From: Josh Poimboeuf <jpoimboe@redhat.com>
To: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Brian Gerst <brgerst@gmail.com>,
Peter Zijlstra <peterz@infradead.org>,
Oleg Nesterov <oleg@redhat.com>,
Andy Lutomirski <luto@amacapital.net>,
Andy Lutomirski <luto@kernel.org>,
the arch/x86 maintainers <x86@kernel.org>,
Linux Kernel Mailing List <linux-kernel@vger.kernel.org>,
"linux-arch@vger.kernel.org" <linux-arch@vger.kernel.org>,
Borislav Petkov <bp@alien8.de>, Nadav Amit <nadav.amit@gmail.com>,
Kees Cook <keescook@chromium.org>,
"kernel-hardening@lists.openwall.com"
<kernel-hardening@lists.openwall.com>, Jann Horn <jann@thejh.net>,
Heiko Carstens <heiko.carstens@de.ibm.com>
Subject: Re: [PATCH v3 00/13] Virtually mapped stacks with guard pages (x86, core)
Date: Fri, 24 Jun 2016 15:25:30 -0500 [thread overview]
Message-ID: <20160624202530.unmidps4kpebo2na@treble> (raw)
In-Reply-To: <CA+55aFx=wdH4v7cD2F5Kq+jwDfV5cz9qTANgOwpMTC3MY=99AQ@mail.gmail.com>
On Fri, Jun 24, 2016 at 11:11:47AM -0700, Linus Torvalds wrote:
> On Fri, Jun 24, 2016 at 10:51 AM, Linus Torvalds
> <torvalds@linux-foundation.org> wrote:
> >
> > And in particular, the init_task stack initialization initialized it
> > to the init_thread pointer. Which was definitely deadly.
> >
> > Let's see if that was it..
>
> No, it's still broken. But it's *less* broken, so here's a new version
> of the patch that at least gets some of the stack setup right, in my
> hope that somebody will bother to look at this, and being less broken
> might mean that somebody sees what else I missed..
I found at least one bug. The changing of task->stack from a "void *" to an
"unsigned long *":
> - void *stack;
> + unsigned long *stack;
That subtly changes the pointer arithmetic in do_boot_cpu():
idle->thread.sp = (unsigned long) (((struct pt_regs *)
(THREAD_SIZE + task_stack_page(idle))) - 1);
That ends up adding 128k to the stack page bottom instead of 16k.
But fixing that doesn't seem to fix this:
[18446743832.576241] ------------[ cut here ]------------
[18446743832.576241] WARNING: CPU: 1 PID: 0 at /home/jpoimboe/git/linux/arch/x86/kernel/cpu/common.c:1434 cpu_init+0x34b/0x440
[18446743832.576241] Modules linked in:
[18446743832.576241] CPU: 1 PID: 0 Comm: swapper/1 Not tainted 4.7.0-rc4+ #47
[18446743832.576241] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.8.1-20150318_183358- 04/01/2014
[18446743832.576241] 0000000000000086 574e5e6c6855ace9 ffff88007c553e88 ffffffff8143cb83
[18446743832.576241] 0000000000000000 0000000000000000 ffff88007c553ec8 ffffffff810b0e7b
[18446743832.576241] 0000059a00000000 0000000000000000 0000000000000000 0000000000000000
[18446743832.576241] Call Trace:
[18446743832.576241] [<ffffffff8143cb83>] dump_stack+0x85/0xc2
[18446743832.576241] [<ffffffff810b0e7b>] __warn+0xcb/0xf0
[18446743832.576241] [<ffffffff810b0fad>] warn_slowpath_null+0x1d/0x20
[18446743832.576241] [<ffffffff810491bb>] cpu_init+0x34b/0x440
[18446743832.576241] [<ffffffff8105ab7c>] start_secondary+0x1c/0x1a0
[18446743832.576241] ---[ end trace 924d57afbaca0720 ]---
So there's at least another bug lurking..
