]>
Commit | Line | Data |
---|---|---|
321d628a FG |
1 | From 77f0942d5c0f9adc2a6cdd1f0f17c1c6e631b5a6 Mon Sep 17 00:00:00 2001 |
2 | From: Josh Poimboeuf <jpoimboe@redhat.com> | |
3 | Date: Mon, 4 Dec 2017 15:07:09 +0100 | |
7c7389df | 4 | Subject: [PATCH 139/232] x86/unwinder: Handle stack overflows more gracefully |
321d628a FG |
5 | MIME-Version: 1.0 |
6 | Content-Type: text/plain; charset=UTF-8 | |
7 | Content-Transfer-Encoding: 8bit | |
8 | ||
9 | CVE-2017-5754 | |
10 | ||
11 | There are at least two unwinder bugs hindering the debugging of | |
12 | stack-overflow crashes: | |
13 | ||
14 | - It doesn't deal gracefully with the case where the stack overflows and | |
15 | the stack pointer itself isn't on a valid stack but the | |
16 | to-be-dereferenced data *is*. | |
17 | ||
18 | - The ORC oops dump code doesn't know how to print partial pt_regs, for the | |
19 | case where if we get an interrupt/exception in *early* entry code | |
20 | before the full pt_regs have been saved. | |
21 | ||
22 | Fix both issues. | |
23 | ||
24 | http://lkml.kernel.org/r/20171126024031.uxi4numpbjm5rlbr@treble | |
25 | ||
26 | Signed-off-by: Josh Poimboeuf <jpoimboe@redhat.com> | |
27 | Signed-off-by: Thomas Gleixner <tglx@linutronix.de> | |
28 | Reviewed-by: Borislav Petkov <bpetkov@suse.de> | |
29 | Cc: Andy Lutomirski <luto@kernel.org> | |
30 | Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com> | |
31 | Cc: Borislav Petkov <bp@alien8.de> | |
32 | Cc: Brian Gerst <brgerst@gmail.com> | |
33 | Cc: Dave Hansen <dave.hansen@intel.com> | |
34 | Cc: Dave Hansen <dave.hansen@linux.intel.com> | |
35 | Cc: David Laight <David.Laight@aculab.com> | |
36 | Cc: Denys Vlasenko <dvlasenk@redhat.com> | |
37 | Cc: Eduardo Valentin <eduval@amazon.com> | |
38 | Cc: Greg KH <gregkh@linuxfoundation.org> | |
39 | Cc: H. Peter Anvin <hpa@zytor.com> | |
40 | Cc: Juergen Gross <jgross@suse.com> | |
41 | Cc: Linus Torvalds <torvalds@linux-foundation.org> | |
42 | Cc: Peter Zijlstra <peterz@infradead.org> | |
43 | Cc: Rik van Riel <riel@redhat.com> | |
44 | Cc: Will Deacon <will.deacon@arm.com> | |
45 | Cc: aliguori@amazon.com | |
46 | Cc: daniel.gruss@iaik.tugraz.at | |
47 | Cc: hughd@google.com | |
48 | Cc: keescook@google.com | |
49 | Link: https://lkml.kernel.org/r/20171204150605.071425003@linutronix.de | |
50 | Signed-off-by: Ingo Molnar <mingo@kernel.org> | |
51 | (backported from commit b02fcf9ba1211097754b286043cd87a8b4907e75) | |
52 | Signed-off-by: Andy Whitcroft <apw@canonical.com> | |
53 | Signed-off-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com> | |
54 | (cherry picked from commit 9e51f396b068c3e8495cd130113e2f73b2b1f6b0) | |
55 | Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com> | |
56 | --- | |
57 | arch/x86/include/asm/kdebug.h | 1 + | |
58 | arch/x86/include/asm/unwind.h | 7 ++++ | |
59 | arch/x86/kernel/dumpstack.c | 29 ++++++++++++++-- | |
60 | arch/x86/kernel/process_64.c | 12 +++---- | |
61 | arch/x86/kernel/unwind_orc.c | 78 +++++++++++++++---------------------------- | |
62 | 5 files changed, 67 insertions(+), 60 deletions(-) | |
63 | ||
64 | diff --git a/arch/x86/include/asm/kdebug.h b/arch/x86/include/asm/kdebug.h | |
65 | index 29a594a3b82a..2a7769dd8fa2 100644 | |
66 | --- a/arch/x86/include/asm/kdebug.h | |
67 | +++ b/arch/x86/include/asm/kdebug.h | |
68 | @@ -25,6 +25,7 @@ extern void die(const char *, struct pt_regs *,long); | |
69 | extern int __must_check __die(const char *, struct pt_regs *, long); | |
70 | extern void show_stack_regs(struct pt_regs *regs); | |
71 | extern void __show_regs(struct pt_regs *regs, int all); | |
