From: Li Huafei <lihuafei1@huawei.com>
To: <linux@armlinux.org.uk>, <rmk+kernel@armlinux.org.uk>,
<ardb@kernel.org>, <will@kernel.org>
Cc: <mark.rutland@arm.com>, <broonie@kernel.org>,
<peterz@infradead.org>, <mingo@redhat.com>, <acme@kernel.org>,
<alexander.shishkin@linux.intel.com>, <jolsa@kernel.org>,
<namhyung@kernel.org>, <arnd@arndb.de>,
<linus.walleij@linaro.org>, <rostedt@goodmis.org>,
<nick.hawkins@hpe.com>, <john@phrozen.org>, <mhiramat@kernel.org>,
<ast@kernel.org>, <linyujun809@huawei.com>,
<ndesaulniers@google.com>, <lihuafei1@huawei.com>,
<linux-arm-kernel@lists.infradead.org>,
<linux-kernel@vger.kernel.org>,
<linux-perf-users@vger.kernel.org>
Subject: [PATCH 1/5] ARM: stacktrace: Skip frame pointer boundary check for call_with_stack()
Date: Tue, 12 Jul 2022 10:15:23 +0800 [thread overview]
Message-ID: <20220712021527.109921-2-lihuafei1@huawei.com> (raw)
In-Reply-To: <20220712021527.109921-1-lihuafei1@huawei.com>
When using the frame pointer unwinder, it was found that the stack trace
output of stack_trace_save() is incomplete if the stack contains
call_with_stack():
[0x7f00002c] dump_stack_task+0x2c/0x90 [hrtimer]
[0x7f0000a0] hrtimer_hander+0x10/0x18 [hrtimer]
[0x801a67f0] __hrtimer_run_queues+0x1b0/0x3b4
[0x801a7350] hrtimer_run_queues+0xc4/0xd8
[0x801a597c] update_process_times+0x3c/0x88
[0x801b5a98] tick_periodic+0x50/0xd8
[0x801b5bf4] tick_handle_periodic+0x24/0x84
[0x8010ffc4] twd_handler+0x38/0x48
[0x8017d220] handle_percpu_devid_irq+0xa8/0x244
[0x80176e9c] generic_handle_domain_irq+0x2c/0x3c
[0x8052e3a8] gic_handle_irq+0x7c/0x90
[0x808ab15c] generic_handle_arch_irq+0x60/0x80
[0x8051191c] call_with_stack+0x1c/0x20
For the frame pointer unwinder, unwind_frame() checks stackframe::fp by
stackframe::sp. Since call_with_stack() switches the SP from one stack
to another, stackframe::fp and stackframe: :sp will point to different
stacks, so we can no longer check stackframe::fp by stackframe::sp. Skip
checking stackframe::fp at this point to avoid this problem.
Signed-off-by: Li Huafei <lihuafei1@huawei.com>
---
arch/arm/kernel/stacktrace.c | 40 ++++++++++++++++++++++++++++------
arch/arm/lib/call_with_stack.S | 2 ++
2 files changed, 35 insertions(+), 7 deletions(-)
diff --git a/arch/arm/kernel/stacktrace.c b/arch/arm/kernel/stacktrace.c
index d0fa2037460a..af87040b0353 100644
--- a/arch/arm/kernel/stacktrace.c
+++ b/arch/arm/kernel/stacktrace.c
@@ -9,6 +9,8 @@
#include <asm/stacktrace.h>
#include <asm/traps.h>
+#include "reboot.h"
+
#if defined(CONFIG_FRAME_POINTER) && !defined(CONFIG_ARM_UNWIND)
/*
* Unwind the current stack frame and store the new register values in the
@@ -39,29 +41,53 @@
* Note that with framepointer enabled, even the leaf functions have the same
* prologue and epilogue, therefore we can ignore the LR value in this case.
*/
-int notrace unwind_frame(struct stackframe *frame)
+
+extern unsigned long call_with_stack_end;
+
+static int frame_pointer_check(struct stackframe *frame)
{
unsigned long high, low;
unsigned long fp = frame->fp;
+ unsigned long pc = frame->pc;
+
+ /*
+ * call_with_stack() is the only place we allow SP to jump from one
+ * stack to another, with FP and SP pointing to different stacks,
+ * skipping the FP boundary check at this point.
