From: Qi Zheng <zhengqi.arch@bytedance.com>
To: Peter Zijlstra <peterz@infradead.org>,
Josh Poimboeuf <jpoimboe@redhat.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>,
Holger Hoffst??tte <holger@applied-asynchrony.com>,
Kees Cook <keescook@chromium.org>,
Thomas Gleixner <tglx@linutronix.de>,
Justin Forbes <jmforbes@linuxtx.org>,
Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
Linux Kernel Mailing List <linux-kernel@vger.kernel.org>,
Andrew Morton <akpm@linux-foundation.org>,
Guenter Roeck <linux@roeck-us.net>, Shuah Khan <shuah@kernel.org>,
patches@kernelci.org, lkft-triage@lists.linaro.org,
Pavel Machek <pavel@denx.de>, Jon Hunter <jonathanh@nvidia.com>,
Florian Fainelli <f.fainelli@gmail.com>,
stable <stable@vger.kernel.org>
Subject: Re: [PATCH] x86: Pin task-stack in __get_wchan()
Date: Fri, 19 Nov 2021 18:02:50 +0800 [thread overview]
Message-ID: <759cd319-990f-af23-2f1c-aba55d0768b8@bytedance.com> (raw)
In-Reply-To: <YZduix64h64cDa7R@hirez.programming.kicks-ass.net>
On 11/19/21 5:29 PM, Peter Zijlstra wrote:
> On Thu, Nov 18, 2021 at 06:04:27PM -0800, Josh Poimboeuf wrote:
>> On Thu, Nov 18, 2021 at 01:11:09PM +0100, Peter Zijlstra wrote:
>
>>> I now have the below, the only thing missing is that there's a
>>> user_mode() call on a stack based regs. Now on x86_64 we can
>>> __get_kernel_nofault() regs->cs and call it a day, but on i386 we have
>>> to also fetch regs->flags.
>>>
>>> Is this really the way to go?
>>
>> Please no. Can we just add a check in unwind_start() to ensure the
>> caller did try_get_task_stack()?
>
> I tried; but at best it's fundamentally racy and in practise its worse
> because init_task doesn't seem to believe in refcounts and kthreads are
> odd for some raisin. Now those are fixable, but given the fundamental
> races, I don't see how it's ever going to be reliable.
>
> I don't mind the __get_kernel_nofault() usage and think I can do a
> better implementation that will allow us to get rid of the
> pagefault_{dis,en}able() sprinkling, but that's for another day. It's
> just the user_mode(regs) usage that's going to be somewhat ugleh.
>
> Anyway, below is the minimal fix for the situation at hand. I'm not
> going to be around much today, so if Linus wants to pick that up instead
> of mass revert things that's obviously fine too.
>
> ---
> Subject: x86: Pin task-stack in __get_wchan()
>
> When commit 5d1ceb3969b6 ("x86: Fix __get_wchan() for !STACKTRACE")
> moved from stacktrace to native unwind_*() usage, the
> try_get_task_stack() got lost, leading to use-after-free issues for
> dying tasks.
>
> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
> ---
> arch/x86/kernel/process.c | 5 +++++
> 1 file changed, 5 insertions(+)
>
> diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c
> index e9ee8b526319..04143a653a8a 100644
> --- a/arch/x86/kernel/process.c
> +++ b/arch/x86/kernel/process.c
> @@ -964,6 +964,9 @@ unsigned long __get_wchan(struct task_struct *p)
> struct unwind_state state;
> unsigned long addr = 0;
>
> + if (!try_get_task_stack(p))
> + return 0;
> +
> for (unwind_start(&state, p, NULL, NULL); !unwind_done(&state);
> unwind_next_frame(&state)) {
> addr = unwind_get_return_address(&state);
> @@ -974,6 +977,8 @@ unsigned long __get_wchan(struct task_struct *p)
> break;
> }
>
> + put_task_stack(p);
> +
> return addr;
> }
>
>
This implementation is very similar to stack_trace_save_tsk(), maybe we
can just move stack_trace_save_tsk() out of CONFIG_STACKTRACE and reuse
it.
--
Thanks,
Qi
next prev parent reply other threads:[~2021-11-19 10:03 UTC|newest]
Thread overview: 35+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-11-17 10:19 [PATCH 5.15 000/923] 5.15.3-rc3 review Greg Kroah-Hartman
2021-11-17 13:37 ` Fox Chen
2021-11-17 14:13 ` Guenter Roeck
2021-11-17 14:43 ` Greg Kroah-Hartman
2021-11-17 14:54 ` Guenter Roeck
2021-11-17 17:34 ` Jon Hunter
2021-11-17 18:51 ` Florian Fainelli
2021-11-17 20:25 ` Holger Kiehl
2021-11-18 8:14 ` Greg Kroah-Hartman
2021-11-18 14:08 ` Holger Kiehl
2021-11-18 17:08 ` Greg Kroah-Hartman
2021-11-17 20:35 ` Guenter Roeck
2021-11-17 21:32 ` Justin Forbes
2021-11-17 23:32 ` Holger Hoffstätte
2021-11-17 23:50 ` Linus Torvalds
2021-11-18 0:16 ` Kees Cook
2021-11-18 6:26 ` Guenter Roeck
2021-11-18 8:14 ` Greg Kroah-Hartman
2021-11-18 8:12 ` Greg Kroah-Hartman
2021-11-18 17:17 ` Kees Cook
2021-11-18 8:06 ` Peter Zijlstra
2021-11-18 8:18 ` Peter Zijlstra
2021-11-18 9:39 ` Peter Zijlstra
2021-11-18 10:12 ` Peter Zijlstra
2021-11-18 12:11 ` Peter Zijlstra
2021-11-19 2:04 ` Josh Poimboeuf
2021-11-19 9:29 ` [PATCH] x86: Pin task-stack in __get_wchan() Peter Zijlstra
2021-11-19 10:02 ` Qi Zheng [this message]
2021-11-19 10:22 ` Peter Zijlstra
2021-11-19 10:26 ` Qi Zheng
2021-11-19 18:16 ` Linus Torvalds
2021-11-19 18:35 ` Josh Poimboeuf
2021-11-22 9:32 ` Peter Zijlstra
2021-11-22 16:14 ` Josh Poimboeuf
2021-11-18 5:45 ` [PATCH 5.15 000/923] 5.15.3-rc3 review Naresh Kamboju
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=759cd319-990f-af23-2f1c-aba55d0768b8@bytedance.com \
--to=zhengqi.arch@bytedance.com \
--cc=akpm@linux-foundation.org \
--cc=f.fainelli@gmail.com \
--cc=gregkh@linuxfoundation.org \
--cc=holger@applied-asynchrony.com \
--cc=jmforbes@linuxtx.org \
--cc=jonathanh@nvidia.com \
--cc=jpoimboe@redhat.com \
--cc=keescook@chromium.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux@roeck-us.net \
--cc=lkft-triage@lists.linaro.org \
--cc=patches@kernelci.org \
--cc=pavel@denx.de \
--cc=peterz@infradead.org \
--cc=shuah@kernel.org \
--cc=stable@vger.kernel.org \
--cc=tglx@linutronix.de \
--cc=torvalds@linux-foundation.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).