From: Brian Gerst <brgerst@gmail.com>
To: Andy Lutomirski <luto@kernel.org>
Cc: "the arch/x86 maintainers" <x86@kernel.org>,
Linux Kernel Mailing List <linux-kernel@vger.kernel.org>,
linux-arch@vger.kernel.org, Borislav Petkov <bp@alien8.de>,
Nadav Amit <nadav.amit@gmail.com>,
Kees Cook <keescook@chromium.org>,
"kernel-hardening@lists.openwall.com"
<kernel-hardening@lists.openwall.com>,
Linus Torvalds <torvalds@linux-foundation.org>,
Josh Poimboeuf <jpoimboe@redhat.com>, Jann Horn <jann@thejh.net>,
Heiko Carstens <heiko.carstens@de.ibm.com>
Subject: Re: [PATCH v4 15/29] x86/mm/64: Enable vmapped stacks
Date: Mon, 27 Jun 2016 11:01:36 -0400 [thread overview]
Message-ID: <CAMzpN2gBgZbBBJ_kAT=fty7=8z3xDyv2gzz9xuGLoK7EUuHh0A@mail.gmail.com> (raw)
In-Reply-To: <f0a81fa3f7f81422cca23c9d6c88a555d89787ab.1466974736.git.luto@kernel.org>
On Sun, Jun 26, 2016 at 5:55 PM, Andy Lutomirski <luto@kernel.org> wrote:
> This allows x86_64 kernels to enable vmapped stacks. There are a
> couple of interesting bits.
>
> First, x86 lazily faults in top-level paging entries for the vmalloc
> area. This won't work if we get a page fault while trying to access
> the stack: the CPU will promote it to a double-fault and we'll die.
> To avoid this problem, probe the new stack when switching stacks and
> forcibly populate the pgd entry for the stack when switching mms.
>
> Second, once we have guard pages around the stack, we'll want to
> detect and handle stack overflow.
>
> I didn't enable it on x86_32. We'd need to rework the double-fault
> code a bit and I'm concerned about running out of vmalloc virtual
> addresses under some workloads.
>
> This patch, by itself, will behave somewhat erratically when the
> stack overflows while RSP is still more than a few tens of bytes
> above the bottom of the stack. Specifically, we'll get #PF and make
> it to no_context and an oops without triggering a double-fault, and
> no_context doesn't know about stack overflows. The next patch will
> improve that case.
>
> Signed-off-by: Andy Lutomirski <luto@kernel.org>
> ---
> arch/x86/Kconfig | 1 +
> arch/x86/include/asm/switch_to.h | 28 +++++++++++++++++++++++++++-
> arch/x86/kernel/traps.c | 32 ++++++++++++++++++++++++++++++++
> arch/x86/mm/tlb.c | 15 +++++++++++++++
> 4 files changed, 75 insertions(+), 1 deletion(-)
>
> diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
> index d9a94da0c29f..afdcf96ef109 100644
> --- a/arch/x86/Kconfig
> +++ b/arch/x86/Kconfig
> @@ -92,6 +92,7 @@ config X86
> select HAVE_ARCH_TRACEHOOK
> select HAVE_ARCH_TRANSPARENT_HUGEPAGE
> select HAVE_EBPF_JIT if X86_64
> + select HAVE_ARCH_VMAP_STACK if X86_64
> select HAVE_CC_STACKPROTECTOR
> select HAVE_CMPXCHG_DOUBLE
> select HAVE_CMPXCHG_LOCAL
> diff --git a/arch/x86/include/asm/switch_to.h b/arch/x86/include/asm/switch_to.h
> index 8f321a1b03a1..14e4b20f0aaf 100644
> --- a/arch/x86/include/asm/switch_to.h
> +++ b/arch/x86/include/asm/switch_to.h
> @@ -8,6 +8,28 @@ struct tss_struct;
> void __switch_to_xtra(struct task_struct *prev_p, struct task_struct *next_p,
> struct tss_struct *tss);
>
> +/* This runs runs on the previous thread's stack. */
> +static inline void prepare_switch_to(struct task_struct *prev,
> + struct task_struct *next)
> +{
> +#ifdef CONFIG_VMAP_STACK
> + /*
> + * If we switch to a stack that has a top-level paging entry
> + * that is not present in the current mm, the resulting #PF will
> + * will be promoted to a double-fault and we'll panic. Probe
> + * the new stack now so that vmalloc_fault can fix up the page
> + * tables if needed. This can only happen if we use a stack
> + * in vmap space.