72 | +extern void show_iret_regs(struct pt_regs *regs); | |
73 | extern unsigned long oops_begin(void); | |
74 | extern void oops_end(unsigned long, struct pt_regs *, int signr); | |
75 | ||
76 | diff --git a/arch/x86/include/asm/unwind.h b/arch/x86/include/asm/unwind.h | |
77 | index 35d67dc7b69f..38fa6154e382 100644 | |
78 | --- a/arch/x86/include/asm/unwind.h | |
79 | +++ b/arch/x86/include/asm/unwind.h | |
80 | @@ -6,6 +6,9 @@ | |
81 | #include <asm/ptrace.h> | |
82 | #include <asm/stacktrace.h> | |
83 | ||
84 | +#define IRET_FRAME_OFFSET (offsetof(struct pt_regs, ip)) | |
85 | +#define IRET_FRAME_SIZE (sizeof(struct pt_regs) - IRET_FRAME_OFFSET) | |
86 | + | |
87 | struct unwind_state { | |
88 | struct stack_info stack_info; | |
89 | unsigned long stack_mask; | |
90 | @@ -51,6 +54,10 @@ void unwind_start(struct unwind_state *state, struct task_struct *task, | |
91 | } | |
92 | ||
93 | #if defined(CONFIG_UNWINDER_ORC) || defined(CONFIG_UNWINDER_FRAME_POINTER) | |
94 | +/* | |
95 | + * WARNING: The entire pt_regs may not be safe to dereference. In some cases, | |
96 | + * only the iret frame registers are accessible. Use with caution! | |
97 | + */ | |
98 | static inline struct pt_regs *unwind_get_entry_regs(struct unwind_state *state) | |
99 | { | |
100 | if (unwind_done(state)) | |
101 | diff --git a/arch/x86/kernel/dumpstack.c b/arch/x86/kernel/dumpstack.c | |
102 | index dbce3cca94cb..695cdce5dfc8 100644 | |
103 | --- a/arch/x86/kernel/dumpstack.c | |
104 | +++ b/arch/x86/kernel/dumpstack.c | |
105 | @@ -50,6 +50,28 @@ static void printk_stack_address(unsigned long address, int reliable, | |
106 | printk("%s %s%pB\n", log_lvl, reliable ? "" : "? ", (void *)address); | |
107 | } | |
108 | ||
109 | +void show_iret_regs(struct pt_regs *regs) | |
110 | +{ | |
111 | + printk(KERN_DEFAULT "RIP: %04x:%pS\n", (int)regs->cs, (void *)regs->ip); | |
112 | + printk(KERN_DEFAULT "RSP: %04x:%016lx EFLAGS: %08lx", (int)regs->ss, | |
113 | + regs->sp, regs->flags); | |
114 | +} | |
115 | + | |
116 | +static void show_regs_safe(struct stack_info *info, struct pt_regs *regs) | |
117 | +{ | |
118 | + if (on_stack(info, regs, sizeof(*regs))) | |
119 | + __show_regs(regs, 0); | |
120 | + else if (on_stack(info, (void *)regs + IRET_FRAME_OFFSET, | |
121 | + IRET_FRAME_SIZE)) { | |
122 | + /* | |
123 | + * When an interrupt or exception occurs in entry code, the | |
124 | + * full pt_regs might not have been saved yet. In that case | |
125 | + * just print the iret frame. | |
126 | + */ | |
127 | + show_iret_regs(regs); | |
128 | + } | |
129 | +} | |
130 | + | |
131 | void show_trace_log_lvl(struct task_struct *task, struct pt_regs *regs, | |
132 | unsigned long *stack, char *log_lvl) | |
133 | { | |
134 | @@ -94,6 +116,9 @@ void show_trace_log_lvl(struct task_struct *task, struct pt_regs *regs, | |
135 | if (stack_name) | |
136 | printk("%s <%s>\n", log_lvl, stack_name); | |
137 | ||
138 | + if (regs) | |
139 | + show_regs_safe(&stack_info, regs); | |
140 | + | |
141 | /* | |
142 | * Scan the stack, printing any text addresses we find. At the | |
143 | * same time, follow proper stack frames with the unwinder. | |
144 | @@ -116,7 +141,7 @@ void show_trace_log_lvl(struct task_struct *task, struct pt_regs *regs, | |
145 | ||
146 | /* | |
147 | * Don't print regs->ip again if it was already printed | |
148 | - * by __show_regs() below. | |
149 | + * by show_regs_safe() below. | |
150 | */ | |
151 | if (regs && stack == ®s->ip) { | |
152 | unwind_next_frame(&state); | |
153 | @@ -154,7 +179,7 @@ void show_trace_log_lvl(struct task_struct *task, struct pt_regs *regs, | |
