patches/kernel/0139-x86-unwinder-Handle-stack-overflows-more-gracefully.patch

   1 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
   2 From: Josh Poimboeuf <jpoimboe@redhat.com>
   3 Date: Mon, 4 Dec 2017 15:07:09 +0100
   4 Subject: [PATCH] x86/unwinder: Handle stack overflows more gracefully
   5 MIME-Version: 1.0
   6 Content-Type: text/plain; charset=UTF-8
   7 Content-Transfer-Encoding: 8bit
   8
   9 CVE-2017-5754
  10
  11 There are at least two unwinder bugs hindering the debugging of
  12 stack-overflow crashes:
  13
  14 - It doesn't deal gracefully with the case where the stack overflows and
  15   the stack pointer itself isn't on a valid stack but the
  16   to-be-dereferenced data *is*.
  17
  18 - The ORC oops dump code doesn't know how to print partial pt_regs, for the
  19   case where if we get an interrupt/exception in *early* entry code
  20   before the full pt_regs have been saved.
  21
  22 Fix both issues.
  23
  24 http://lkml.kernel.org/r/20171126024031.uxi4numpbjm5rlbr@treble
  25
  26 Signed-off-by: Josh Poimboeuf <jpoimboe@redhat.com>
  27 Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
  28 Reviewed-by: Borislav Petkov <bpetkov@suse.de>
  29 Cc: Andy Lutomirski <luto@kernel.org>
  30 Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
  31 Cc: Borislav Petkov <bp@alien8.de>
  32 Cc: Brian Gerst <brgerst@gmail.com>
  33 Cc: Dave Hansen <dave.hansen@intel.com>
  34 Cc: Dave Hansen <dave.hansen@linux.intel.com>
  35 Cc: David Laight <David.Laight@aculab.com>
  36 Cc: Denys Vlasenko <dvlasenk@redhat.com>
  37 Cc: Eduardo Valentin <eduval@amazon.com>
  38 Cc: Greg KH <gregkh@linuxfoundation.org>
  39 Cc: H. Peter Anvin <hpa@zytor.com>
  40 Cc: Juergen Gross <jgross@suse.com>
  41 Cc: Linus Torvalds <torvalds@linux-foundation.org>
  42 Cc: Peter Zijlstra <peterz@infradead.org>
  43 Cc: Rik van Riel <riel@redhat.com>
  44 Cc: Will Deacon <will.deacon@arm.com>
  45 Cc: aliguori@amazon.com
  46 Cc: daniel.gruss@iaik.tugraz.at
  47 Cc: hughd@google.com
  48 Cc: keescook@google.com
  49 Link: https://lkml.kernel.org/r/20171204150605.071425003@linutronix.de
  50 Signed-off-by: Ingo Molnar <mingo@kernel.org>
  51 (backported from commit b02fcf9ba1211097754b286043cd87a8b4907e75)
  52 Signed-off-by: Andy Whitcroft <apw@canonical.com>
  53 Signed-off-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com>
  54 (cherry picked from commit 9e51f396b068c3e8495cd130113e2f73b2b1f6b0)
  55 Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
  56 ---
  57  arch/x86/include/asm/kdebug.h |  1 +
  58  arch/x86/include/asm/unwind.h |  7 ++++
  59  arch/x86/kernel/dumpstack.c   | 29 ++++++++++++++--
  60  arch/x86/kernel/process_64.c  | 12 +++----
  61  arch/x86/kernel/unwind_orc.c  | 78 +++++++++++++++----------------------------
  62  5 files changed, 67 insertions(+), 60 deletions(-)
  63
  64 diff --git a/arch/x86/include/asm/kdebug.h b/arch/x86/include/asm/kdebug.h
  65 index 29a594a3b82a..2a7769dd8fa2 100644
  66 --- a/arch/x86/include/asm/kdebug.h
  67 +++ b/arch/x86/include/asm/kdebug.h
  68 @@ -25,6 +25,7 @@ extern void die(const char *, struct pt_regs *,long);
  69  extern int __must_check __die(const char *, struct pt_regs *, long);
  70  extern void show_stack_regs(struct pt_regs *regs);
  71  extern void __show_regs(struct pt_regs *regs, int all);
  72 +extern void show_iret_regs(struct pt_regs *regs);
  73  extern unsigned long oops_begin(void);
  74  extern void oops_end(unsigned long, struct pt_regs *, int signr);
  75
  76 diff --git a/arch/x86/include/asm/unwind.h b/arch/x86/include/asm/unwind.h
  77 index 35d67dc7b69f..38fa6154e382 100644
  78 --- a/arch/x86/include/asm/unwind.h
  79 +++ b/arch/x86/include/asm/unwind.h
  80 @@ -6,6 +6,9 @@
  81  #include <asm/ptrace.h>
  82  #include <asm/stacktrace.h>
  83
  84 +#define IRET_FRAME_OFFSET (offsetof(struct pt_regs, ip))
  85 +#define IRET_FRAME_SIZE   (sizeof(struct pt_regs) - IRET_FRAME_OFFSET)
  86 +
  87  struct unwind_state {
  88         struct stack_info stack_info;
  89         unsigned long stack_mask;
  90 @@ -51,6 +54,10 @@ void unwind_start(struct unwind_state *state, struct task_struct *task,
  91  }
  92
  93  #if defined(CONFIG_UNWINDER_ORC) || defined(CONFIG_UNWINDER_FRAME_POINTER)
  94 +/*
  95 + * WARNING: The entire pt_regs may not be safe to dereference.  In some cases,
  96 + * only the iret frame registers are accessible.  Use with caution!
