Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1432117
| From | Brian Gerst <brgerst@gmail.com> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | Re: [PATCH v4 15/29] x86/mm/64: Enable vmapped stacks |
| Date | 2016-06-27 17:20 +0200 |
| Message-ID | <rOGul-20Y-9@gated-at.bofh.it> (permalink) |
| References | <rOqfT-8f8-5@gated-at.bofh.it> <rOqpA-5R-13@gated-at.bofh.it> <rOGkF-1Xk-17@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
On Mon, Jun 27, 2016 at 11:01 AM, Brian Gerst <brgerst@gmail.com> wrote:
> On Sun, Jun 26, 2016 at 5:55 PM, Andy Lutomirski <luto@kernel.org> wrote:
>> This allows x86_64 kernels to enable vmapped stacks. There are a
>> couple of interesting bits.
>>
>> First, x86 lazily faults in top-level paging entries for the vmalloc
>> area. This won't work if we get a page fault while trying to access
>> the stack: the CPU will promote it to a double-fault and we'll die.
>> To avoid this problem, probe the new stack when switching stacks and
>> forcibly populate the pgd entry for the stack when switching mms.
>>
>> Second, once we have guard pages around the stack, we'll want to
>> detect and handle stack overflow.
>>
>> I didn't enable it on x86_32. We'd need to rework the double-fault
>> code a bit and I'm concerned about running out of vmalloc virtual
>> addresses under some workloads.
>>
>> This patch, by itself, will behave somewhat erratically when the
>> stack overflows while RSP is still more than a few tens of bytes
>> above the bottom of the stack. Specifically, we'll get #PF and make
>> it to no_context and an oops without triggering a double-fault, and
>> no_context doesn't know about stack overflows. The next patch will
>> improve that case.
>>
>> Signed-off-by: Andy Lutomirski <luto@kernel.org>
>> ---
>> arch/x86/Kconfig | 1 +
>> arch/x86/include/asm/switch_to.h | 28 +++++++++++++++++++++++++++-
>> arch/x86/kernel/traps.c | 32 ++++++++++++++++++++++++++++++++
>> arch/x86/mm/tlb.c | 15 +++++++++++++++
>> 4 files changed, 75 insertions(+), 1 deletion(-)
>>
>> diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
>> index d9a94da0c29f..afdcf96ef109 100644
>> --- a/arch/x86/Kconfig
>> +++ b/arch/x86/Kconfig
>> @@ -92,6 +92,7 @@ config X86
>> select HAVE_ARCH_TRACEHOOK
>> select HAVE_ARCH_TRANSPARENT_HUGEPAGE
>> select HAVE_EBPF_JIT if X86_64
>> + select HAVE_ARCH_VMAP_STACK if X86_64
>> select HAVE_CC_STACKPROTECTOR
>> select HAVE_CMPXCHG_DOUBLE
>> select HAVE_CMPXCHG_LOCAL
>> diff --git a/arch/x86/include/asm/switch_to.h b/arch/x86/include/asm/switch_to.h
>> index 8f321a1b03a1..14e4b20f0aaf 100644
>> --- a/arch/x86/include/asm/switch_to.h
>> +++ b/arch/x86/include/asm/switch_to.h
>> @@ -8,6 +8,28 @@ struct tss_struct;
>> void __switch_to_xtra(struct task_struct *prev_p, struct task_struct *next_p,
>> struct tss_struct *tss);
>>
>> +/* This runs runs on the previous thread's stack. */
>> +static inline void prepare_switch_to(struct task_struct *prev,
>> + struct task_struct *next)
>> +{
>> +#ifdef CONFIG_VMAP_STACK
>> + /*
>> + * If we switch to a stack that has a top-level paging entry
>> + * that is not present in the current mm, the resulting #PF will
>> + * will be promoted to a double-fault and we'll panic. Probe
>> + * the new stack now so that vmalloc_fault can fix up the page
>> + * tables if needed. This can only happen if we use a stack
>> + * in vmap space.
>> + *
>> + * We assume that the stack is aligned so that it never spans
>> + * more than one top-level paging entry.
