1 #include <linux/sched.h>
2 #include <linux/sched/task.h>
3 #include <linux/sched/task_stack.h>
4 #include <asm/ptrace.h>
5 #include <asm/bitops.h>
6 #include <asm/stacktrace.h>
7 #include <asm/unwind.h>
9 #define FRAME_HEADER_SIZE (sizeof(long) * 2)
12 * This disables KASAN checking when reading a value from another task's stack,
13 * since the other task could be running on another CPU and could have poisoned
14 * the stack in the meantime.
16 #define READ_ONCE_TASK_STACK(task, x) \
19 if (task == current) \
22 val = READ_ONCE_NOCHECK(x); \
26 static void unwind_dump(struct unwind_state
*state
, unsigned long *sp
)
28 static bool dumped_before
= false;
29 bool prev_zero
, zero
= false;
37 printk_deferred("unwind stack type:%d next_sp:%p mask:%lx graph_idx:%d\n",
38 state
->stack_info
.type
, state
->stack_info
.next_sp
,
39 state
->stack_mask
, state
->graph_idx
);
41 for (sp
= state
->orig_sp
; sp
< state
->stack_info
.end
; sp
++) {
42 word
= READ_ONCE_NOCHECK(*sp
);
49 printk_deferred("%p: %016x ...\n", sp
, 0);
53 printk_deferred("%p: %016lx (%pB)\n", sp
, word
, (void *)word
);
57 unsigned long unwind_get_return_address(struct unwind_state
*state
)
60 unsigned long *addr_p
= unwind_get_return_address_ptr(state
);
62 if (unwind_done(state
))
65 if (state
->regs
&& user_mode(state
->regs
))
68 addr
= READ_ONCE_TASK_STACK(state
->task
, *addr_p
);
69 addr
= ftrace_graph_ret_addr(state
->task
, &state
->graph_idx
, addr
,
72 return __kernel_text_address(addr
) ? addr
: 0;
74 EXPORT_SYMBOL_GPL(unwind_get_return_address
);
76 static size_t regs_size(struct pt_regs
*regs
)
78 /* x86_32 regs from kernel mode are two words shorter: */
79 if (IS_ENABLED(CONFIG_X86_32
) && !user_mode(regs
))
80 return sizeof(*regs
) - 2*sizeof(long);
85 static bool is_last_task_frame(struct unwind_state
*state
)
87 unsigned long bp
= (unsigned long)state
->bp
;
88 unsigned long regs
= (unsigned long)task_pt_regs(state
->task
);
91 * We have to check for the last task frame at two different locations
92 * because gcc can occasionally decide to realign the stack pointer and
93 * change the offset of the stack frame by a word in the prologue of a
94 * function called by head/entry code.
96 return bp
== regs
- FRAME_HEADER_SIZE
||
97 bp
== regs
- FRAME_HEADER_SIZE
- sizeof(long);
101 * This determines if the frame pointer actually contains an encoded pointer to
102 * pt_regs on the stack. See ENCODE_FRAME_POINTER.
104 static struct pt_regs
*decode_frame_pointer(unsigned long *bp
)
106 unsigned long regs
= (unsigned long)bp
;
111 return (struct pt_regs
*)(regs
& ~0x1);
114 static bool update_stack_state(struct unwind_state
*state
, void *addr
,
117 struct stack_info
*info
= &state
->stack_info
;
118 enum stack_type orig_type
= info
->type
;
121 * If addr isn't on the current stack, switch to the next one.
123 * We may have to traverse multiple stacks to deal with the possibility
124 * that 'info->next_sp' could point to an empty stack and 'addr' could
125 * be on a subsequent stack.
127 while (!on_stack(info
, addr
, len
))
128 if (get_stack_info(info
->next_sp
, state
->task
, info
,
132 if (!state
->orig_sp
|| info
->type
!= orig_type
)
133 state
->orig_sp
= addr
;
138 bool unwind_next_frame(struct unwind_state
*state
)
140 struct pt_regs
*regs
;
141 unsigned long *next_bp
, *next_frame
;
143 enum stack_type prev_type
= state
->stack_info
.type
;
145 if (unwind_done(state
))
148 /* have we reached the end? */
149 if (state
->regs
&& user_mode(state
->regs
))
152 if (is_last_task_frame(state
)) {
153 regs
= task_pt_regs(state
->task
);
156 * kthreads (other than the boot CPU's idle thread) have some
157 * partial regs at the end of their stack which were placed
158 * there by copy_thread_tls(). But the regs don't have any
159 * useful information, so we can skip them.