  97 + */
  98  static inline struct pt_regs *unwind_get_entry_regs(struct unwind_state *state)
  99  {
 100         if (unwind_done(state))
 101 diff --git a/arch/x86/kernel/dumpstack.c b/arch/x86/kernel/dumpstack.c
 102 index dbce3cca94cb..695cdce5dfc8 100644
 103 --- a/arch/x86/kernel/dumpstack.c
 104 +++ b/arch/x86/kernel/dumpstack.c
 105 @@ -50,6 +50,28 @@ static void printk_stack_address(unsigned long address, int reliable,
 106         printk("%s %s%pB\n", log_lvl, reliable ? "" : "? ", (void *)address);
 107  }
 108
 109 +void show_iret_regs(struct pt_regs *regs)
 110 +{
 111 +       printk(KERN_DEFAULT "RIP: %04x:%pS\n", (int)regs->cs, (void *)regs->ip);
 112 +       printk(KERN_DEFAULT "RSP: %04x:%016lx EFLAGS: %08lx", (int)regs->ss,
 113 +               regs->sp, regs->flags);
 114 +}
 115 +
 116 +static void show_regs_safe(struct stack_info *info, struct pt_regs *regs)
 117 +{
 118 +       if (on_stack(info, regs, sizeof(*regs)))
 119 +               __show_regs(regs, 0);
 120 +       else if (on_stack(info, (void *)regs + IRET_FRAME_OFFSET,
 121 +                         IRET_FRAME_SIZE)) {
 122 +               /*
 123 +                * When an interrupt or exception occurs in entry code, the
 124 +                * full pt_regs might not have been saved yet.  In that case
 125 +                * just print the iret frame.
 126 +                */
 127 +               show_iret_regs(regs);
 128 +       }
 129 +}
 130 +
 131  void show_trace_log_lvl(struct task_struct *task, struct pt_regs *regs,
 132                         unsigned long *stack, char *log_lvl)
 133  {
 134 @@ -94,6 +116,9 @@ void show_trace_log_lvl(struct task_struct *task, struct pt_regs *regs,
 135                 if (stack_name)
 136                         printk("%s <%s>\n", log_lvl, stack_name);
 137
 138 +               if (regs)
 139 +                       show_regs_safe(&stack_info, regs);
 140 +
 141                 /*
 142                  * Scan the stack, printing any text addresses we find.  At the
 143                  * same time, follow proper stack frames with the unwinder.
 144 @@ -116,7 +141,7 @@ void show_trace_log_lvl(struct task_struct *task, struct pt_regs *regs,
 145
 146                         /*
 147                          * Don't print regs->ip again if it was already printed
 148 -                        * by __show_regs() below.
 149 +                        * by show_regs_safe() below.
