Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1524084

Re: perf: fuzzer KASAN unwind_get_return_address

From Josh Poimboeuf <jpoimboe@redhat.com>
Newsgroups linux.kernel
Subject Re: perf: fuzzer KASAN unwind_get_return_address
Date 2016-11-17 05:50 +0100
Message-ID <sEmO5-4fO-5@gated-at.bofh.it> (permalink)
References (3 earlier) <sDSZH-1sK-3@gated-at.bofh.it> <sE88q-3gV-19@gated-at.bofh.it> <sE9xw-48I-35@gated-at.bofh.it> <sE9QR-4fj-7@gated-at.bofh.it> <sE9QR-4fj-5@gated-at.bofh.it>
Organization linux.* mail to news gateway

Show all headers | View raw

On Wed, Nov 16, 2016 at 03:58:49PM +0100, Peter Zijlstra wrote:
> 3BUG: KASAN: stack-out-of-bounds in unwind_get_return_address+0x1fb/0x220 at addr ffff88042f88bba0

So I dug through the disassembly (thanks for the vmlinux), and I'm
pretty sure the stack-out-of-bounds address is on the NMI stack, in the
kasan redzone in the stack frame of intel_pmu_handle_irq().

What's weird though is that perf_callchain_kernel() passes the pt_regs
from the IRQ, not from the NMI.  The unwinder should have started from
the IRQ stack.  But somehow it ended up unwinding to the middle of the
NMI stack.

So it seems like stack corruption in the IRQ or task stack, with a frame
pointer that points back to the middle of the NMI stack for some reason.
But then again, the kasan error report dumped the stack fine.  So that
would seem to rule out stack corruption...  So I have no idea what's
going on.

I got perf_fuzzer running and tried to recreate, but no luck.

Peter or Vince, can you try to recreate with this patch?  It dumps the
raw stack contents during a stack dump.  Hopefully that would give a
clue about what's going wrong.

diff --git a/arch/x86/kernel/dumpstack.c b/arch/x86/kernel/dumpstack.c
index 499aa6f..67ff3ac 100644
--- a/arch/x86/kernel/dumpstack.c
+++ b/arch/x86/kernel/dumpstack.c
@@ -48,6 +48,30 @@ static void printk_stack_address(unsigned long address, int reliable,
 	printk("%s %s%pB\n", log_lvl, reliable ? "" : "? ", (void *)address);
 }
 
+static void raw_stack_dump(struct stack_info *info)
+{
+	unsigned long *s, word[4];
+	int skip = 0;
+
+	for (s = info->begin; s < info->end; s += 4) {
+		word[0] = READ_ONCE_NOCHECK(s[0]);
+		word[1] = READ_ONCE_NOCHECK(s[1]);
+		word[2] = READ_ONCE_NOCHECK(s[2]);
+		word[3] = READ_ONCE_NOCHECK(s[3]);
+
+		if (!word[0] && !word[1] && !word[2] && !word[3]) {
+			if (!skip)
+				printk("%p: %016x ...\n", s, 0);
+			skip = 1;
+			continue;
+		}
+
+		skip = 0;
+		printk("%p: %016lx %016lx %016lx %016lx\n",
+		       s, word[0], word[1], word[2], word[3]);
+	}
+}
+
 void show_trace_log_lvl(struct task_struct *task, struct pt_regs *regs,
 			unsigned long *stack, char *log_lvl)
 {
@@ -156,6 +180,8 @@ void show_trace_log_lvl(struct task_struct *task, struct pt_regs *regs,
 
 		if (str_end)
 			printk("%s <%s>\n", log_lvl, str_end);
+
+		raw_stack_dump(&stack_info);
 	}
 }