+ */
+ if (pc >= (unsigned long)&call_with_stack &&
+ pc < (unsigned long)&call_with_stack_end)
+ return 0;
/* only go to a higher address on the stack */
low = frame->sp;
high = ALIGN(low, THREAD_SIZE);
-#ifdef CONFIG_CC_IS_CLANG
/* check current frame pointer is within bounds */
+#ifdef CONFIG_CC_IS_CLANG
if (fp < low + 4 || fp > high - 4)
return -EINVAL;
-
- frame->sp = frame->fp;
- frame->fp = READ_ONCE_NOCHECK(*(unsigned long *)(fp));
- frame->pc = READ_ONCE_NOCHECK(*(unsigned long *)(fp + 4));
#else
- /* check current frame pointer is within bounds */
if (fp < low + 12 || fp > high - 4)
return -EINVAL;
+#endif
+
+ return 0;
+}
+
+int notrace unwind_frame(struct stackframe *frame)
+{
+ unsigned long fp = frame->fp;
+
+ if (frame_pointer_check(frame))
+ return -EINVAL;
/* restore the registers from the stack frame */
+#ifdef CONFIG_CC_IS_CLANG
+ frame->sp = frame->fp;
+ frame->fp = READ_ONCE_NOCHECK(*(unsigned long *)(fp));
+ frame->pc = READ_ONCE_NOCHECK(*(unsigned long *)(fp + 4));
+#else
frame->fp = READ_ONCE_NOCHECK(*(unsigned long *)(fp - 12));
frame->sp = READ_ONCE_NOCHECK(*(unsigned long *)(fp - 8));
frame->pc = READ_ONCE_NOCHECK(*(unsigned long *)(fp - 4));
diff --git a/arch/arm/lib/call_with_stack.S b/arch/arm/lib/call_with_stack.S
index 0a268a6c513c..5030d4e8d126 100644
--- a/arch/arm/lib/call_with_stack.S
+++ b/arch/arm/lib/call_with_stack.S
@@ -46,4 +46,6 @@ UNWIND( .setfp fpreg, sp )
pop {fpreg, pc}
UNWIND( .fnend )
#endif
+ .globl call_with_stack_end
+call_with_stack_end:
ENDPROC(call_with_stack)
--
2.17.1
next prev parent reply other threads:[~2022-07-12 2:18 UTC|newest]
Thread overview: 23+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-07-12 2:15 [PATCH 0/5] ARM: Convert to ARCH_STACKWALK Li Huafei
2022-07-12 2:15 ` Li Huafei [this message]
2022-07-18 8:57 ` [PATCH 1/5] ARM: stacktrace: Skip frame pointer boundary check for call_with_stack() Linus Walleij
2022-07-26 8:10 ` Li Huafei
2022-07-12 2:15 ` [PATCH 2/5] ARM: stacktrace: Avoid duplicate saving of exception PC value Li Huafei
2022-07-18 9:01 ` Linus Walleij
2022-07-26 9:10 ` Li Huafei
2022-07-26 10:22 ` Russell King (Oracle)
2022-07-26 12:21 ` Li Huafei
2022-07-12 2:15 ` [PATCH 3/5] ARM: stacktrace: Allow stack trace saving for non-current tasks Li Huafei
2022-07-18 9:07 ` Linus Walleij
2022-07-26 9:12 ` Li Huafei
2022-07-26 9:49 ` Russell King (Oracle)
2022-07-26 12:08 ` Li Huafei
2022-07-12 2:15 ` [PATCH 4/5] ARM: stacktrace: Make stack walk callback consistent with generic code Li Huafei
2022-07-12 13:34 ` Mark Brown
2022-07-13 11:21 ` Li Huafei
2022-07-18 9:09 ` Linus Walleij
2022-07-26 9:19 ` Li Huafei
2022-07-12 2:15 ` [PATCH 5/5] ARM: stacktrace: Convert stacktrace to generic ARCH_STACKWALK Li Huafei
2022-07-18 9:12 ` Linus Walleij
2022-07-26 9:15 ` Li Huafei
2022-07-27 6:29 ` Li Huafei
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220712021527.109921-2-lihuafei1@huawei.com \
--to=lihuafei1@huawei.com \
--cc=acme@kernel.org \
--cc=alexander.shishkin@linux.intel.com \
--cc=ardb@kernel.org \
--cc=arnd@arndb.de \
--cc=ast@kernel.org \
--cc=broonie@kernel.org \
--cc=john@phrozen.org \
--cc=jolsa@kernel.org \
--cc=linus.walleij@linaro.org \
--cc=linux-arm-kernel@lists.infradead.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-perf-users@vger.kernel.org \
--cc=linux@armlinux.org.uk \
--cc=linyujun809@huawei.com \
--cc=mark.rutland@arm.com \
--cc=mhiramat@kernel.org \
--cc=mingo@redhat.com \
--cc=namhyung@kernel.org \
--cc=ndesaulniers@google.com \
--cc=nick.hawkins@hpe.com \
--cc=peterz@infradead.org \
--cc=rmk+kernel@armlinux.org.uk \
--cc=rostedt@goodmis.org \
--cc=will@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).