 150                          */
 151                         if (regs && stack == &regs->ip) {
 152                                 unwind_next_frame(&state);
 153 @@ -154,7 +179,7 @@ void show_trace_log_lvl(struct task_struct *task, struct pt_regs *regs,
 154                         /* if the frame has entry regs, print them */
 155                         regs = unwind_get_entry_regs(&state);
 156                         if (regs)
 157 -                               __show_regs(regs, 0);
 158 +                               show_regs_safe(&stack_info, regs);
 159                 }
 160
 161                 if (stack_name)
 162 diff --git a/arch/x86/kernel/process_64.c b/arch/x86/kernel/process_64.c
 163 index b08b9b6c40eb..01b119bebb68 100644
 164 --- a/arch/x86/kernel/process_64.c
 165 +++ b/arch/x86/kernel/process_64.c
 166 @@ -69,10 +69,8 @@ void __show_regs(struct pt_regs *regs, int all)
 167         unsigned int fsindex, gsindex;
 168         unsigned int ds, cs, es;
 169
 170 -       printk(KERN_DEFAULT "RIP: %04lx:%pS\n", regs->cs & 0xffff,
 171 -               (void *)regs->ip);
 172 -       printk(KERN_DEFAULT "RSP: %04lx:%016lx EFLAGS: %08lx", regs->ss,
 173 -               regs->sp, regs->flags);
 174 +       show_iret_regs(regs);
 175 +
 176         if (regs->orig_ax != -1)
 177                 pr_cont(" ORIG_RAX: %016lx\n", regs->orig_ax);
 178         else
 179 @@ -89,6 +87,9 @@ void __show_regs(struct pt_regs *regs, int all)
 180         printk(KERN_DEFAULT "R13: %016lx R14: %016lx R15: %016lx\n",
 181                regs->r13, regs->r14, regs->r15);
 182
 183 +       if (!all)
 184 +               return;
 185 +
 186         asm("movl %%ds,%0" : "=r" (ds));
 187         asm("movl %%cs,%0" : "=r" (cs));
 188         asm("movl %%es,%0" : "=r" (es));
 189 @@ -99,9 +100,6 @@ void __show_regs(struct pt_regs *regs, int all)
 190         rdmsrl(MSR_GS_BASE, gs);
 191         rdmsrl(MSR_KERNEL_GS_BASE, shadowgs);
 192
 193 -       if (!all)
 194 -               return;
 195 -
 196         cr0 = read_cr0();
 197         cr2 = read_cr2();
 198         cr3 = __read_cr3();
 199 diff --git a/arch/x86/kernel/unwind_orc.c b/arch/x86/kernel/unwind_orc.c
 200 index cea85bfe93f7..702f15f6b5be 100644
 201 --- a/arch/x86/kernel/unwind_orc.c
 202 +++ b/arch/x86/kernel/unwind_orc.c
 203 @@ -253,22 +253,15 @@ unsigned long *unwind_get_return_address_ptr(struct unwind_state *state)
 204         return NULL;
 205  }
 206
 207 -static bool stack_access_ok(struct unwind_state *state, unsigned long addr,
 208 +static bool stack_access_ok(struct unwind_state *state, unsigned long _addr,
 209                             size_t len)
 210  {
 211         struct stack_info *info = &state->stack_info;
 212 +       void *addr = (void *)_addr;
 213
 214 -       /*
 215 -        * If the address isn't on the current stack, switch to the next one.
 216 -        *
 217 -        * We may have to traverse multiple stacks to deal with the possibility
 218 -        * that info->next_sp could point to an empty stack and the address
 219 -        * could be on a subsequent stack.