> + *
> + * We assume that the stack is aligned so that it never spans
> + * more than one top-level paging entry.
> + *
> + * To minimize cache pollution, just follow the stack pointer.
> + */
> + READ_ONCE(*(unsigned char *)next->thread.sp);
> +#endif
> +}
> +
> #ifdef CONFIG_X86_32
>
> #ifdef CONFIG_CC_STACKPROTECTOR
> @@ -39,6 +61,8 @@ do { \
> */ \
> unsigned long ebx, ecx, edx, esi, edi; \
> \
> + prepare_switch_to(prev, next); \
> + \
> asm volatile("pushl %%ebp\n\t" /* save EBP */ \
> "movl %%esp,%[prev_sp]\n\t" /* save ESP */ \
> "movl %[next_sp],%%esp\n\t" /* restore ESP */ \
> @@ -103,7 +127,9 @@ do { \
> * clean in kernel mode, with the possible exception of IOPL. Kernel IOPL
> * has no effect.
> */
> -#define switch_to(prev, next, last) \
> +#define switch_to(prev, next, last) \
> + prepare_switch_to(prev, next); \
> + \
> asm volatile(SAVE_CONTEXT \
> "movq %%rsp,%P[threadrsp](%[prev])\n\t" /* save RSP */ \
> "movq %P[threadrsp](%[next]),%%rsp\n\t" /* restore RSP */ \
> diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c
> index 00f03d82e69a..9cb7ea781176 100644
> --- a/arch/x86/kernel/traps.c
> +++ b/arch/x86/kernel/traps.c
> @@ -292,12 +292,30 @@ DO_ERROR(X86_TRAP_NP, SIGBUS, "segment not present", segment_not_present)
> DO_ERROR(X86_TRAP_SS, SIGBUS, "stack segment", stack_segment)
> DO_ERROR(X86_TRAP_AC, SIGBUS, "alignment check", alignment_check)
>
> +#ifdef CONFIG_VMAP_STACK
> +static void __noreturn handle_stack_overflow(const char *message,
> + struct pt_regs *regs,
> + unsigned long fault_address)
> +{
> + printk(KERN_EMERG "BUG: stack guard page was hit at %p (stack is %p..%p)\n",
> + (void *)fault_address, current->stack,
> + (char *)current->stack + THREAD_SIZE - 1);
> + die(message, regs, 0);
> +
> + /* Be absolutely certain we don't return. */
> + panic(message);
> +}
> +#endif
> +
> #ifdef CONFIG_X86_64
> /* Runs on IST stack */
> dotraplinkage void do_double_fault(struct pt_regs *regs, long error_code)
> {
> static const char str[] = "double fault";
> struct task_struct *tsk = current;
> +#ifdef CONFIG_VMAP_STACK
> + unsigned long cr2;
> +#endif
>
> #ifdef CONFIG_X86_ESPFIX64
> extern unsigned char native_irq_return_iret[];
> @@ -332,6 +350,20 @@ dotraplinkage void do_double_fault(struct pt_regs *regs, long error_code)
> tsk->thread.error_code = error_code;
> tsk->thread.trap_nr = X86_TRAP_DF;
>
> +#ifdef CONFIG_VMAP_STACK
> + /*
> + * If we overflow the stack into a guard page, the CPU will fail
> + * to deliver #PF and will send #DF instead. CR2 will contain
> + * the linear address of the second fault, which will be in the
> + * guard page below the bottom of the stack.
> + */
> + cr2 = read_cr2();
> + if ((unsigned long)tsk->stack - 1 - cr2 < PAGE_SIZE)
> + handle_stack_overflow(
> + "kernel stack overflow (double-fault)",
> + regs, cr2);
> +#endif
Is there any other way to tell if this was from a page fault? If it
wasn't a page fault then CR2 is undefined.
