* [PATCH v4 0/3] sched: Always check the integrity of the canary
@ 2014-09-12 13:16 Aaron Tomlin
2014-09-12 13:16 ` [PATCH v4 1/3] init/main.c: Give init_task a canary Aaron Tomlin
` (2 more replies)
0 siblings, 3 replies; 8+ messages in thread
From: Aaron Tomlin @ 2014-09-12 13:16 UTC (permalink / raw)
To: peterz
Cc: mingo, dzickus, bmr, jcastillo, atomlin, oleg, riel, prarit, jgh,
linux-kernel, tglx, x86, rostedt, hannes, aneesh.kumar, akpm,
akpm, linuxppc-dev, minchan, mpe
Hi Peter,
Please let me know if this iteration is satisfactory. Thanks.
Currently in the event of a stack overrun a call to schedule()
does not check for this type of corruption. This corruption is
often silent and can go unnoticed. However once the corrupted
region is examined at a later stage, the outcome is undefined
and often results in a sporadic page fault which cannot be
handled.
The first patch adds a canary to init_task's end of stack.
While the second patch provides a helper to determine the
integrity of the canary. The third checks for a stack
overrun and takes appropriate action since the damage
is already done, there is no point in continuing.
Changes since v3:
* Add Michael Ellerman's Acked-by to first patch
(for powerpc)
* Fix compiler error - Michael Ellerman
* Set default Kconfig option to n - Michael Ellerman
Changes since v2:
* Use BUG_ON in schedule_debug() - Peter Zijlstra
* Use a more explicit function
name for setting the canary - Chuck Ebbert
Changes since v1:
* Rebased against v3.17-rc4
* Add a canary to init_task - Oleg Nesterov
* Fix various code formatting issues - Peter Zijlstra
* Introduce Kconfig option - Peter Zijlstra
Aaron Tomlin (3):
init/main.c: Give init_task a canary
sched: Add helper for task stack page overrun checking
sched: BUG when stack end location is over written
arch/powerpc/mm/fault.c | 5 +----
arch/x86/mm/fault.c | 5 +----
include/linux/sched.h | 4 ++++
init/main.c | 1 +
kernel/fork.c | 12 +++++++++---
kernel/sched/core.c | 3 +++
kernel/trace/trace_stack.c | 4 +---
lib/Kconfig.debug | 12 ++++++++++++
8 files changed, 32 insertions(+), 14 deletions(-)
--
1.9.3
^ permalink raw reply [flat|nested] 8+ messages in thread
* [PATCH v4 1/3] init/main.c: Give init_task a canary
2014-09-12 13:16 [PATCH v4 0/3] sched: Always check the integrity of the canary Aaron Tomlin
@ 2014-09-12 13:16 ` Aaron Tomlin
2014-09-18 20:27 ` Oleg Nesterov
2014-09-19 11:46 ` [tip:sched/core] " tip-bot for Aaron Tomlin
2014-09-12 13:16 ` [PATCH v4 2/3] sched: Add helper for task stack page overrun checking Aaron Tomlin
2014-09-12 13:16 ` [PATCH v4 3/3] sched: BUG when stack end location is over written Aaron Tomlin
2 siblings, 2 replies; 8+ messages in thread
From: Aaron Tomlin @ 2014-09-12 13:16 UTC (permalink / raw)
To: peterz
Cc: mingo, dzickus, bmr, jcastillo, atomlin, oleg, riel, prarit, jgh,
linux-kernel, tglx, x86, rostedt, hannes, aneesh.kumar, akpm,
akpm, linuxppc-dev, minchan, mpe
Tasks get their end of stack set to STACK_END_MAGIC with the
aim to catch stack overruns. Currently this feature does not
apply to init_task. This patch removes this restriction.
Note that a similar patch was posted by Prarit Bhargava [1]
some time ago but was never merged.
[1]: http://marc.info/?l=linux-kernel&m=127144305403241&w=2
Signed-off-by: Aaron Tomlin <atomlin@redhat.com>
Acked-by: Michael Ellerman <mpe@ellerman.id.au>
---
arch/powerpc/mm/fault.c | 3 +--
arch/x86/mm/fault.c | 3 +--
include/linux/sched.h | 2 ++
init/main.c | 1 +
kernel/fork.c | 12 +++++++++---
kernel/trace/trace_stack.c | 4 +---
6 files changed, 15 insertions(+), 10 deletions(-)
diff --git a/arch/powerpc/mm/fault.c b/arch/powerpc/mm/fault.c
index 51ab9e7..35d0760c 100644
--- a/arch/powerpc/mm/fault.c
+++ b/arch/powerpc/mm/fault.c
@@ -30,7 +30,6 @@
#include <linux/kprobes.h>
#include <linux/kdebug.h>
#include <linux/perf_event.h>
-#include <linux/magic.h>
#include <linux/ratelimit.h>
#include <linux/context_tracking.h>
@@ -538,7 +537,7 @@ void bad_page_fault(struct pt_regs *regs, unsigned long address, int sig)
regs->nip);
stackend = end_of_stack(current);
- if (current != &init_task && *stackend != STACK_END_MAGIC)
+ if (*stackend != STACK_END_MAGIC)
printk(KERN_ALERT "Thread overran stack, or stack corrupted\n");
die("Kernel access of bad area", regs, sig);
diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c
index a241946..bc23a70 100644
--- a/arch/x86/mm/fault.c
+++ b/arch/x86/mm/fault.c
@@ -3,7 +3,6 @@
* Copyright (C) 2001, 2002 Andi Kleen, SuSE Labs.