>> + *
>> + * To minimize cache pollution, just follow the stack pointer.
>> + */
>> + READ_ONCE(*(unsigned char *)next->thread.sp);
>> +#endif
>> +}
>> +
>> #ifdef CONFIG_X86_32
>>
>> #ifdef CONFIG_CC_STACKPROTECTOR
>> @@ -39,6 +61,8 @@ do { \
>> */ \
>> unsigned long ebx, ecx, edx, esi, edi; \
>> \
>> + prepare_switch_to(prev, next); \
>> + \
>> asm volatile("pushl %%ebp\n\t" /* save EBP */ \
>> "movl %%esp,%[prev_sp]\n\t" /* save ESP */ \
>> "movl %[next_sp],%%esp\n\t" /* restore ESP */ \
>> @@ -103,7 +127,9 @@ do { \
>> * clean in kernel mode, with the possible exception of IOPL. Kernel IOPL
>> * has no effect.
>> */
>> -#define switch_to(prev, next, last) \
>> +#define switch_to(prev, next, last) \
>> + prepare_switch_to(prev, next); \
>> + \
>> asm volatile(SAVE_CONTEXT \
>> "movq %%rsp,%P[threadrsp](%[prev])\n\t" /* save RSP */ \
>> "movq %P[threadrsp](%[next]),%%rsp\n\t" /* restore RSP */ \
>> diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c
>> index 00f03d82e69a..9cb7ea781176 100644
>> --- a/arch/x86/kernel/traps.c
>> +++ b/arch/x86/kernel/traps.c
>> @@ -292,12 +292,30 @@ DO_ERROR(X86_TRAP_NP, SIGBUS, "segment not present", segment_not_present)
>> DO_ERROR(X86_TRAP_SS, SIGBUS, "stack segment", stack_segment)
>> DO_ERROR(X86_TRAP_AC, SIGBUS, "alignment check", alignment_check)
>>
>> +#ifdef CONFIG_VMAP_STACK
>> +static void __noreturn handle_stack_overflow(const char *message,
>> + struct pt_regs *regs,
>> + unsigned long fault_address)
>> +{
>> + printk(KERN_EMERG "BUG: stack guard page was hit at %p (stack is %p..%p)\n",
>> + (void *)fault_address, current->stack,
>> + (char *)current->stack + THREAD_SIZE - 1);
>> + die(message, regs, 0);
>> +
>> + /* Be absolutely certain we don't return. */
>> + panic(message);
>> +}
>> +#endif
>> +
>> #ifdef CONFIG_X86_64
>> /* Runs on IST stack */
>> dotraplinkage void do_double_fault(struct pt_regs *regs, long error_code)
>> {
>> static const char str[] = "double fault";
>> struct task_struct *tsk = current;
>> +#ifdef CONFIG_VMAP_STACK
>> + unsigned long cr2;
>> +#endif
>>
>> #ifdef CONFIG_X86_ESPFIX64
>> extern unsigned char native_irq_return_iret[];
>> @@ -332,6 +350,20 @@ dotraplinkage void do_double_fault(struct pt_regs *regs, long error_code)
>> tsk->thread.error_code = error_code;
>> tsk->thread.trap_nr = X86_TRAP_DF;
>>
>> +#ifdef CONFIG_VMAP_STACK
>> + /*
>> + * If we overflow the stack into a guard page, the CPU will fail
>> + * to deliver #PF and will send #DF instead. CR2 will contain
>> + * the linear address of the second fault, which will be in the
>> + * guard page below the bottom of the stack.
>> + */
>> + cr2 = read_cr2();
>> + if ((unsigned long)tsk->stack - 1 - cr2 < PAGE_SIZE)
>> + handle_stack_overflow(
>> + "kernel stack overflow (double-fault)",
>> + regs, cr2);
>> +#endif
>
> Is there any other way to tell if this was from a page fault? If it
> wasn't a page fault then CR2 is undefined.
I guess it doesn't really matter, since the fault is fatal either way.
The error message might be incorrect though.
