From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
        id S932447AbcJNNJF (ORCPT <rfc822;w@1wt.eu>);
        Fri, 14 Oct 2016 09:09:05 -0400
Received: from foss.arm.com ([217.140.101.70]:36968 "EHLO foss.arm.com"
        rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP
        id S932389AbcJNNJD (ORCPT <rfc822;linux-kernel@vger.kernel.org>);
        Fri, 14 Oct 2016 09:09:03 -0400
Date: Fri, 14 Oct 2016 14:08:26 +0100
From: Mark Rutland <mark.rutland@arm.com>
To: Dmitry Vyukov <dvyukov@google.com>
Cc: rostedt@goodmis.org, mingo@redhat.com, akpm@linux-foundation.org,
        linux-kernel@vger.kernel.org, ryabinin.a.a@gmail.com,
        surovegin@google.com, Catalin Marinas <catalin.marinas@arm.com>,
        Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>,
        Alexander Potapenko <glider@google.com>,
        Will Deacon <will.deacon@arm.com>, Ingo Molnar <mingo@kernel.org>,
        Thomas Gleixner <tglx@linutronix.de>, "H. Peter Anvin" <hpa@zytor.com>,
        Ananth N Mavinakayanahalli <ananth@linux.vnet.ibm.com>,
        Anil S Keshavamurthy <anil.s.keshavamurthy@intel.com>,
        "David S. Miller" <davem@davemloft.net>,
        Masami Hiramatsu <mhiramat@kernel.org>, x86@kernel.org,
        kasan-dev@googlegroups.com
Subject: Re: [PATCH v4] kprobes: unpoison stack in jprobe_return() for KASAN
Message-ID: <20161014130818.GA11804@leverpostej>
References: <1476446070-5297-1-git-send-email-dvyukov@google.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <1476446070-5297-1-git-send-email-dvyukov@google.com>
User-Agent: Mutt/1.5.21 (2010-09-15)
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On Fri, Oct 14, 2016 at 01:54:30PM +0200, Dmitry Vyukov wrote:
> KASAN stack instrumentation poisons stack redzones on function entry
> and unpoisons them on function exit. If a function exits abnormally
> (e.g. with a longjmp like jprobe_return()), stack redzones are left
> poisoned. Later this leads to random KASAN false reports.
> 
> Unpoison stack redzones in the frames we are going to jump over
> before doing actual longjmp in jprobe_return().
> 
> Signed-off-by: Dmitry Vyukov <dvyukov@google.com>
> Reviewed-by: Mark Rutland <mark.rutland@arm.com>

... judging by the kbuild test robot I spoke too soon, and should have
been more thorough. :/

> +/*
> + * Clear all poison for the region between the current SP and a provided
> + * watermark value, as is sometimes required prior to hand-crafted asm function
> + * returns in the middle of functions.
> + */
> +void kasan_unpoison_stack_above_sp_to(const void *watermark)
> +{
> +	const void *sp = (void *)current_stack_pointer();

Aargh; it seems current_stack_pointer() is only function-like on some
arches, and not on others (arm64 included). I should have known better;
sorry for the bad suggestion.

I'm not overjoyed about taking the address of a stack variable to
implement this ourselves. Can we use __builtin_frame_address(0) instead?
Or are there cases where that won't work on x86?

> +	size_t size = watermark - sp;
> +
> +	if (WARN_ON(sp > watermark))
> +		return;

... not a new problem, but we should also include <linux/bug.h> for
WARN_ON().

Thanks,
Mark.