* Copyright (C) 2008-2009, Red Hat Inc., Ingo Molnar
*/
-#include <linux/magic.h> /* STACK_END_MAGIC */
#include <linux/sched.h> /* test_thread_flag(), ... */
#include <linux/kdebug.h> /* oops_begin/end, ... */
#include <linux/module.h> /* search_exception_table */
@@ -710,7 +709,7 @@ no_context(struct pt_regs *regs, unsigned long error_code,
show_fault_oops(regs, error_code, address);
stackend = end_of_stack(tsk);
- if (tsk != &init_task && *stackend != STACK_END_MAGIC)
+ if (*stackend != STACK_END_MAGIC)
printk(KERN_EMERG "Thread overran stack, or stack corrupted\n");
tsk->thread.cr2 = address;
diff --git a/include/linux/sched.h b/include/linux/sched.h
index 5c2c885..7ef34b7 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -57,6 +57,7 @@ struct sched_param {
#include <linux/llist.h>
#include <linux/uidgid.h>
#include <linux/gfp.h>
+#include <linux/magic.h>
#include <asm/processor.h>
@@ -2636,6 +2637,7 @@ static inline unsigned long stack_not_used(struct task_struct *p)
return (unsigned long)n - (unsigned long)end_of_stack(p);
}
#endif
+extern void set_task_stack_end_magic(struct task_struct *tsk);
/* set thread flags in other task's structures
* - see asm/thread_info.h for TIF_xxxx flags available
diff --git a/init/main.c b/init/main.c
index bb1aed9..5fc3fc7 100644
--- a/init/main.c
+++ b/init/main.c
@@ -508,6 +508,7 @@ asmlinkage __visible void __init start_kernel(void)
* lockdep hash:
*/
lockdep_init();
+ set_task_stack_end_magic(&init_task);
smp_setup_processor_id();
debug_objects_early_init();
diff --git a/kernel/fork.c b/kernel/fork.c
index 0cf9cdb..adf9583 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -294,11 +294,18 @@ int __weak arch_dup_task_struct(struct task_struct *dst,
return 0;
}
+void set_task_stack_end_magic(struct task_struct *tsk)
+{
+ unsigned long *stackend;
+
+ stackend = end_of_stack(tsk);
+ *stackend = STACK_END_MAGIC; /* for overflow detection */
+}
+
static struct task_struct *dup_task_struct(struct task_struct *orig)
{
struct task_struct *tsk;
struct thread_info *ti;
- unsigned long *stackend;
int node = tsk_fork_get_node(orig);
int err;
@@ -328,8 +335,7 @@ static struct task_struct *dup_task_struct(struct task_struct *orig)
setup_thread_stack(tsk, orig);
clear_user_return_notifier(tsk);
clear_tsk_need_resched(tsk);
- stackend = end_of_stack(tsk);
- *stackend = STACK_END_MAGIC; /* for overflow detection */
+ set_task_stack_end_magic(tsk);
#ifdef CONFIG_CC_STACKPROTECTOR
tsk->stack_canary = get_random_int();
diff --git a/kernel/trace/trace_stack.c b/kernel/trace/trace_stack.c
index 8a4e5cb..1636e41 100644
--- a/kernel/trace/trace_stack.c
+++ b/kernel/trace/trace_stack.c
@@ -13,7 +13,6 @@
#include <linux/sysctl.h>
#include <linux/init.h>
#include <linux/fs.h>
-#include <linux/magic.h>
#include <asm/setup.h>
@@ -171,8 +170,7 @@ check_stack(unsigned long ip, unsigned long *stack)
i++;
}
- if ((current != &init_task &&
- *(end_of_stack(current)) != STACK_END_MAGIC)) {
+ if (*end_of_stack(current) != STACK_END_MAGIC) {
print_max_stack();
BUG();
}
--
1.9.3
^ permalink raw reply related [flat|nested] 8+ messages in thread
* [PATCH v4 2/3] sched: Add helper for task stack page overrun checking
2014-09-12 13:16 [PATCH v4 0/3] sched: Always check the integrity of the canary Aaron Tomlin
2014-09-12 13:16 ` [PATCH v4 1/3] init/main.c: Give init_task a canary Aaron Tomlin
@ 2014-09-12 13:16 ` Aaron Tomlin
2014-09-19 11:46 ` [tip:sched/core] " tip-bot for Aaron Tomlin
2014-09-12 13:16 ` [PATCH v4 3/3] sched: BUG when stack end location is over written Aaron Tomlin
2 siblings, 1 reply; 8+ messages in thread
From: Aaron Tomlin @ 2014-09-12 13:16 UTC (permalink / raw)
To: peterz
Cc: mingo, dzickus, bmr, jcastillo, atomlin, oleg, riel, prarit, jgh,
linux-kernel, tglx, x86, rostedt, hannes, aneesh.kumar, akpm,
akpm, linuxppc-dev, minchan, mpe
This facility is used in a few places so let's introduce
a helper function to improve code readability.
