[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Mon, 14 Aug 2017 18:25:09 +0100
From: Mark Rutland <mark.rutland@....com>
To: Will Deacon <will.deacon@....com>
Cc: linux-arm-kernel@...ts.infradead.org, ard.biesheuvel@...aro.org,
catalin.marinas@....com, james.morse@....com, labbott@...hat.com,
linux-kernel@...r.kernel.org, luto@...capital.net,
matt@...eblueprint.co.uk, kernel-hardening@...ts.openwall.com,
keescook@...omium.org
Subject: Re: [PATCH 14/14] arm64: add VMAP_STACK overflow detection
On Mon, Aug 14, 2017 at 04:32:53PM +0100, Will Deacon wrote:
> Just some minor comments on this (after taking ages to realise you were
> using tpidr_el0 as a temporary rather than tpidr_el1 and getting totally
> confused!).
>
> On Mon, Aug 07, 2017 at 07:36:05PM +0100, Mark Rutland wrote:
> > +static inline bool on_overflow_stack(unsigned long sp)
> > +{
> > + unsigned long low = (unsigned long)this_cpu_ptr(overflow_stack);
>
> Can you use raw_cpu_ptr here, like you do for the irq stack?
Sure; done.
> > diff --git a/arch/arm64/kernel/entry.S b/arch/arm64/kernel/entry.S
> > index e5aa866..44a27c3 100644
> > --- a/arch/arm64/kernel/entry.S
> > +++ b/arch/arm64/kernel/entry.S
> > @@ -72,6 +72,37 @@
> > .macro kernel_ventry label
> > .align 7
> > sub sp, sp, #S_FRAME_SIZE
> > +#ifdef CONFIG_VMAP_STACK
> > + add sp, sp, x0 // sp' = sp + x0
> > + sub x0, sp, x0 // x0' = sp' - x0 = (sp + x0) - x0 = sp
> > + tbnz x0, #THREAD_SHIFT, 0f
> > + sub x0, sp, x0 // sp' - x0' = (sp + x0) - sp = x0
> > + sub sp, sp, x0 // sp' - x0 = (sp + x0) - x0 = sp
> > + b \label
> > +
> > + /* Stash the original SP value in tpidr_el0 */
> > +0: msr tpidr_el0, x0
>
> The comment here is a bit confusing, since the sp has already been
> decremented for the frame, as mention in a later comment.
True. I've updated the comment to say:
/*
* Stash the SP (minus S_FRAME_SIZE) in tpidr_el0. We can recover the
* original SP value later if we need it.
*/
[...]
> > + * Store the original GPRs to the new stack. The orginial SP (minus
>
> original
Took me a moment to spot the second instance. Fixed now.
[...]
> > + /* Time to die */
> > + bl handle_bad_stack
> > + ASM_BUG()
>
> Why not just a b without the ASM_BUG?
We need the BL to ensure that the LR is valid for unwinding. That's
necessary for the backtrace to identify the exception regs based on the
LR falling into .entry.text.
The ASM_BUG() ensures that the LR value definitely falls in .entry.text,
and makes the backtrace resolve the symbol correctly regardless of
what's next.
I didn't add a comment for the other cases, so I hadn't bothered here.
I'm happy to add those, so long as we're consistent.
Thanks,
Mark.
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
