• Josh Poimboeuf's avatar
    x86/unwind: Fix empty stack dereference in guess unwinder · 7fbe6ac0
    Josh Poimboeuf authored
    Vince Waver reported the following bug:
    
      WARNING: CPU: 0 PID: 21338 at arch/x86/mm/fault.c:435 vmalloc_fault+0x58/0x1f0
      CPU: 0 PID: 21338 Comm: perf_fuzzer Not tainted 4.8.0+ #37
      Hardware name: Hewlett-Packard HP Compaq Pro 6305 SFF/1850, BIOS K06 v02.57 08/16/2013
      Call Trace:
       <NMI>  ? dump_stack+0x46/0x59
       ? __warn+0xd5/0xee
       ? vmalloc_fault+0x58/0x1f0
       ? __do_page_fault+0x6d/0x48e
       ? perf_log_throttle+0xa4/0xf4
       ? trace_page_fault+0x22/0x30
       ? __unwind_start+0x28/0x42
       ? perf_callchain_kernel+0x75/0xac
       ? get_perf_callchain+0x13a/0x1f0
       ? perf_callchain+0x6a/0x6c
       ? perf_prepare_sample+0x71/0x2eb
       ? perf_event_output_forward+0x1a/0x54
       ? __default_send_IPI_shortcut+0x10/0x2d
       ? __perf_event_overflow+0xfb/0x167
       ? x86_pmu_handle_irq+0x113/0x150
       ? native_read_msr+0x6/0x34
       ? perf_event_nmi_handler+0x22/0x39
       ? perf_ibs_nmi_handler+0x4a/0x51
       ? perf_event_nmi_handler+0x22/0x39
       ? nmi_handle+0x4d/0xf0
       ? perf_ibs_handle_irq+0x3d1/0x3d1
       ? default_do_nmi+0x3c/0xd5
       ? do_nmi+0x92/0x102
       ? end_repeat_nmi+0x1a/0x1e
       ? entry_SYSCALL_64_after_swapgs+0x12/0x4a
       ? entry_SYSCALL_64_after_swapgs+0x12/0x4a
       ? entry_SYSCALL_64_after_swapgs+0x12/0x4a
       <EOE> ^A4---[ end trace 632723104d47d31a ]---
      BUG: stack guard page was hit at ffffc90008500000 (stack is ffffc900084fc000..ffffc900084fffff)
      kernel stack overflow (page fault): 0000 [#1] SMP
      ...
    
    The NMI hit in the entry code right after setting up the stack pointer
    from 'cpu_current_top_of_stack', so the kernel stack was empty.  The
    'guess' version of __unwind_start() attempted to dereference the "top of
    stack" pointer, which is not actually *on* the stack.
    
    Add a check in the guess unwinder to deal with an empty stack.  (The
    frame pointer unwinder already has such a check.)
    Reported-by: default avatarVince Weaver <vincent.weaver@maine.edu>
    Signed-off-by: default avatarJosh Poimboeuf <jpoimboe@redhat.com>
    Cc: Andy Lutomirski <luto@kernel.org>
    Cc: Arnaldo Carvalho de Melo <acme@kernel.org>
    Cc: Linus Torvalds <torvalds@linux-foundation.org>
    Cc: Peter Zijlstra <peterz@infradead.org>
    Cc: Thomas Gleixner <tglx@linutronix.de>
    Fixes: 7c7900f8 ("x86/unwind: Add new unwind interface and implementations")
    Link: http://lkml.kernel.org/r/20161024133127.e5evgeebdbohnmpb@trebleSigned-off-by: default avatarIngo Molnar <mingo@kernel.org>
    7fbe6ac0
unwind_guess.c 1.52 KB