Signed-off-by: Aaron Tomlin <atomlin@redhat.com>
---
arch/powerpc/mm/fault.c | 4 +---
arch/x86/mm/fault.c | 4 +---
include/linux/sched.h | 2 ++
kernel/trace/trace_stack.c | 2 +-
4 files changed, 5 insertions(+), 7 deletions(-)
diff --git a/arch/powerpc/mm/fault.c b/arch/powerpc/mm/fault.c
index 35d0760c..99b2f27 100644
--- a/arch/powerpc/mm/fault.c
+++ b/arch/powerpc/mm/fault.c
@@ -507,7 +507,6 @@ bail:
void bad_page_fault(struct pt_regs *regs, unsigned long address, int sig)
{
const struct exception_table_entry *entry;
- unsigned long *stackend;
/* Are we prepared to handle this fault? */
if ((entry = search_exception_tables(regs->nip)) != NULL) {
@@ -536,8 +535,7 @@ void bad_page_fault(struct pt_regs *regs, unsigned long address, int sig)
printk(KERN_ALERT "Faulting instruction address: 0x%08lx\n",
regs->nip);
- stackend = end_of_stack(current);
- if (*stackend != STACK_END_MAGIC)
+ if (task_stack_end_corrupted(current))
printk(KERN_ALERT "Thread overran stack, or stack corrupted\n");
die("Kernel access of bad area", regs, sig);
diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c
index bc23a70..6240bc7 100644
--- a/arch/x86/mm/fault.c
+++ b/arch/x86/mm/fault.c
@@ -648,7 +648,6 @@ no_context(struct pt_regs *regs, unsigned long error_code,
unsigned long address, int signal, int si_code)
{
struct task_struct *tsk = current;
- unsigned long *stackend;
unsigned long flags;
int sig;
@@ -708,8 +707,7 @@ no_context(struct pt_regs *regs, unsigned long error_code,
show_fault_oops(regs, error_code, address);
- stackend = end_of_stack(tsk);
- if (*stackend != STACK_END_MAGIC)
+ if (task_stack_end_corrupted(tsk))
printk(KERN_EMERG "Thread overran stack, or stack corrupted\n");
tsk->thread.cr2 = address;
diff --git a/include/linux/sched.h b/include/linux/sched.h
index 7ef34b7..a80e35d 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -2615,6 +2615,8 @@ static inline unsigned long *end_of_stack(struct task_struct *p)
}
#endif
+#define task_stack_end_corrupted(task) \
+ (*(end_of_stack(task)) != STACK_END_MAGIC)
static inline int object_is_on_stack(void *obj)
{
diff --git a/kernel/trace/trace_stack.c b/kernel/trace/trace_stack.c
index 1636e41..16eddb3 100644
--- a/kernel/trace/trace_stack.c
+++ b/kernel/trace/trace_stack.c
@@ -170,7 +170,7 @@ check_stack(unsigned long ip, unsigned long *stack)
i++;
}
- if (*end_of_stack(current) != STACK_END_MAGIC) {
+ if (task_stack_end_corrupted(current)) {
print_max_stack();
BUG();
}
--
1.9.3
^ permalink raw reply related [flat|nested] 8+ messages in thread
* [PATCH v4 3/3] sched: BUG when stack end location is over written
2014-09-12 13:16 [PATCH v4 0/3] sched: Always check the integrity of the canary Aaron Tomlin
2014-09-12 13:16 ` [PATCH v4 1/3] init/main.c: Give init_task a canary Aaron Tomlin
2014-09-12 13:16 ` [PATCH v4 2/3] sched: Add helper for task stack page overrun checking Aaron Tomlin
@ 2014-09-12 13:16 ` Aaron Tomlin
2014-09-19 11:46 ` [tip:sched/core] sched: Add default-disabled option to BUG() when stack end location is overwritten tip-bot for Aaron Tomlin
2 siblings, 1 reply; 8+ messages in thread
From: Aaron Tomlin @ 2014-09-12 13:16 UTC (permalink / raw)
To: peterz
Cc: mingo, dzickus, bmr, jcastillo, atomlin, oleg, riel, prarit, jgh,
linux-kernel, tglx, x86, rostedt, hannes, aneesh.kumar, akpm,
akpm, linuxppc-dev, minchan, mpe
Currently in the event of a stack overrun a call to schedule()
does not check for this type of corruption. This corruption is
often silent and can go unnoticed. However once the corrupted
region is examined at a later stage, the outcome is undefined
and often results in a sporadic page fault which cannot be
handled.