154 | /* if the frame has entry regs, print them */ | |
155 | regs = unwind_get_entry_regs(&state); | |
156 | if (regs) | |
157 | - __show_regs(regs, 0); | |
158 | + show_regs_safe(&stack_info, regs); | |
159 | } | |
160 | ||
161 | if (stack_name) | |
162 | diff --git a/arch/x86/kernel/process_64.c b/arch/x86/kernel/process_64.c | |
163 | index b08b9b6c40eb..01b119bebb68 100644 | |
164 | --- a/arch/x86/kernel/process_64.c | |
165 | +++ b/arch/x86/kernel/process_64.c | |
166 | @@ -69,10 +69,8 @@ void __show_regs(struct pt_regs *regs, int all) | |
167 | unsigned int fsindex, gsindex; | |
168 | unsigned int ds, cs, es; | |
169 | ||
170 | - printk(KERN_DEFAULT "RIP: %04lx:%pS\n", regs->cs & 0xffff, | |
171 | - (void *)regs->ip); | |
172 | - printk(KERN_DEFAULT "RSP: %04lx:%016lx EFLAGS: %08lx", regs->ss, | |
173 | - regs->sp, regs->flags); | |
174 | + show_iret_regs(regs); | |
175 | + | |
176 | if (regs->orig_ax != -1) | |
177 | pr_cont(" ORIG_RAX: %016lx\n", regs->orig_ax); | |
178 | else | |
179 | @@ -89,6 +87,9 @@ void __show_regs(struct pt_regs *regs, int all) | |
180 | printk(KERN_DEFAULT "R13: %016lx R14: %016lx R15: %016lx\n", | |
181 | regs->r13, regs->r14, regs->r15); | |
182 | ||
183 | + if (!all) | |
184 | + return; | |
185 | + | |
186 | asm("movl %%ds,%0" : "=r" (ds)); | |
187 | asm("movl %%cs,%0" : "=r" (cs)); | |
188 | asm("movl %%es,%0" : "=r" (es)); | |
189 | @@ -99,9 +100,6 @@ void __show_regs(struct pt_regs *regs, int all) | |
190 | rdmsrl(MSR_GS_BASE, gs); | |
191 | rdmsrl(MSR_KERNEL_GS_BASE, shadowgs); | |
192 | ||
193 | - if (!all) | |
194 | - return; | |
195 | - | |
196 | cr0 = read_cr0(); | |
197 | cr2 = read_cr2(); | |
198 | cr3 = __read_cr3(); | |
199 | diff --git a/arch/x86/kernel/unwind_orc.c b/arch/x86/kernel/unwind_orc.c | |
200 | index cea85bfe93f7..702f15f6b5be 100644 | |
201 | --- a/arch/x86/kernel/unwind_orc.c | |
202 | +++ b/arch/x86/kernel/unwind_orc.c | |
203 | @@ -253,22 +253,15 @@ unsigned long *unwind_get_return_address_ptr(struct unwind_state *state) | |
204 | return NULL; | |
205 | } | |
206 | ||
207 | -static bool stack_access_ok(struct unwind_state *state, unsigned long addr, | |
208 | +static bool stack_access_ok(struct unwind_state *state, unsigned long _addr, | |
209 | size_t len) | |
210 | { | |
211 | struct stack_info *info = &state->stack_info; | |
212 | + void *addr = (void *)_addr; | |
213 | ||
214 | - /* | |
215 | - * If the address isn't on the current stack, switch to the next one. | |
216 | - * | |
217 | - * We may have to traverse multiple stacks to deal with the possibility | |
218 | - * that info->next_sp could point to an empty stack and the address | |
219 | - * could be on a subsequent stack. | |
220 | - */ | |
221 | - while (!on_stack(info, (void *)addr, len)) | |
222 | - if (get_stack_info(info->next_sp, state->task, info, | |
223 | - &state->stack_mask)) | |
224 | - return false; | |
225 | + if (!on_stack(info, addr, len) && | |
226 | + (get_stack_info(addr, state->task, info, &state->stack_mask))) | |
227 | + return false; | |
228 | ||
229 | return true; | |
230 | } | |
231 | @@ -283,42 +276,32 @@ static bool deref_stack_reg(struct unwind_state *state, unsigned long addr, | |
232 | return true; | |
233 | } | |
234 | ||
235 | -#define REGS_SIZE (sizeof(struct pt_regs)) | |
236 | -#define SP_OFFSET (offsetof(struct pt_regs, sp)) | |
237 | -#define IRET_REGS_SIZE (REGS_SIZE - offsetof(struct pt_regs, ip)) | |
238 | -#define IRET_SP_OFFSET (SP_OFFSET - offsetof(struct pt_regs, ip)) | |
239 | - | |
240 | static bool deref_stack_regs(struct unwind_state *state, unsigned long addr, | |