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

perf: fuzzer KASAN unwind_get_return_address Vince Weaver <vincent.weaver@maine.edu> - 2016-11-15 18:50 +0100
  Re: perf: fuzzer KASAN unwind_get_return_address Peter Zijlstra <peterz@infradead.org> - 2016-11-15 20:00 +0100
    Re: perf: fuzzer KASAN unwind_get_return_address Vince Weaver <vincent.weaver@maine.edu> - 2016-11-15 20:10 +0100
      Re: perf: fuzzer KASAN unwind_get_return_address Josh Poimboeuf <jpoimboe@redhat.com> - 2016-11-15 22:00 +0100
        Re: perf: fuzzer KASAN unwind_get_return_address Peter Zijlstra <peterz@infradead.org> - 2016-11-16 14:10 +0100
          Re: perf: fuzzer KASAN unwind_get_return_address Dmitry Vyukov <dvyukov@google.com> - 2016-11-16 14:20 +0100
          Re: perf: fuzzer KASAN unwind_get_return_address Josh Poimboeuf <jpoimboe@redhat.com> - 2016-11-16 15:40 +0100
            Re: perf: fuzzer KASAN unwind_get_return_address Josh Poimboeuf <jpoimboe@redhat.com> - 2016-11-16 16:00 +0100
            Re: perf: fuzzer KASAN unwind_get_return_address Peter Zijlstra <peterz@infradead.org> - 2016-11-16 16:00 +0100
              Re: perf: fuzzer KASAN unwind_get_return_address Josh Poimboeuf <jpoimboe@redhat.com> - 2016-11-17 05:50 +0100
                Re: perf: fuzzer KASAN unwind_get_return_address Peter Zijlstra <peterz@infradead.org> - 2016-11-17 10:20 +0100
                Re: perf: fuzzer KASAN unwind_get_return_address Josh Poimboeuf <jpoimboe@redhat.com> - 2016-11-17 18:10 +0100
                Re: perf: fuzzer KASAN unwind_get_return_address Vince Weaver <vincent.weaver@maine.edu> - 2016-11-17 18:20 +0100
                Re: perf: fuzzer KASAN unwind_get_return_address Dmitry Vyukov <dvyukov@google.com> - 2016-11-17 18:50 +0100
                Re: perf: fuzzer KASAN unwind_get_return_address Josh Poimboeuf <jpoimboe@redhat.com> - 2016-11-17 18:40 +0100
                Re: perf: fuzzer KASAN unwind_get_return_address Vince Weaver <vincent.weaver@maine.edu> - 2016-11-17 19:20 +0100
                Re: perf: fuzzer KASAN unwind_get_return_address Peter Zijlstra <peterz@infradead.org> - 2016-11-17 18:20 +0100
                Re: perf: fuzzer KASAN unwind_get_return_address Peter Zijlstra <peterz@infradead.org> - 2016-11-17 18:20 +0100
                [tip:perf/urgent] perf/x86/intel: Cure bogus unwind from PEBS  entries tip-bot for Peter Zijlstra <tipbot@zytor.com> - 2016-11-22 13:40 +0100
                Re: perf: fuzzer KASAN unwind_get_return_address Josh Poimboeuf <jpoimboe@redhat.com> - 2016-11-17 18:50 +0100
            Re: perf: fuzzer KASAN unwind_get_return_address Peter Zijlstra <peterz@infradead.org> - 2016-11-16 16:00 +0100
              Re: perf: fuzzer KASAN unwind_get_return_address Vince Weaver <vincent.weaver@maine.edu> - 2016-11-16 16:10 +0100
          [PATCH 1/2] unwind: prevent KASAN false positive warnings in guess unwinder Josh Poimboeuf <jpoimboe@redhat.com> - 2016-11-17 18:20 +0100
            Re: [PATCH 1/2] unwind: prevent KASAN false positive warnings in  guess unwinder Josh Poimboeuf <jpoimboe@redhat.com> - 2016-11-17 21:30 +0100
              Re: [PATCH 1/2] unwind: prevent KASAN false positive warnings in  guess unwinder Ingo Molnar <mingo@kernel.org> - 2016-11-18 09:40 +0100
            [tip:x86/urgent] x86/unwind: Prevent KASAN false positive warnings  in guess unwinder tip-bot for Josh Poimboeuf <tipbot@zytor.com> - 2016-11-18 10:10 +0100
          [PATCH 2/2] dumpstack: prevent KASAN false positive warnings Josh Poimboeuf <jpoimboe@redhat.com> - 2016-11-17 18:20 +0100
            [tip:x86/urgent] x86/dumpstack: Prevent KASAN false positive  warnings tip-bot for Josh Poimboeuf <tipbot@zytor.com> - 2016-11-18 10:10 +0100
    Re: perf: fuzzer KASAN unwind_get_return_address Dmitry Vyukov <dvyukov@google.com> - 2016-11-15 20:10 +0100
      Re: perf: fuzzer KASAN unwind_get_return_address Josh Poimboeuf <jpoimboe@redhat.com> - 2016-11-15 22:00 +0100

csiph-web