This patch checks for a stack overrun and takes appropriate
action since the damage is already done, there is no point
in continuing.
Signed-off-by: Aaron Tomlin <atomlin@redhat.com>
---
kernel/sched/core.c | 3 +++
lib/Kconfig.debug | 12 ++++++++++++
2 files changed, 15 insertions(+)
diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index ec1a286..6ed1a24 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -2660,6 +2660,9 @@ static noinline void __schedule_bug(struct task_struct *prev)
*/
static inline void schedule_debug(struct task_struct *prev)
{
+#ifdef CONFIG_SCHED_STACK_END_CHECK
+ BUG_ON(unlikely(task_stack_end_corrupted(prev)));
+#endif
/*
* Test if we are atomic. Since do_exit() needs to call into
* schedule() atomically, we ignore that path. Otherwise whine
diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
index a285900..e58163d 100644
--- a/lib/Kconfig.debug
+++ b/lib/Kconfig.debug
@@ -824,6 +824,18 @@ config SCHEDSTATS
application, you can say N to avoid the very slight overhead
this adds.
+config SCHED_STACK_END_CHECK
+ bool "Detect stack corruption on calls to schedule()"
+ depends on DEBUG_KERNEL
+ default n
+ help
+ This option checks for a stack overrun on calls to schedule().
+ If the stack end location is found to be over written always panic as
+ the content of the corrupted region can no longer be trusted.
+ This is to ensure no erroneous behaviour occurs which could result in
+ data corruption or a sporadic crash at a later stage once the region
+ is examined. The runtime overhead introduced is minimal.
+
config TIMER_STATS
bool "Collect kernel timers statistics"
depends on DEBUG_KERNEL && PROC_FS
--
1.9.3
^ permalink raw reply related [flat|nested] 8+ messages in thread
* Re: [PATCH v4 1/3] init/main.c: Give init_task a canary
2014-09-12 13:16 ` [PATCH v4 1/3] init/main.c: Give init_task a canary Aaron Tomlin
@ 2014-09-18 20:27 ` Oleg Nesterov
2014-09-19 11:46 ` [tip:sched/core] " tip-bot for Aaron Tomlin
1 sibling, 0 replies; 8+ messages in thread
From: Oleg Nesterov @ 2014-09-18 20:27 UTC (permalink / raw)
To: Aaron Tomlin
Cc: peterz, mingo, dzickus, bmr, jcastillo, riel, prarit, jgh,
linux-kernel, tglx, x86, rostedt, hannes, aneesh.kumar, akpm,
akpm, linuxppc-dev, minchan, mpe
On 09/12, Aaron Tomlin wrote:
>
> Tasks get their end of stack set to STACK_END_MAGIC with the
> aim to catch stack overruns. Currently this feature does not
> apply to init_task. This patch removes this restriction.
>
> Note that a similar patch was posted by Prarit Bhargava [1]
> some time ago but was never merged.
>
> [1]: http://marc.info/?l=linux-kernel&m=127144305403241&w=2
>
> Signed-off-by: Aaron Tomlin <atomlin@redhat.com>
> Acked-by: Michael Ellerman <mpe@ellerman.id.au>
Acked-by: Oleg Nesterov <oleg@redhat.com>
^ permalink raw reply [flat|nested] 8+ messages in thread
* [tip:sched/core] init/main.c: Give init_task a canary
2014-09-12 13:16 ` [PATCH v4 1/3] init/main.c: Give init_task a canary Aaron Tomlin
2014-09-18 20:27 ` Oleg Nesterov
@ 2014-09-19 11:46 ` tip-bot for Aaron Tomlin
1 sibling, 0 replies; 8+ messages in thread
From: tip-bot for Aaron Tomlin @ 2014-09-19 11:46 UTC (permalink / raw)
To: linux-tip-commits
Cc: mingo, rusty, torvalds, kirill.shutemov, peterz, seiji.aguchi,
mpe, fabf, atomlin, jolsa, riel, rostedt, michael.opdenacker,
akpm, isimatu.yasuaki, tglx, oleg, vdavydov, rientjes,
linux-kernel, paulus, hpa, daeseok.youn, masami.hiramatsu.pt,
athorlton, benh, geert, keescook, prarit
Commit-ID: d4311ff1a8da48d609db9500f121c15580dfeeb7
Gitweb: http://git.kernel.org/tip/d4311ff1a8da48d609db9500f121c15580dfeeb7
Author: Aaron Tomlin <atomlin@redhat.com>
AuthorDate: Fri, 12 Sep 2014 14:16:17 +0100
Committer: Ingo Molnar <mingo@kernel.org>
CommitDate: Fri, 19 Sep 2014 12:35:22 +0200
init/main.c: Give init_task a canary
Tasks get their end of stack set to STACK_END_MAGIC with the
aim to catch stack overruns. Currently this feature does not
apply to init_task. This patch removes this restriction.