--
Brian Gerst
next prev parent reply other threads:[~2016-06-27 15:02 UTC|newest]
Thread overview: 84+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-06-26 21:55 [PATCH v4 00/29] virtually mapped stacks and thread_info cleanup Andy Lutomirski
2016-06-26 21:55 ` [PATCH v4 01/29] bluetooth: Switch SMP to crypto_cipher_encrypt_one() Andy Lutomirski
2016-06-27 5:58 ` Marcel Holtmann
2016-06-27 8:54 ` Ingo Molnar
2016-06-27 22:30 ` Marcel Holtmann
2016-06-27 22:33 ` Andy Lutomirski
2016-07-04 17:56 ` Marcel Holtmann
2016-07-06 13:17 ` Andy Lutomirski
2016-06-26 21:55 ` [PATCH v4 02/29] rxrpc: Avoid using stack memory in SG lists in rxkad Andy Lutomirski
2016-06-26 21:55 ` [PATCH v4 03/29] x86/mm/hotplug: Don't remove PGD entries in remove_pagetable() Andy Lutomirski
2016-06-26 21:55 ` [PATCH v4 04/29] x86/cpa: In populate_pgd, don't set the pgd entry until it's populated Andy Lutomirski
2016-06-28 18:48 ` Borislav Petkov
2016-06-28 19:07 ` Andy Lutomirski
2016-06-26 21:55 ` [PATCH v4 05/29] x86/mm: Remove kernel_unmap_pages_in_pgd() and efi_cleanup_page_tables() Andy Lutomirski
2016-06-27 7:19 ` Borislav Petkov
2016-06-26 21:55 ` [PATCH v4 06/29] mm: Track NR_KERNEL_STACK in KiB instead of number of stacks Andy Lutomirski
2016-06-26 21:55 ` [PATCH v4 07/29] mm: Fix memcg stack accounting for sub-page stacks Andy Lutomirski
2016-06-26 21:55 ` [PATCH v4 08/29] dma-api: Teach the "DMA-from-stack" check about vmapped stacks Andy Lutomirski
2016-06-30 19:37 ` Borislav Petkov
2016-07-06 13:20 ` Andy Lutomirski
2016-06-26 21:55 ` [PATCH v4 09/29] fork: Add generic vmalloced stack support Andy Lutomirski
2016-07-01 14:59 ` Borislav Petkov
2016-07-01 16:30 ` Andy Lutomirski
2016-06-26 21:55 ` [PATCH v4 10/29] x86/die: Don't try to recover from an OOPS on a non-default stack Andy Lutomirski
2016-07-02 17:24 ` Borislav Petkov
2016-07-02 18:34 ` Josh Poimboeuf
2016-07-03 9:40 ` Borislav Petkov
2016-07-03 14:25 ` Andy Lutomirski
2016-07-03 18:42 ` Borislav Petkov
2016-06-26 21:55 ` [PATCH v4 11/29] x86/dumpstack: When OOPSing, rewind the stack before do_exit Andy Lutomirski
2016-07-04 18:45 ` Borislav Petkov
2016-06-26 21:55 ` [PATCH v4 12/29] x86/dumpstack: When dumping stack bytes due to OOPS, start with regs->sp Andy Lutomirski
2016-06-26 21:55 ` [PATCH v4 13/29] x86/dumpstack: Try harder to get a call trace on stack overflow Andy Lutomirski
2016-06-26 21:55 ` [PATCH v4 14/29] x86/dumpstack/64: Handle faults when printing the "Stack:" part of an OOPS Andy Lutomirski
2016-06-26 21:55 ` [PATCH v4 15/29] x86/mm/64: Enable vmapped stacks Andy Lutomirski
2016-06-27 15:01 ` Brian Gerst [this message]
2016-06-27 15:12 ` Brian Gerst
2016-06-27 15:22 ` Andy Lutomirski
2016-06-27 15:54 ` Andy Lutomirski
2016-06-27 16:17 ` Brian Gerst
2016-06-27 16:35 ` Andy Lutomirski
2016-06-27 17:09 ` Brian Gerst
2016-06-27 17:23 ` Brian Gerst
2016-06-27 17:28 ` Linus Torvalds
2016-06-27 17:30 ` Andy Lutomirski
