 	 * Don't warn if the unwinder got lost due to an interrupt in entry
-	 * code before the stack was set up:
+	 * code before the first frame pointer got set up:
 	 */
 	if (state->got_irq && in_entry_code(state->ip))
 		goto the_end;
+	if (state->regs && (unsigned long *)state->regs->sp >= last_aligned_frame(state))
+		goto the_end;
 
 	if (state->regs) {
 		printk_deferred_once(KERN_WARNING

Re: WARNING: kernel stack regs at ffffc9000024fea8 in udevadm:92 has bad 'bp' value 00007fffc4614d30

[Borislav Petkov]

On Thu, Apr 20, 2017 at 08:42:52AM -0500, Josh Poimboeuf wrote:
> If it's recreatable, can you test with the following patch?

Yap, it is. /me builds a kernel...

> 
> diff --git a/arch/x86/kernel/unwind_frame.c b/arch/x86/kernel/unwind_frame.c
> index bda82df..abe36ff 100644
> --- a/arch/x86/kernel/unwind_frame.c
> +++ b/arch/x86/kernel/unwind_frame.c

...

Looks good.

Reported-and-tested-by: Borislav Petkov <bp@suse.de>

Thanks.

-- 
Regards/Gruss,
    Boris.

Good mailing practices for 400: avoid top-posting and trim the reply.