Note that a similar patch was posted by Prarit Bhargava
some time ago but was never merged:
http://marc.info/?l=linux-kernel&m=127144305403241&w=2
Signed-off-by: Aaron Tomlin <atomlin@redhat.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Acked-by: Oleg Nesterov <oleg@redhat.com>
Acked-by: Michael Ellerman <mpe@ellerman.id.au>
Cc: aneesh.kumar@linux.vnet.ibm.com
Cc: dzickus@redhat.com
Cc: bmr@redhat.com
Cc: jcastillo@redhat.com
Cc: jgh@redhat.com
Cc: minchan@kernel.org
Cc: tglx@linutronix.de
Cc: hannes@cmpxchg.org
Cc: Alex Thorlton <athorlton@sgi.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Cc: Daeseok Youn <daeseok.youn@gmail.com>
Cc: David Rientjes <rientjes@google.com>
Cc: Fabian Frederick <fabf@skynet.be>
Cc: Geert Uytterhoeven <geert@linux-m68k.org>
Cc: Jiri Olsa <jolsa@redhat.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Masami Hiramatsu <masami.hiramatsu.pt@hitachi.com>
Cc: Michael Opdenacker <michael.opdenacker@free-electrons.com>
Cc: Paul Mackerras <paulus@samba.org>
Cc: Prarit Bhargava <prarit@redhat.com>
Cc: Rik van Riel <riel@redhat.com>
Cc: Rusty Russell <rusty@rustcorp.com.au>
Cc: Seiji Aguchi <seiji.aguchi@hds.com>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: Vladimir Davydov <vdavydov@parallels.com>
Cc: Yasuaki Ishimatsu <isimatu.yasuaki@jp.fujitsu.com>
Cc: linuxppc-dev@lists.ozlabs.org
Link: http://lkml.kernel.org/r/1410527779-8133-2-git-send-email-atomlin@redhat.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
---
arch/powerpc/mm/fault.c | 3 +--
arch/x86/mm/fault.c | 3 +--
include/linux/sched.h | 2 ++
init/main.c | 1 +
kernel/fork.c | 12 +++++++++---
kernel/trace/trace_stack.c | 4 +---
6 files changed, 15 insertions(+), 10 deletions(-)
diff --git a/arch/powerpc/mm/fault.c b/arch/powerpc/mm/fault.c
index 51ab9e7..35d0760c 100644
--- a/arch/powerpc/mm/fault.c
+++ b/arch/powerpc/mm/fault.c
@@ -30,7 +30,6 @@
#include <linux/kprobes.h>
#include <linux/kdebug.h>
#include <linux/perf_event.h>
-#include <linux/magic.h>
#include <linux/ratelimit.h>
#include <linux/context_tracking.h>
@@ -538,7 +537,7 @@ void bad_page_fault(struct pt_regs *regs, unsigned long address, int sig)
regs->nip);
stackend = end_of_stack(current);
- if (current != &init_task && *stackend != STACK_END_MAGIC)
+ if (*stackend != STACK_END_MAGIC)
printk(KERN_ALERT "Thread overran stack, or stack corrupted\n");
die("Kernel access of bad area", regs, sig);
diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c
index a241946..bc23a70 100644
--- a/arch/x86/mm/fault.c
+++ b/arch/x86/mm/fault.c
@@ -3,7 +3,6 @@
* Copyright (C) 2001, 2002 Andi Kleen, SuSE Labs.