241 | - unsigned long *ip, unsigned long *sp, bool full) | |
242 | + unsigned long *ip, unsigned long *sp) | |
243 | { | |
244 | - size_t regs_size = full ? REGS_SIZE : IRET_REGS_SIZE; | |
245 | - size_t sp_offset = full ? SP_OFFSET : IRET_SP_OFFSET; | |
246 | - struct pt_regs *regs = (struct pt_regs *)(addr + regs_size - REGS_SIZE); | |
247 | - | |
248 | - if (IS_ENABLED(CONFIG_X86_64)) { | |
249 | - if (!stack_access_ok(state, addr, regs_size)) | |
250 | - return false; | |
251 | - | |
252 | - *ip = regs->ip; | |
253 | - *sp = regs->sp; | |
254 | + struct pt_regs *regs = (struct pt_regs *)addr; | |
255 | ||
256 | - return true; | |
257 | - } | |
258 | + /* x86-32 support will be more complicated due to the ®s->sp hack */ | |
259 | + BUILD_BUG_ON(IS_ENABLED(CONFIG_X86_32)); | |
260 | ||
261 | - if (!stack_access_ok(state, addr, sp_offset)) | |
262 | + if (!stack_access_ok(state, addr, sizeof(struct pt_regs))) | |
263 | return false; | |
264 | ||
265 | *ip = regs->ip; | |
266 | + *sp = regs->sp; | |
267 | + return true; | |
268 | +} | |
269 | ||
270 | - if (user_mode(regs)) { | |
271 | - if (!stack_access_ok(state, addr + sp_offset, | |
272 | - REGS_SIZE - SP_OFFSET)) | |
273 | - return false; | |
274 | +static bool deref_stack_iret_regs(struct unwind_state *state, unsigned long addr, | |
275 | + unsigned long *ip, unsigned long *sp) | |
276 | +{ | |
277 | + struct pt_regs *regs = (void *)addr - IRET_FRAME_OFFSET; | |
278 | ||
279 | - *sp = regs->sp; | |
280 | - } else | |
281 | - *sp = (unsigned long)®s->sp; | |
282 | + if (!stack_access_ok(state, addr, IRET_FRAME_SIZE)) | |
283 | + return false; | |
284 | ||
285 | + *ip = regs->ip; | |
286 | + *sp = regs->sp; | |
287 | return true; | |
288 | } | |
289 | ||
290 | @@ -327,7 +310,6 @@ bool unwind_next_frame(struct unwind_state *state) | |
291 | unsigned long ip_p, sp, orig_ip, prev_sp = state->sp; | |
292 | enum stack_type prev_type = state->stack_info.type; | |
293 | struct orc_entry *orc; | |
294 | - struct pt_regs *ptregs; | |
295 | bool indirect = false; | |
296 | ||
297 | if (unwind_done(state)) | |
298 | @@ -435,8 +417,8 @@ bool unwind_next_frame(struct unwind_state *state) | |
299 | break; | |
300 | ||
301 | case ORC_TYPE_REGS: | |
302 | - if (!deref_stack_regs(state, sp, &state->ip, &state->sp, true)) { | |
303 | - orc_warn("can't dereference registers at %p for ip %p\n", | |
304 | + if (!deref_stack_regs(state, sp, &state->ip, &state->sp)) { | |
305 | + orc_warn("can't dereference registers at %p for ip %pB\n", | |
306 | (void *)sp, (void *)orig_ip); | |
307 | goto done; | |
308 | } | |
309 | @@ -447,20 +429,14 @@ bool unwind_next_frame(struct unwind_state *state) | |
310 | break; | |
311 | ||
312 | case ORC_TYPE_REGS_IRET: | |
313 | - if (!deref_stack_regs(state, sp, &state->ip, &state->sp, false)) { | |
314 | - orc_warn("can't dereference iret registers at %p for ip %p\n", | |
315 | + if (!deref_stack_iret_regs(state, sp, &state->ip, &state->sp)) { | |
316 | + orc_warn("can't dereference iret registers at %p for ip %pB\n", | |
317 | (void *)sp, (void *)orig_ip); | |
318 | goto done; | |
319 | } | |
320 | ||
321 | - ptregs = container_of((void *)sp, struct pt_regs, ip); | |
322 | - if ((unsigned long)ptregs >= prev_sp && | |
323 | - on_stack(&state->stack_info, ptregs, REGS_SIZE)) { | |
324 | - state->regs = ptregs; | |
325 | - state->full_regs = false; | |
326 | - } else | |
327 | - state->regs = NULL; | |
328 | - | |
329 | + state->regs = (void *)sp - IRET_FRAME_OFFSET; | |
330 | + state->full_regs = false; | |
331 | state->signal = true; | |
332 | break; | |
333 | ||
334 | -- | |
335 | 2.14.2 | |
336 |