--
Brian Gerst
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
[PATCH v4 00/29] virtually mapped stacks and thread_info cleanup Andy Lutomirski <luto@kernel.org> - 2016-06-27 00:00 +0200
[PATCH v4 07/29] mm: Fix memcg stack accounting for sub-page stacks Andy Lutomirski <luto@kernel.org> - 2016-06-27 00:00 +0200
[PATCH v4 24/29] x86/entry: Get rid of pt_regs_to_thread_info() Andy Lutomirski <luto@kernel.org> - 2016-06-27 00:00 +0200
[PATCH v4 10/29] x86/die: Don't try to recover from an OOPS on a non-default stack Andy Lutomirski <luto@kernel.org> - 2016-06-27 00:00 +0200
Re: [PATCH v4 10/29] x86/die: Don't try to recover from an OOPS on a non-default stack Borislav Petkov <bp@alien8.de> - 2016-07-02 19:30 +0200
Re: [PATCH v4 10/29] x86/die: Don't try to recover from an OOPS on a non-default stack Josh Poimboeuf <jpoimboe@redhat.com> - 2016-07-02 20:40 +0200
Re: [PATCH v4 10/29] x86/die: Don't try to recover from an OOPS on a non-default stack Borislav Petkov <bp@alien8.de> - 2016-07-03 11:50 +0200
Re: [PATCH v4 10/29] x86/die: Don't try to recover from an OOPS on a non-default stack Andy Lutomirski <luto@amacapital.net> - 2016-07-03 16:30 +0200
Re: [PATCH v4 10/29] x86/die: Don't try to recover from an OOPS on a non-default stack Borislav Petkov <bp@alien8.de> - 2016-07-03 20:50 +0200
[PATCH v4 12/29] x86/dumpstack: When dumping stack bytes due to OOPS, start with regs->sp Andy Lutomirski <luto@kernel.org> - 2016-06-27 00:00 +0200
[PATCH v4 06/29] mm: Track NR_KERNEL_STACK in KiB instead of number of stacks Andy Lutomirski <luto@kernel.org> - 2016-06-27 00:00 +0200
[PATCH v4 14/29] x86/dumpstack/64: Handle faults when printing the "Stack:" part of an OOPS Andy Lutomirski <luto@kernel.org> - 2016-06-27 00:00 +0200
[PATCH v4 26/29] sched: Allow putting thread_info into task_struct Andy Lutomirski <luto@kernel.org> - 2016-06-27 00:00 +0200
[PATCH v4 08/29] dma-api: Teach the "DMA-from-stack" check about vmapped stacks Andy Lutomirski <luto@kernel.org> - 2016-06-27 00:00 +0200
Re: [PATCH v4 08/29] dma-api: Teach the "DMA-from-stack" check about vmapped stacks Borislav Petkov <bp@alien8.de> - 2016-06-30 21:40 +0200
Re: [PATCH v4 08/29] dma-api: Teach the "DMA-from-stack" check about vmapped stacks Andy Lutomirski <luto@amacapital.net> - 2016-07-06 15:30 +0200
[PATCH v4 25/29] um: Stop conflating task_struct::stack with thread_info Andy Lutomirski <luto@kernel.org> - 2016-06-27 00:10 +0200
Re: [PATCH v4 25/29] um: Stop conflating task_struct::stack with thread_info Andy Lutomirski <luto@amacapital.net> - 2016-06-27 01:50 +0200
Re: [PATCH v4 25/29] um: Stop conflating task_struct::stack with thread_info Brian Gerst <brgerst@gmail.com> - 2016-06-27 01:50 +0200
[PATCH v4 22/29] x86/asm: Move 'status' from struct thread_info to struct thread_struct Andy Lutomirski <luto@kernel.org> - 2016-06-27 00:10 +0200