* Copyright (C) 2008-2009, Red Hat Inc., Ingo Molnar
*/
-#include <linux/magic.h> /* STACK_END_MAGIC */
#include <linux/sched.h> /* test_thread_flag(), ... */
#include <linux/kdebug.h> /* oops_begin/end, ... */
#include <linux/module.h> /* search_exception_table */
@@ -710,7 +709,7 @@ no_context(struct pt_regs *regs, unsigned long error_code,
show_fault_oops(regs, error_code, address);
stackend = end_of_stack(tsk);
- if (tsk != &init_task && *stackend != STACK_END_MAGIC)
+ if (*stackend != STACK_END_MAGIC)
printk(KERN_EMERG "Thread overran stack, or stack corrupted\n");
tsk->thread.cr2 = address;
diff --git a/include/linux/sched.h b/include/linux/sched.h
index 82ff3d6..118dca7 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -57,6 +57,7 @@ struct sched_param {
#include <linux/llist.h>
#include <linux/uidgid.h>
#include <linux/gfp.h>
+#include <linux/magic.h>
#include <asm/processor.h>
@@ -2638,6 +2639,7 @@ static inline unsigned long stack_not_used(struct task_struct *p)
return (unsigned long)n - (unsigned long)end_of_stack(p);
}
#endif
+extern void set_task_stack_end_magic(struct task_struct *tsk);
/* set thread flags in other task's structures
* - see asm/thread_info.h for TIF_xxxx flags available
diff --git a/init/main.c b/init/main.c
index bb1aed9..5fc3fc7 100644
--- a/init/main.c
+++ b/init/main.c
@@ -508,6 +508,7 @@ asmlinkage __visible void __init start_kernel(void)
* lockdep hash:
*/
lockdep_init();
+ set_task_stack_end_magic(&init_task);
smp_setup_processor_id();
debug_objects_early_init();
diff --git a/kernel/fork.c b/kernel/fork.c
index 9387ae8..ad64248 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -294,11 +294,18 @@ int __weak arch_dup_task_struct(struct task_struct *dst,
return 0;
}
+void set_task_stack_end_magic(struct task_struct *tsk)
+{
+ unsigned long *stackend;
+
+ stackend = end_of_stack(tsk);
+ *stackend = STACK_END_MAGIC; /* for overflow detection */
+}
+
static struct task_struct *dup_task_struct(struct task_struct *orig)
{
struct task_struct *tsk;
struct thread_info *ti;
- unsigned long *stackend;
int node = tsk_fork_get_node(orig);
int err;
@@ -328,8 +335,7 @@ static struct task_struct *dup_task_struct(struct task_struct *orig)
setup_thread_stack(tsk, orig);
clear_user_return_notifier(tsk);
clear_tsk_need_resched(tsk);
- stackend = end_of_stack(tsk);
- *stackend = STACK_END_MAGIC; /* for overflow detection */
+ set_task_stack_end_magic(tsk);
#ifdef CONFIG_CC_STACKPROTECTOR
tsk->stack_canary = get_random_int();
diff --git a/kernel/trace/trace_stack.c b/kernel/trace/trace_stack.c
index 8a4e5cb..1636e41 100644
--- a/kernel/trace/trace_stack.c
+++ b/kernel/trace/trace_stack.c
@@ -13,7 +13,6 @@
#include <linux/sysctl.h>
#include <linux/init.h>
#include <linux/fs.h>
-#include <linux/magic.h>
#include <asm/setup.h>
@@ -171,8 +170,7 @@ check_stack(unsigned long ip, unsigned long *stack)
i++;
}
- if ((current != &init_task &&
- *(end_of_stack(current)) != STACK_END_MAGIC)) {
+ if (*end_of_stack(current) != STACK_END_MAGIC) {
print_max_stack();
BUG();
}
^ permalink raw reply related [flat|nested] 8+ messages in thread
* [tip:sched/core] sched: Add helper for task stack page overrun checking
2014-09-12 13:16 ` [PATCH v4 2/3] sched: Add helper for task stack page overrun checking Aaron Tomlin
@ 2014-09-19 11:46 ` tip-bot for Aaron Tomlin
0 siblings, 0 replies; 8+ messages in thread
From: tip-bot for Aaron Tomlin @ 2014-09-19 11:46 UTC (permalink / raw)
To: linux-tip-commits
Cc: mingo, torvalds, peterz, seiji.aguchi, mpe, atomlin, jolsa,
rostedt, akpm, isimatu.yasuaki, tglx, hpa, paulus, linux-kernel,
benh, masami.hiramatsu.pt
Commit-ID: a70857e46dd13e87ae06bf0e64cb6a2d4f436265
Gitweb: http://git.kernel.org/tip/a70857e46dd13e87ae06bf0e64cb6a2d4f436265
Author: Aaron Tomlin <atomlin@redhat.com>
AuthorDate: Fri, 12 Sep 2014 14:16:18 +0100
Committer: Ingo Molnar <mingo@kernel.org>
CommitDate: Fri, 19 Sep 2014 12:35:23 +0200
sched: Add helper for task stack page overrun checking
This facility is used in a few places so let's introduce
a helper function to improve code readability.
