arch/x86/kernel/unwind_frame.c

   1 #include <linux/sched.h>
   2 #include <asm/ptrace.h>
   3 #include <asm/bitops.h>
   4 #include <asm/stacktrace.h>
   5 #include <asm/unwind.h>
   6
   7 #define FRAME_HEADER_SIZE (sizeof(long) * 2)
   8
   9 /*
  10  * This disables KASAN checking when reading a value from another task's stack,
  11  * since the other task could be running on another CPU and could have poisoned
  12  * the stack in the meantime.
  13  */
  14 #define READ_ONCE_TASK_STACK(task, x)                   \
  15 ({                                                      \
  16         unsigned long val;                              \
  17         if (task == current)                            \
  18                 val = READ_ONCE(x);                     \
  19         else                                            \
  20                 val = READ_ONCE_NOCHECK(x);             \
  21         val;                                            \
  22 })
  23
  24 static void unwind_dump(struct unwind_state *state, unsigned long *sp)
  25 {
  26         static bool dumped_before = false;
  27         bool prev_zero, zero = false;
  28         unsigned long word;
  29
  30         if (dumped_before)
  31                 return;
  32
  33         dumped_before = true;
  34
  35         printk_deferred("unwind stack type:%d next_sp:%p mask:%lx graph_idx:%d\n",
  36                         state->stack_info.type, state->stack_info.next_sp,
  37                         state->stack_mask, state->graph_idx);
  38
  39         for (sp = state->orig_sp; sp < state->stack_info.end; sp++) {
  40                 word = READ_ONCE_NOCHECK(*sp);
  41
  42                 prev_zero = zero;
  43                 zero = word == 0;
  44
  45                 if (zero) {
  46                         if (!prev_zero)
  47                                 printk_deferred("%p: %016x ...\n", sp, 0);
  48                         continue;
  49                 }
  50
  51                 printk_deferred("%p: %016lx (%pB)\n", sp, word, (void *)word);
  52         }
  53 }
  54
  55 unsigned long unwind_get_return_address(struct unwind_state *state)
  56 {
  57         unsigned long addr;
  58         unsigned long *addr_p = unwind_get_return_address_ptr(state);
  59
  60         if (unwind_done(state))
  61                 return 0;
  62
  63         if (state->regs && user_mode(state->regs))
  64                 return 0;
  65
  66         addr = READ_ONCE_TASK_STACK(state->task, *addr_p);
  67         addr = ftrace_graph_ret_addr(state->task, &state->graph_idx, addr,
  68                                      addr_p);
  69
  70         return __kernel_text_address(addr) ? addr : 0;
  71 }
  72 EXPORT_SYMBOL_GPL(unwind_get_return_address);
  73
  74 static size_t regs_size(struct pt_regs *regs)
  75 {
  76         /* x86_32 regs from kernel mode are two words shorter: */
  77         if (IS_ENABLED(CONFIG_X86_32) && !user_mode(regs))
  78                 return sizeof(*regs) - 2*sizeof(long);
  79
  80         return sizeof(*regs);
  81 }
  82
  83 static bool is_last_task_frame(struct unwind_state *state)
  84 {
  85         unsigned long bp = (unsigned long)state->bp;
  86         unsigned long regs = (unsigned long)task_pt_regs(state->task);
  87
  88         /*
  89          * We have to check for the last task frame at two different locations
  90          * because gcc can occasionally decide to realign the stack pointer and
  91          * change the offset of the stack frame by a word in the prologue of a
  92          * function called by head/entry code.
  93          */
  94         return bp == regs - FRAME_HEADER_SIZE ||
  95                bp == regs - FRAME_HEADER_SIZE - sizeof(long);
  96 }
  97
  98 /*
  99  * This determines if the frame pointer actually contains an encoded pointer to
 100  * pt_regs on the stack.  See ENCODE_FRAME_POINTER.
 101  */
 102 static struct pt_regs *decode_frame_pointer(unsigned long *bp)
 103 {
 104         unsigned long regs = (unsigned long)bp;
 105
 106         if (!(regs & 0x1))
 107                 return NULL;
 108
 109         return (struct pt_regs *)(regs & ~0x1);
 110 }
 111
 112 static bool update_stack_state(struct unwind_state *state, void *addr,
 113                                size_t len)
 114 {
 115         struct stack_info *info = &state->stack_info;
 116         enum stack_type orig_type = info->type;
 117
 118         /*
 119          * If addr isn't on the current stack, switch to the next one.
 120          *
 121          * We may have to traverse multiple stacks to deal with the possibility
 122          * that 'info->next_sp' could point to an empty stack and 'addr' could
 123          * be on a subsequent stack.
 124          */
 125         while (!on_stack(info, addr, len))
 126                 if (get_stack_info(info->next_sp, state->task, info,
 127                                    &state->stack_mask))
 128                         return false;
 129
 130         if (!state->orig_sp || info->type != orig_type)
 131                 state->orig_sp = addr;
 132
 133         return true;
 134 }
 135
 136 bool unwind_next_frame(struct unwind_state *state)
 137 {
 138         struct pt_regs *regs;
 139         unsigned long *next_bp, *next_frame;
 140         size_t next_len;
 141         enum stack_type prev_type = state->stack_info.type;
 142
 143         if (unwind_done(state))
 144                 return false;
 145
 146         /* have we reached the end? */
 147         if (state->regs && user_mode(state->regs))
 148                 goto the_end;
 149
 150         if (is_last_task_frame(state)) {
 151                 regs = task_pt_regs(state->task);
 152
 153                 /*
 154                  * kthreads (other than the boot CPU's idle thread) have some
 155                  * partial regs at the end of their stack which were placed
 156                  * there by copy_thread_tls().  But the regs don't have any
 157                  * useful information, so we can skip them.
