From: Jisheng Zhang <jszhang@kernel.org> To: Paul Walmsley <paul.walmsley@sifive.com>, Palmer Dabbelt <palmer@dabbelt.com>, Albert Ou <aou@eecs.berkeley.edu> Cc: linux-riscv@lists.infradead.org, linux-kernel@vger.kernel.org, Guo Ren <guoren@kernel.org> Subject: [PATCH] riscv: fix race when vmap stack overflow Date: Wed, 19 Oct 2022 23:47:27 +0800 [thread overview] Message-ID: <20221019154727.2395-1-jszhang@kernel.org> (raw) Currently, when detecting vmap stack overflow, riscv firstly switches to the so called shadow stack, then use this shadow stack to call the get_overflow_stack() to get the overflow stack. However, there's a race here if two or more harts use the same shadow stack at the same time. To solve this race, we introduce spin_shadow_stack atomic var, which will make the shadow stack usage serialized. Fixes: 31da94c25aea ("riscv: add VMAP_STACK overflow detection") Signed-off-by: Jisheng Zhang <jszhang@kernel.org> Suggested-by: Guo Ren <guoren@kernel.org> --- arch/riscv/kernel/entry.S | 4 ++++ arch/riscv/kernel/traps.c | 4 ++++ 2 files changed, 8 insertions(+) diff --git a/arch/riscv/kernel/entry.S b/arch/riscv/kernel/entry.S index b9eda3fcbd6d..7b924b16792b 100644 --- a/arch/riscv/kernel/entry.S +++ b/arch/riscv/kernel/entry.S @@ -404,6 +404,10 @@ handle_syscall_trace_exit: #ifdef CONFIG_VMAP_STACK handle_kernel_stack_overflow: +1: la sp, spin_shadow_stack + amoswap.w sp, sp, (sp) + bnez sp, 1b + la sp, shadow_stack addi sp, sp, SHADOW_OVERFLOW_STACK_SIZE diff --git a/arch/riscv/kernel/traps.c b/arch/riscv/kernel/traps.c index f3e96d60a2ff..88a54947dffb 100644 --- a/arch/riscv/kernel/traps.c +++ b/arch/riscv/kernel/traps.c @@ -221,11 +221,15 @@ asmlinkage unsigned long get_overflow_stack(void) OVERFLOW_STACK_SIZE; } +atomic_t spin_shadow_stack; + asmlinkage void handle_bad_stack(struct pt_regs *regs) { unsigned long tsk_stk = (unsigned long)current->stack; unsigned long ovf_stk = (unsigned long)this_cpu_ptr(overflow_stack); + atomic_set_release(&spin_shadow_stack, 0); + console_verbose(); pr_emerg("Insufficient stack space to handle exception!\n"); -- 2.37.2
WARNING: multiple messages have this Message-ID (diff)
From: Jisheng Zhang <jszhang@kernel.org> To: Paul Walmsley <paul.walmsley@sifive.com>, Palmer Dabbelt <palmer@dabbelt.com>, Albert Ou <aou@eecs.berkeley.edu> Cc: linux-riscv@lists.infradead.org, linux-kernel@vger.kernel.org, Guo Ren <guoren@kernel.org> Subject: [PATCH] riscv: fix race when vmap stack overflow Date: Wed, 19 Oct 2022 23:47:27 +0800 [thread overview] Message-ID: <20221019154727.2395-1-jszhang@kernel.org> (raw) Currently, when detecting vmap stack overflow, riscv firstly switches to the so called shadow stack, then use this shadow stack to call the get_overflow_stack() to get the overflow stack. However, there's a race here if two or more harts use the same shadow stack at the same time. To solve this race, we introduce spin_shadow_stack atomic var, which will make the shadow stack usage serialized. Fixes: 31da94c25aea ("riscv: add VMAP_STACK overflow detection") Signed-off-by: Jisheng Zhang <jszhang@kernel.org> Suggested-by: Guo Ren <guoren@kernel.org> --- arch/riscv/kernel/entry.S | 4 ++++ arch/riscv/kernel/traps.c | 4 ++++ 2 files changed, 8 insertions(+) diff --git a/arch/riscv/kernel/entry.S b/arch/riscv/kernel/entry.S index b9eda3fcbd6d..7b924b16792b 100644 --- a/arch/riscv/kernel/entry.S +++ b/arch/riscv/kernel/entry.S @@ -404,6 +404,10 @@ handle_syscall_trace_exit: #ifdef CONFIG_VMAP_STACK handle_kernel_stack_overflow: +1: la sp, spin_shadow_stack + amoswap.w sp, sp, (sp) + bnez sp, 1b + la sp, shadow_stack addi sp, sp, SHADOW_OVERFLOW_STACK_SIZE diff --git a/arch/riscv/kernel/traps.c b/arch/riscv/kernel/traps.c index f3e96d60a2ff..88a54947dffb 100644 --- a/arch/riscv/kernel/traps.c +++ b/arch/riscv/kernel/traps.c @@ -221,11 +221,15 @@ asmlinkage unsigned long get_overflow_stack(void) OVERFLOW_STACK_SIZE; } +atomic_t spin_shadow_stack; + asmlinkage void handle_bad_stack(struct pt_regs *regs) { unsigned long tsk_stk = (unsigned long)current->stack; unsigned long ovf_stk = (unsigned long)this_cpu_ptr(overflow_stack); + atomic_set_release(&spin_shadow_stack, 0); + console_verbose(); pr_emerg("Insufficient stack space to handle exception!\n"); -- 2.37.2 _______________________________________________ linux-riscv mailing list linux-riscv@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-riscv
next reply other threads:[~2022-10-19 15:59 UTC|newest] Thread overview: 28+ messages / expand[flat|nested] mbox.gz Atom feed top 2022-10-19 15:47 Jisheng Zhang [this message] 2022-10-19 15:47 ` [PATCH] riscv: fix race when vmap stack overflow Jisheng Zhang 2022-10-20 1:02 ` Guo Ren 2022-10-20 1:02 ` Guo Ren 2022-10-20 2:16 ` Guo Ren 2022-10-20 2:16 ` Guo Ren 2022-10-20 14:38 ` Jisheng Zhang 2022-10-20 14:38 ` Jisheng Zhang 2022-10-21 0:35 ` Guo Ren 2022-10-21 0:35 ` Guo Ren 2022-10-20 23:26 ` Andrea Parri 2022-10-20 23:26 ` Andrea Parri 2022-10-21 1:11 ` Guo Ren 2022-10-21 1:11 ` Guo Ren 2022-10-21 8:36 ` Andrea Parri 2022-10-21 8:36 ` Andrea Parri 2022-10-21 12:08 ` Tong Tiangen 2022-10-21 12:08 ` Tong Tiangen 2022-10-21 13:22 ` Andrea Parri 2022-10-21 13:22 ` Andrea Parri 2022-10-21 13:46 ` Tong Tiangen 2022-10-21 13:46 ` Tong Tiangen 2022-10-21 14:41 ` Guo Ren 2022-10-21 14:41 ` Guo Ren 2022-10-21 15:17 ` Tong Tiangen 2022-10-21 15:17 ` Tong Tiangen 2022-10-21 14:35 ` Guo Ren 2022-10-21 14:35 ` Guo Ren
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20221019154727.2395-1-jszhang@kernel.org \ --to=jszhang@kernel.org \ --cc=aou@eecs.berkeley.edu \ --cc=guoren@kernel.org \ --cc=linux-kernel@vger.kernel.org \ --cc=linux-riscv@lists.infradead.org \ --cc=palmer@dabbelt.com \ --cc=paul.walmsley@sifive.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.