Signed-off-by: Aaron Tomlin <atomlin@redhat.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: aneesh.kumar@linux.vnet.ibm.com
Cc: dzickus@redhat.com
Cc: bmr@redhat.com
Cc: jcastillo@redhat.com
Cc: oleg@redhat.com
Cc: riel@redhat.com
Cc: prarit@redhat.com
Cc: jgh@redhat.com
Cc: minchan@kernel.org
Cc: mpe@ellerman.id.au
Cc: tglx@linutronix.de
Cc: hannes@cmpxchg.org
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Cc: Jiri Olsa <jolsa@redhat.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Masami Hiramatsu <masami.hiramatsu.pt@hitachi.com>
Cc: Michael Ellerman <mpe@ellerman.id.au>
Cc: Paul Mackerras <paulus@samba.org>
Cc: Seiji Aguchi <seiji.aguchi@hds.com>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: Yasuaki Ishimatsu <isimatu.yasuaki@jp.fujitsu.com>
Cc: linuxppc-dev@lists.ozlabs.org
Link: http://lkml.kernel.org/r/1410527779-8133-3-git-send-email-atomlin@redhat.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
---
arch/powerpc/mm/fault.c | 4 +---
arch/x86/mm/fault.c | 4 +---
include/linux/sched.h | 2 ++
kernel/trace/trace_stack.c | 2 +-
4 files changed, 5 insertions(+), 7 deletions(-)
diff --git a/arch/powerpc/mm/fault.c b/arch/powerpc/mm/fault.c
index 35d0760c..99b2f27 100644
--- a/arch/powerpc/mm/fault.c
+++ b/arch/powerpc/mm/fault.c
@@ -507,7 +507,6 @@ bail:
void bad_page_fault(struct pt_regs *regs, unsigned long address, int sig)
{
const struct exception_table_entry *entry;
- unsigned long *stackend;
/* Are we prepared to handle this fault? */
if ((entry = search_exception_tables(regs->nip)) != NULL) {
@@ -536,8 +535,7 @@ void bad_page_fault(struct pt_regs *regs, unsigned long address, int sig)
printk(KERN_ALERT "Faulting instruction address: 0x%08lx\n",
regs->nip);
- stackend = end_of_stack(current);
- if (*stackend != STACK_END_MAGIC)
+ if (task_stack_end_corrupted(current))
printk(KERN_ALERT "Thread overran stack, or stack corrupted\n");
die("Kernel access of bad area", regs, sig);
diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c
index bc23a70..6240bc7 100644
--- a/arch/x86/mm/fault.c
+++ b/arch/x86/mm/fault.c
@@ -648,7 +648,6 @@ no_context(struct pt_regs *regs, unsigned long error_code,
unsigned long address, int signal, int si_code)
{
struct task_struct *tsk = current;
- unsigned long *stackend;
unsigned long flags;
int sig;
@@ -708,8 +707,7 @@ no_context(struct pt_regs *regs, unsigned long error_code,
show_fault_oops(regs, error_code, address);
- stackend = end_of_stack(tsk);
- if (*stackend != STACK_END_MAGIC)
+ if (task_stack_end_corrupted(tsk))
printk(KERN_EMERG "Thread overran stack, or stack corrupted\n");
tsk->thread.cr2 = address;
diff --git a/include/linux/sched.h b/include/linux/sched.h
index 118dca7..18f5262 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -2617,6 +2617,8 @@ static inline unsigned long *end_of_stack(struct task_struct *p)
}
#endif
+#define task_stack_end_corrupted(task) \
+ (*(end_of_stack(task)) != STACK_END_MAGIC)
static inline int object_is_on_stack(void *obj)
{
diff --git a/kernel/trace/trace_stack.c b/kernel/trace/trace_stack.c
index 1636e41..16eddb3 100644
--- a/kernel/trace/trace_stack.c
+++ b/kernel/trace/trace_stack.c
@@ -170,7 +170,7 @@ check_stack(unsigned long ip, unsigned long *stack)
i++;
}
- if (*end_of_stack(current) != STACK_END_MAGIC) {
+ if (task_stack_end_corrupted(current)) {
print_max_stack();
BUG();
}
^ permalink raw reply related [flat|nested] 8+ messages in thread
* [tip:sched/core] sched: Add default-disabled option to BUG() when stack end location is overwritten
2014-09-12 13:16 ` [PATCH v4 3/3] sched: BUG when stack end location is over written Aaron Tomlin
@ 2014-09-19 11:46 ` tip-bot for Aaron Tomlin
0 siblings, 0 replies; 8+ messages in thread
From: tip-bot for Aaron Tomlin @ 2014-09-19 11:46 UTC (permalink / raw)
To: linux-tip-commits
Cc: mingo, torvalds, peterz, atomlin, viro, ddstreet, akpm, ak, tglx,
davidlohr, lkundrak, linux-kernel, hpa, davem, paulmck, keescook,
ast
Commit-ID: 0d9e26329b0c9263d4d9e0422d80a0e73268c52f
Gitweb: http://git.kernel.org/tip/0d9e26329b0c9263d4d9e0422d80a0e73268c52f
Author: Aaron Tomlin <atomlin@redhat.com>
AuthorDate: Fri, 12 Sep 2014 14:16:19 +0100
Committer: Ingo Molnar <mingo@kernel.org>
CommitDate: Fri, 19 Sep 2014 12:35:24 +0200
sched: Add default-disabled option to BUG() when stack end location is overwritten
Currently in the event of a stack overrun a call to schedule()
does not check for this type of corruption. This corruption is
often silent and can go unnoticed. However once the corrupted
region is examined at a later stage, the outcome is undefined
and often results in a sporadic page fault which cannot be
handled.