 220 -        */
 221 -       while (!on_stack(info, (void *)addr, len))
 222 -               if (get_stack_info(info->next_sp, state->task, info,
 223 -                                  &state->stack_mask))
 224 -                       return false;
 225 +       if (!on_stack(info, addr, len) &&
 226 +           (get_stack_info(addr, state->task, info, &state->stack_mask)))
 227 +               return false;
 228
 229         return true;
 230  }
 231 @@ -283,42 +276,32 @@ static bool deref_stack_reg(struct unwind_state *state, unsigned long addr,
 232         return true;
 233  }
 234
 235 -#define REGS_SIZE (sizeof(struct pt_regs))
 236 -#define SP_OFFSET (offsetof(struct pt_regs, sp))
 237 -#define IRET_REGS_SIZE (REGS_SIZE - offsetof(struct pt_regs, ip))
 238 -#define IRET_SP_OFFSET (SP_OFFSET - offsetof(struct pt_regs, ip))
 239 -
 240  static bool deref_stack_regs(struct unwind_state *state, unsigned long addr,
 241 -                            unsigned long *ip, unsigned long *sp, bool full)
 242 +                            unsigned long *ip, unsigned long *sp)
 243  {
 244 -       size_t regs_size = full ? REGS_SIZE : IRET_REGS_SIZE;
 245 -       size_t sp_offset = full ? SP_OFFSET : IRET_SP_OFFSET;
 246 -       struct pt_regs *regs = (struct pt_regs *)(addr + regs_size - REGS_SIZE);
 247 -
 248 -       if (IS_ENABLED(CONFIG_X86_64)) {
 249 -               if (!stack_access_ok(state, addr, regs_size))
 250 -                       return false;
 251 -
 252 -               *ip = regs->ip;
 253 -               *sp = regs->sp;
 254 +       struct pt_regs *regs = (struct pt_regs *)addr;
 255
 256 -               return true;
 257 -       }
 258 +       /* x86-32 support will be more complicated due to the &regs->sp hack */
 259 +       BUILD_BUG_ON(IS_ENABLED(CONFIG_X86_32));
 260
 261 -       if (!stack_access_ok(state, addr, sp_offset))
 262 +       if (!stack_access_ok(state, addr, sizeof(struct pt_regs)))
 263                 return false;
 264
 265         *ip = regs->ip;
 266 +       *sp = regs->sp;
 267 +       return true;
 268 +}
 269
 270 -       if (user_mode(regs)) {
 271 -               if (!stack_access_ok(state, addr + sp_offset,
 272 -                                    REGS_SIZE - SP_OFFSET))
 273 -                       return false;
 274 +static bool deref_stack_iret_regs(struct unwind_state *state, unsigned long addr,
 275 +                                 unsigned long *ip, unsigned long *sp)
 276 +{
 277 +       struct pt_regs *regs = (void *)addr - IRET_FRAME_OFFSET;
 278
 279 -               *sp = regs->sp;
 280 -       } else
 281 -               *sp = (unsigned long)&regs->sp;
 282 +       if (!stack_access_ok(state, addr, IRET_FRAME_SIZE))
 283 +               return false;
 284
 285 +       *ip = regs->ip;
 286 +       *sp = regs->sp;
 287         return true;
 288  }
 289
 290 @@ -327,7 +310,6 @@ bool unwind_next_frame(struct unwind_state *state)
 291         unsigned long ip_p, sp, orig_ip, prev_sp = state->sp;
 292         enum stack_type prev_type = state->stack_info.type;
 293         struct orc_entry *orc;
 294 -       struct pt_regs *ptregs;
 295         bool indirect = false;
 296
 297         if (unwind_done(state))
 298 @@ -435,8 +417,8 @@ bool unwind_next_frame(struct unwind_state *state)
 299                 break;
 300
 301         case ORC_TYPE_REGS:
 302 -               if (!deref_stack_regs(state, sp, &state->ip, &state->sp, true)) {
 303 -                       orc_warn("can't dereference registers at %p for ip %p\n",
 304 +               if (!deref_stack_regs(state, sp, &state->ip, &state->sp)) {
 305 +                       orc_warn("can't dereference registers at %p for ip %pB\n",
 306                                  (void *)sp, (void *)orig_ip);
 307                         goto done;
 308                 }
 309 @@ -447,20 +429,14 @@ bool unwind_next_frame(struct unwind_state *state)
 310                 break;
 311
 312         case ORC_TYPE_REGS_IRET:
 313 -               if (!deref_stack_regs(state, sp, &state->ip, &state->sp, false)) {
 314 -                       orc_warn("can't dereference iret registers at %p for ip %p\n",
 315 +               if (!deref_stack_iret_regs(state, sp, &state->ip, &state->sp)) {
 316 +                       orc_warn("can't dereference iret registers at %p for ip %pB\n",
 317                                  (void *)sp, (void *)orig_ip);
 318                         goto done;
 319                 }
 320
 321 -               ptregs = container_of((void *)sp, struct pt_regs, ip);
 322 -               if ((unsigned long)ptregs >= prev_sp &&
 323 -                   on_stack(&state->stack_info, ptregs, REGS_SIZE)) {
 324 -                       state->regs = ptregs;
 325 -                       state->full_regs = false;
 326 -               } else
 327 -                       state->regs = NULL;
 328 -
 329 +               state->regs = (void *)sp - IRET_FRAME_OFFSET;
 330 +               state->full_regs = false;
 331                 state->signal = true;
 332                 break;
 333
 334 --
 335 2.14.2
 336