Re: [PATCH v4 22/29] x86/asm: Move 'status' from struct thread_info to struct thread_struct Brian Gerst <brgerst@gmail.com> - 2016-06-27 02:00 +0200
Re: [PATCH v4 22/29] x86/asm: Move 'status' from struct thread_info to struct thread_struct Andy Lutomirski <luto@amacapital.net> - 2016-06-27 02:30 +0200
Re: [PATCH v4 22/29] x86/asm: Move 'status' from struct thread_info to struct thread_struct Brian Gerst <brgerst@gmail.com> - 2016-06-27 02:40 +0200
Re: [PATCH v4 22/29] x86/asm: Move 'status' from struct thread_info to struct thread_struct Andy Lutomirski <luto@amacapital.net> - 2016-06-27 02:50 +0200
[PATCH v4 19/29] signal: Consolidate {TS,TLF}_RESTORE_SIGMASK code Andy Lutomirski <luto@kernel.org> - 2016-06-27 00:10 +0200
[PATCH v4 15/29] x86/mm/64: Enable vmapped stacks Andy Lutomirski <luto@kernel.org> - 2016-06-27 00:10 +0200
Re: [PATCH v4 15/29] x86/mm/64: Enable vmapped stacks Brian Gerst <brgerst@gmail.com> - 2016-06-27 17:10 +0200
Re: [PATCH v4 15/29] x86/mm/64: Enable vmapped stacks Brian Gerst <brgerst@gmail.com> - 2016-06-27 17:20 +0200
Re: [PATCH v4 15/29] x86/mm/64: Enable vmapped stacks Andy Lutomirski <luto@amacapital.net> - 2016-06-27 17:30 +0200
Re: [PATCH v4 15/29] x86/mm/64: Enable vmapped stacks Andy Lutomirski <luto@amacapital.net> - 2016-06-27 18:00 +0200
Re: [PATCH v4 15/29] x86/mm/64: Enable vmapped stacks Brian Gerst <brgerst@gmail.com> - 2016-06-27 18:20 +0200
Re: [PATCH v4 15/29] x86/mm/64: Enable vmapped stacks Andy Lutomirski <luto@amacapital.net> - 2016-06-27 18:40 +0200
Re: [PATCH v4 15/29] x86/mm/64: Enable vmapped stacks Brian Gerst <brgerst@gmail.com> - 2016-06-27 19:10 +0200
Re: [PATCH v4 15/29] x86/mm/64: Enable vmapped stacks Brian Gerst <brgerst@gmail.com> - 2016-06-27 19:30 +0200
Re: [PATCH v4 15/29] x86/mm/64: Enable vmapped stacks Linus Torvalds <torvalds@linux-foundation.org> - 2016-06-27 19:30 +0200
Re: [PATCH v4 15/29] x86/mm/64: Enable vmapped stacks Andy Lutomirski <luto@amacapital.net> - 2016-06-27 19:40 +0200
[PATCH v4 18/29] x86: Move addr_limit to thread_struct Andy Lutomirski <luto@kernel.org> - 2016-06-27 00:10 +0200
[PATCH v4 17/29] x86: Move uaccess_err and sig_on_uaccess_err to thread_struct Andy Lutomirski <luto@kernel.org> - 2016-06-27 00:10 +0200
[PATCH v4 03/29] x86/mm/hotplug: Don't remove PGD entries in remove_pagetable() Andy Lutomirski <luto@kernel.org> - 2016-06-27 00:10 +0200
[PATCH v4 23/29] kdb: Use task_cpu() instead of task_thread_info()->cpu Andy Lutomirski <luto@kernel.org> - 2016-06-27 00:10 +0200
[PATCH v4 16/29] x86/mm: Improve stack-overflow #PF handling Andy Lutomirski <luto@kernel.org> - 2016-06-27 00:10 +0200
[PATCH v4 20/29] x86/smp: Remove stack_smp_processor_id() Andy Lutomirski <luto@kernel.org> - 2016-06-27 00:10 +0200
[PATCH v4 02/29] rxrpc: Avoid using stack memory in SG lists in rxkad Andy Lutomirski <luto@kernel.org> - 2016-06-27 00:10 +0200
Re: [PATCH v4 02/29] rxrpc: Avoid using stack memory in SG lists in rxkad David Howells <dhowells@redhat.com> - 2016-06-28 09:40 +0200