2016-06-26 21:55 ` [PATCH v4 16/29] x86/mm: Improve stack-overflow #PF handling Andy Lutomirski
2016-06-26 21:55 ` [PATCH v4 17/29] x86: Move uaccess_err and sig_on_uaccess_err to thread_struct Andy Lutomirski
2016-06-26 21:55 ` [PATCH v4 18/29] x86: Move addr_limit " Andy Lutomirski
2016-06-26 21:55 ` [PATCH v4 19/29] signal: Consolidate {TS,TLF}_RESTORE_SIGMASK code Andy Lutomirski
2016-06-26 21:55 ` [PATCH v4 20/29] x86/smp: Remove stack_smp_processor_id() Andy Lutomirski
2016-06-26 21:55 ` [PATCH v4 21/29] x86/smp: Remove unnecessary initialization of thread_info::cpu Andy Lutomirski
2016-06-26 21:55 ` [PATCH v4 22/29] x86/asm: Move 'status' from struct thread_info to struct thread_struct Andy Lutomirski
2016-06-26 23:55 ` Brian Gerst
2016-06-27 0:23 ` Andy Lutomirski
2016-06-27 0:36 ` Brian Gerst
2016-06-27 0:40 ` Andy Lutomirski
2016-06-26 21:55 ` [PATCH v4 23/29] kdb: Use task_cpu() instead of task_thread_info()->cpu Andy Lutomirski
2016-06-26 21:55 ` [PATCH v4 24/29] x86/entry: Get rid of pt_regs_to_thread_info() Andy Lutomirski
2016-06-26 21:55 ` [PATCH v4 25/29] um: Stop conflating task_struct::stack with thread_info Andy Lutomirski
2016-06-26 23:40 ` Brian Gerst
2016-06-26 23:49 ` Andy Lutomirski
2016-06-26 21:55 ` [PATCH v4 26/29] sched: Allow putting thread_info into task_struct Andy Lutomirski
2016-07-11 10:08 ` [kernel-hardening] " Mark Rutland
2016-07-11 14:55 ` Andy Lutomirski
2016-07-11 15:08 ` Mark Rutland
[not found] ` <CA+55aFy2Sno+bS0A2k0cMWpEJy-bpXufSAw3+ufrfQYbp9rcMQ@mail.gmail.com>
2016-07-11 16:31 ` Mark Rutland
2016-07-11 16:42 ` Linus Torvalds
2016-06-26 21:55 ` [PATCH v4 27/29] x86: Move " Andy Lutomirski
2016-06-26 21:55 ` [PATCH v4 28/29] sched: Free the stack early if CONFIG_THREAD_INFO_IN_TASK Andy Lutomirski
2016-06-27 2:35 ` Andy Lutomirski
2016-06-26 21:55 ` [PATCH v4 29/29] fork: Cache two thread stacks per cpu if CONFIG_VMAP_STACK is set Andy Lutomirski
2016-06-28 7:32 ` [PATCH v4 02/29] rxrpc: Avoid using stack memory in SG lists in rxkad David Howells
2016-06-28 7:37 ` Herbert Xu
2016-06-28 9:07 ` David Howells
2016-06-28 9:45 ` Herbert Xu
2016-06-28 7:41 ` David Howells
2016-06-28 7:52 ` David Howells
2016-06-28 7:55 ` Herbert Xu
2016-06-28 8:54 ` David Howells
2016-06-28 9:43 ` Herbert Xu
2016-06-28 10:00 ` David Howells
2016-06-28 13:23 ` David Howells
2016-06-29 7:06 ` [PATCH v4 00/29] virtually mapped stacks and thread_info cleanup Mika Penttilä
2016-06-29 17:24 ` Mika Penttilä
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CAMzpN2gBgZbBBJ_kAT=fty7=8z3xDyv2gzz9xuGLoK7EUuHh0A@mail.gmail.com' \
--to=brgerst@gmail.com \
--cc=bp@alien8.de \
--cc=heiko.carstens@de.ibm.com \
--cc=jann@thejh.net \
--cc=jpoimboe@redhat.com \
--cc=keescook@chromium.org \
--cc=kernel-hardening@lists.openwall.com \
--cc=linux-arch@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=luto@kernel.org \
--cc=nadav.amit@gmail.com \
--cc=torvalds@linux-foundation.org \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).