This patch checks for a stack overrun and takes appropriate
action since the damage is already done, there is no point
in continuing.
Signed-off-by: Aaron Tomlin <atomlin@redhat.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: aneesh.kumar@linux.vnet.ibm.com
Cc: dzickus@redhat.com
Cc: bmr@redhat.com
Cc: jcastillo@redhat.com
Cc: oleg@redhat.com
Cc: riel@redhat.com
Cc: prarit@redhat.com
Cc: jgh@redhat.com
Cc: minchan@kernel.org
Cc: mpe@ellerman.id.au
Cc: tglx@linutronix.de
Cc: rostedt@goodmis.org
Cc: hannes@cmpxchg.org
Cc: Alexei Starovoitov <ast@plumgrid.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Andi Kleen <ak@linux.intel.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Dan Streetman <ddstreet@ieee.org>
Cc: Davidlohr Bueso <davidlohr@hp.com>
Cc: David S. Miller <davem@davemloft.net>
Cc: Kees Cook <keescook@chromium.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Lubomir Rintel <lkundrak@v3.sk>
Cc: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
Link: http://lkml.kernel.org/r/1410527779-8133-4-git-send-email-atomlin@redhat.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
---
kernel/sched/core.c | 3 +++
lib/Kconfig.debug | 12 ++++++++++++
2 files changed, 15 insertions(+)
diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index 4b1ddeb..61ee2b3 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -2693,6 +2693,9 @@ static noinline void __schedule_bug(struct task_struct *prev)
*/
static inline void schedule_debug(struct task_struct *prev)
{
+#ifdef CONFIG_SCHED_STACK_END_CHECK
+ BUG_ON(unlikely(task_stack_end_corrupted(prev)));
+#endif
/*
* Test if we are atomic. Since do_exit() needs to call into
* schedule() atomically, we ignore that path. Otherwise whine
diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
index a285900..e58163d 100644
--- a/lib/Kconfig.debug
+++ b/lib/Kconfig.debug
@@ -824,6 +824,18 @@ config SCHEDSTATS
application, you can say N to avoid the very slight overhead
this adds.
+config SCHED_STACK_END_CHECK
+ bool "Detect stack corruption on calls to schedule()"
+ depends on DEBUG_KERNEL
+ default n
+ help
+ This option checks for a stack overrun on calls to schedule().
+ If the stack end location is found to be over written always panic as
+ the content of the corrupted region can no longer be trusted.
+ This is to ensure no erroneous behaviour occurs which could result in
+ data corruption or a sporadic crash at a later stage once the region
+ is examined. The runtime overhead introduced is minimal.
+
config TIMER_STATS
bool "Collect kernel timers statistics"
depends on DEBUG_KERNEL && PROC_FS
^ permalink raw reply related [flat|nested] 8+ messages in thread
end of thread, other threads:[~2014-09-19 11:53 UTC | newest]
Thread overview: 8+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2014-09-12 13:16 [PATCH v4 0/3] sched: Always check the integrity of the canary Aaron Tomlin
2014-09-12 13:16 ` [PATCH v4 1/3] init/main.c: Give init_task a canary Aaron Tomlin
2014-09-18 20:27 ` Oleg Nesterov
2014-09-19 11:46 ` [tip:sched/core] " tip-bot for Aaron Tomlin
2014-09-12 13:16 ` [PATCH v4 2/3] sched: Add helper for task stack page overrun checking Aaron Tomlin
2014-09-19 11:46 ` [tip:sched/core] " tip-bot for Aaron Tomlin
2014-09-12 13:16 ` [PATCH v4 3/3] sched: BUG when stack end location is over written Aaron Tomlin
2014-09-19 11:46 ` [tip:sched/core] sched: Add default-disabled option to BUG() when stack end location is overwritten tip-bot for Aaron Tomlin
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).