 158                  *
 159                  * This user_mode() check is slightly broader than a PF_KTHREAD
 160                  * check because it also catches the awkward situation where a
 161                  * newly forked kthread transitions into a user task by calling
 162                  * do_execve(), which eventually clears PF_KTHREAD.
 163                  */
 164                 if (!user_mode(regs))
 165                         goto the_end;
 166
 167                 /*
 168                  * We're almost at the end, but not quite: there's still the
 169                  * syscall regs frame.  Entry code doesn't encode the regs
 170                  * pointer for syscalls, so we have to set it manually.
 171                  */
 172                 state->regs = regs;
 173                 state->bp = NULL;
 174                 return true;
 175         }
 176
 177         /* get the next frame pointer */
 178         if (state->regs)
 179                 next_bp = (unsigned long *)state->regs->bp;
 180         else
 181                 next_bp = (unsigned long *)READ_ONCE_TASK_STACK(state->task,*state->bp);
 182
 183         /* is the next frame pointer an encoded pointer to pt_regs? */
 184         regs = decode_frame_pointer(next_bp);
 185         if (regs) {
 186                 next_frame = (unsigned long *)regs;
 187                 next_len = sizeof(*regs);
 188         } else {
 189                 next_frame = next_bp;
 190                 next_len = FRAME_HEADER_SIZE;
 191         }
 192
 193         /* make sure the next frame's data is accessible */
 194         if (!update_stack_state(state, next_frame, next_len)) {
 195                 /*
 196                  * Don't warn on bad regs->bp.  An interrupt in entry code
 197                  * might cause a false positive warning.
 198                  */
 199                 if (state->regs)
 200                         goto the_end;
 201
 202                 goto bad_address;
 203         }
 204
 205         /* Make sure it only unwinds up and doesn't overlap the last frame: */
 206         if (state->stack_info.type == prev_type) {
 207                 if (state->regs && (void *)next_frame < (void *)state->regs + regs_size(state->regs))
 208                         goto bad_address;
 209
 210                 if (state->bp && (void *)next_frame < (void *)state->bp + FRAME_HEADER_SIZE)
 211                         goto bad_address;
 212         }
 213
 214         /* move to the next frame */
 215         if (regs) {
 216                 state->regs = regs;
 217                 state->bp = NULL;
 218         } else {
 219                 state->bp = next_bp;
 220                 state->regs = NULL;
 221         }
 222
 223         return true;
 224
 225 bad_address:
 226         /*
 227          * When unwinding a non-current task, the task might actually be
 228          * running on another CPU, in which case it could be modifying its
 229          * stack while we're reading it.  This is generally not a problem and
 230          * can be ignored as long as the caller understands that unwinding
 231          * another task will not always succeed.
 232          */
 233         if (state->task != current)
 234                 goto the_end;
 235
 236         if (state->regs) {
 237                 printk_deferred_once(KERN_WARNING
 238                         "WARNING: kernel stack regs at %p in %s:%d has bad 'bp' value %p\n",
 239                         state->regs, state->task->comm,
 240                         state->task->pid, next_frame);
 241                 unwind_dump(state, (unsigned long *)state->regs);
 242         } else {
 243                 printk_deferred_once(KERN_WARNING
 244                         "WARNING: kernel stack frame pointer at %p in %s:%d has bad value %p\n",
 245                         state->bp, state->task->comm,
 246                         state->task->pid, next_frame);
 247                 unwind_dump(state, state->bp);
 248         }
 249 the_end:
 250         state->stack_info.type = STACK_TYPE_UNKNOWN;
 251         return false;
 252 }
 253 EXPORT_SYMBOL_GPL(unwind_next_frame);
 254
 255 void __unwind_start(struct unwind_state *state, struct task_struct *task,
 256                     struct pt_regs *regs, unsigned long *first_frame)
 257 {
 258         unsigned long *bp, *frame;
 259         size_t len;
 260
 261         memset(state, 0, sizeof(*state));
 262         state->task = task;
 263
 264         /* don't even attempt to start from user mode regs */
 265         if (regs && user_mode(regs)) {
 266                 state->stack_info.type = STACK_TYPE_UNKNOWN;
 267                 return;
 268         }
 269
 270         /* set up the starting stack frame */
 271         bp = get_frame_pointer(task, regs);
 272         regs = decode_frame_pointer(bp);
 273         if (regs) {
 274                 state->regs = regs;
 275                 frame = (unsigned long *)regs;
 276                 len = sizeof(*regs);
 277         } else {
 278                 state->bp = bp;
 279                 frame = bp;
 280                 len = FRAME_HEADER_SIZE;
 281         }
 282
 283         /* initialize stack info and make sure the frame data is accessible */
 284         get_stack_info(frame, state->task, &state->stack_info,
 285                        &state->stack_mask);
 286         update_stack_state(state, frame, len);
 287
 288         /*
 289          * The caller can provide the address of the first frame directly
 290          * (first_frame) or indirectly (regs->sp) to indicate which stack frame
 291          * to start unwinding at.  Skip ahead until we reach it.
 292          */
 293         while (!unwind_done(state) &&
 294                (!on_stack(&state->stack_info, first_frame, sizeof(long)) ||
 295                         state->bp < first_frame))
 296                 unwind_next_frame(state);
 297 }
 298 EXPORT_SYMBOL_GPL(__unwind_start);