Re: [PATCH v4 02/29] rxrpc: Avoid using stack memory in SG lists in rxkad Herbert Xu <herbert@gondor.apana.org.au> - 2016-06-28 09:40 +0200
Re: [PATCH v4 02/29] rxrpc: Avoid using stack memory in SG lists in rxkad David Howells <dhowells@redhat.com> - 2016-06-28 11:10 +0200
Re: [PATCH v4 02/29] rxrpc: Avoid using stack memory in SG lists in rxkad Herbert Xu <herbert@gondor.apana.org.au> - 2016-06-28 11:50 +0200
Re: [PATCH v4 02/29] rxrpc: Avoid using stack memory in SG lists in rxkad David Howells <dhowells@redhat.com> - 2016-06-28 09:50 +0200
Re: [PATCH v4 02/29] rxrpc: Avoid using stack memory in SG lists in rxkad David Howells <dhowells@redhat.com> - 2016-06-28 10:00 +0200
[PATCH v4 04/29] x86/cpa: In populate_pgd, don't set the pgd entry until it's populated Andy Lutomirski <luto@kernel.org> - 2016-06-27 00:10 +0200
Re: [PATCH v4 04/29] x86/cpa: In populate_pgd, don't set the pgd entry until it's populated Borislav Petkov <bp@alien8.de> - 2016-06-28 21:10 +0200
Re: [PATCH v4 04/29] x86/cpa: In populate_pgd, don't set the pgd entry until it's populated Andy Lutomirski <luto@amacapital.net> - 2016-06-28 21:10 +0200
[PATCH v4 01/29] bluetooth: Switch SMP to crypto_cipher_encrypt_one() Andy Lutomirski <luto@kernel.org> - 2016-06-27 00:10 +0200
Re: [PATCH v4 01/29] bluetooth: Switch SMP to crypto_cipher_encrypt_one() Marcel Holtmann <marcel@holtmann.org> - 2016-06-27 08:00 +0200
Re: [PATCH v4 01/29] bluetooth: Switch SMP to crypto_cipher_encrypt_one() Ingo Molnar <mingo@kernel.org> - 2016-06-27 11:00 +0200
Re: [PATCH v4 01/29] bluetooth: Switch SMP to crypto_cipher_encrypt_one() Marcel Holtmann <marcel@holtmann.org> - 2016-06-28 00:40 +0200
Re: [PATCH v4 01/29] bluetooth: Switch SMP to crypto_cipher_encrypt_one() Andy Lutomirski <luto@amacapital.net> - 2016-06-28 00:40 +0200
Re: [PATCH v4 01/29] bluetooth: Switch SMP to crypto_cipher_encrypt_one() Marcel Holtmann <marcel@holtmann.org> - 2016-07-04 20:00 +0200
Re: [PATCH v4 01/29] bluetooth: Switch SMP to crypto_cipher_encrypt_one() Andy Lutomirski <luto@amacapital.net> - 2016-07-06 15:20 +0200
[PATCH v4 21/29] x86/smp: Remove unnecessary initialization of thread_info::cpu Andy Lutomirski <luto@kernel.org> - 2016-06-27 00:10 +0200
Re: [PATCH v4 02/29] rxrpc: Avoid using stack memory in SG lists in rxkad Herbert Xu <herbert@gondor.apana.org.au> - 2016-06-28 10:00 +0200
Re: [PATCH v4 02/29] rxrpc: Avoid using stack memory in SG lists in rxkad David Howells <dhowells@redhat.com> - 2016-06-28 11:00 +0200
Re: [PATCH v4 02/29] rxrpc: Avoid using stack memory in SG lists in rxkad Herbert Xu <herbert@gondor.apana.org.au> - 2016-06-28 11:50 +0200
Re: [PATCH v4 02/29] rxrpc: Avoid using stack memory in SG lists in rxkad David Howells <dhowells@redhat.com> - 2016-06-28 12:10 +0200
Re: [PATCH v4 02/29] rxrpc: Avoid using stack memory in SG lists in rxkad David Howells <dhowells@redhat.com> - 2016-06-28 15:30 +0200
csiph-web