161 * This user_mode() check is slightly broader than a PF_KTHREAD
162 * check because it also catches the awkward situation where a
163 * newly forked kthread transitions into a user task by calling
164 * do_execve(), which eventually clears PF_KTHREAD.
166 if (!user_mode(regs
))
170 * We're almost at the end, but not quite: there's still the
171 * syscall regs frame. Entry code doesn't encode the regs
172 * pointer for syscalls, so we have to set it manually.
179 /* get the next frame pointer */
181 next_bp
= (unsigned long *)state
->regs
->bp
;
183 next_bp
= (unsigned long *)READ_ONCE_TASK_STACK(state
->task
,*state
->bp
);
185 /* is the next frame pointer an encoded pointer to pt_regs? */
186 regs
= decode_frame_pointer(next_bp
);
188 next_frame
= (unsigned long *)regs
;
189 next_len
= sizeof(*regs
);
191 next_frame
= next_bp
;
192 next_len
= FRAME_HEADER_SIZE
;
195 /* make sure the next frame's data is accessible */
196 if (!update_stack_state(state
, next_frame
, next_len
)) {
198 * Don't warn on bad regs->bp. An interrupt in entry code
199 * might cause a false positive warning.
207 /* Make sure it only unwinds up and doesn't overlap the last frame: */
208 if (state
->stack_info
.type
== prev_type
) {
209 if (state
->regs
&& (void *)next_frame
< (void *)state
->regs
+ regs_size(state
->regs
))
212 if (state
->bp
&& (void *)next_frame
< (void *)state
->bp
+ FRAME_HEADER_SIZE
)
216 /* move to the next frame */
229 * When unwinding a non-current task, the task might actually be
230 * running on another CPU, in which case it could be modifying its
231 * stack while we're reading it. This is generally not a problem and
232 * can be ignored as long as the caller understands that unwinding
233 * another task will not always succeed.
235 if (state
->task
!= current
)
239 printk_deferred_once(KERN_WARNING
240 "WARNING: kernel stack regs at %p in %s:%d has bad 'bp' value %p\n",
241 state
->regs
, state
->task
->comm
,
242 state
->task
->pid
, next_frame
);
243 unwind_dump(state
, (unsigned long *)state
->regs
);
245 printk_deferred_once(KERN_WARNING
246 "WARNING: kernel stack frame pointer at %p in %s:%d has bad value %p\n",
247 state
->bp
, state
->task
->comm
,
248 state
->task
->pid
, next_frame
);
249 unwind_dump(state
, state
->bp
);
252 state
->stack_info
.type
= STACK_TYPE_UNKNOWN
;
255 EXPORT_SYMBOL_GPL(unwind_next_frame
);
257 void __unwind_start(struct unwind_state
*state
, struct task_struct
*task
,
258 struct pt_regs
*regs
, unsigned long *first_frame
)
260 unsigned long *bp
, *frame
;
263 memset(state
, 0, sizeof(*state
));
266 /* don't even attempt to start from user mode regs */
267 if (regs
&& user_mode(regs
)) {
268 state
->stack_info
.type
= STACK_TYPE_UNKNOWN
;
272 /* set up the starting stack frame */
273 bp
= get_frame_pointer(task
, regs
);
274 regs
= decode_frame_pointer(bp
);
277 frame
= (unsigned long *)regs
;
282 len
= FRAME_HEADER_SIZE
;
285 /* initialize stack info and make sure the frame data is accessible */
286 get_stack_info(frame
, state
->task
, &state
->stack_info
,
288 update_stack_state(state
, frame
, len
);
291 * The caller can provide the address of the first frame directly
292 * (first_frame) or indirectly (regs->sp) to indicate which stack frame
293 * to start unwinding at. Skip ahead until we reach it.
295 while (!unwind_done(state
) &&
296 (!on_stack(&state
->stack_info
, first_frame
, sizeof(long)) ||
297 state
->bp
< first_frame
))
298 unwind_next_frame(state
);
300 EXPORT_SYMBOL_GPL(__unwind_start
);