--
Josh
next prev parent reply other threads:[~2016-06-24 21:06 UTC|newest]
Thread overview: 150+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-06-20 23:43 [PATCH v3 00/13] Virtually mapped stacks with guard pages (x86, core) Andy Lutomirski
2016-06-20 23:43 ` Andy Lutomirski
2016-06-20 23:43 ` [PATCH v3 01/13] x86/mm/hotplug: Don't remove PGD entries in remove_pagetable() Andy Lutomirski
2016-06-20 23:43 ` Andy Lutomirski
2016-06-20 23:43 ` [PATCH v3 02/13] x86/cpa: In populate_pgd, don't set the pgd entry until it's populated Andy Lutomirski
2016-06-20 23:43 ` Andy Lutomirski
2016-06-20 23:43 ` [PATCH v3 03/13] x86/mm: Remove kernel_unmap_pages_in_pgd() and efi_cleanup_page_tables() Andy Lutomirski
2016-06-20 23:43 ` Andy Lutomirski
2016-06-21 9:53 ` Matt Fleming
2016-06-21 9:53 ` Matt Fleming
2016-06-20 23:43 ` [PATCH v3 04/13] mm: Track NR_KERNEL_STACK in KiB instead of number of stacks Andy Lutomirski
2016-06-20 23:43 ` Andy Lutomirski
2016-06-21 9:46 ` Vladimir Davydov
2016-06-21 9:46 ` Vladimir Davydov
2016-06-22 7:35 ` Michal Hocko
2016-06-22 7:35 ` Michal Hocko
2016-06-20 23:43 ` [PATCH v3 05/13] mm: Fix memcg stack accounting for sub-page stacks Andy Lutomirski
2016-06-20 23:43 ` Andy Lutomirski
2016-06-21 9:54 ` Vladimir Davydov
2016-06-21 9:54 ` Vladimir Davydov
2016-06-22 7:38 ` Michal Hocko
2016-06-22 7:38 ` Michal Hocko
2016-06-20 23:43 ` [PATCH v3 06/13] fork: Add generic vmalloced stack support Andy Lutomirski
2016-06-20 23:43 ` Andy Lutomirski
2016-06-21 7:30 ` Jann Horn
2016-06-21 16:59 ` Andy Lutomirski
2016-06-21 16:59 ` Andy Lutomirski
2016-06-21 17:13 ` Kees Cook
2016-06-21 17:13 ` Kees Cook
2016-06-21 17:28 ` Andy Lutomirski
2016-06-21 17:28 ` Andy Lutomirski
2016-06-21 18:32 ` Rik van Riel
2016-06-21 18:32 ` [kernel-hardening] " Rik van Riel
2016-06-21 19:44 ` Arnd Bergmann
2016-06-21 19:43 ` Andy Lutomirski
2016-06-21 19:43 ` [kernel-hardening] " Andy Lutomirski
2016-06-21 19:44 ` Arnd Bergmann
2016-07-11 17:00 ` Andrey Ryabinin
2016-06-20 23:43 ` [PATCH v3 07/13] x86/die: Don't try to recover from an OOPS on a non-default stack Andy Lutomirski
2016-06-20 23:43 ` Andy Lutomirski
2016-06-20 23:43 ` [PATCH v3 08/13] x86/dumpstack: When OOPSing, rewind the stack before do_exit Andy Lutomirski
2016-06-20 23:43 ` Andy Lutomirski
2016-06-20 23:43 ` [PATCH v3 09/13] x86/dumpstack: When dumping stack bytes due to OOPS, start with regs->sp Andy Lutomirski
2016-06-20 23:43 ` Andy Lutomirski
2016-06-20 23:43 ` [PATCH v3 10/13] x86/dumpstack: Try harder to get a call trace on stack overflow Andy Lutomirski
2016-06-20 23:43 ` Andy Lutomirski
2016-06-20 23:43 ` [PATCH v3 11/13] x86/dumpstack/64: Handle faults when printing the "Stack:" part of an OOPS Andy Lutomirski
2016-06-20 23:43 ` Andy Lutomirski
2016-06-20 23:43 ` [PATCH v3 12/13] x86/mm/64: Enable vmapped stacks Andy Lutomirski
2016-06-20 23:43 ` Andy Lutomirski
2016-06-20 23:43 ` [PATCH v3 13/13] x86/mm: Improve stack-overflow #PF handling Andy Lutomirski
2016-06-20 23:43 ` Andy Lutomirski
2016-06-21 4:01 ` [PATCH v3 00/13] Virtually mapped stacks with guard pages (x86, core) Linus Torvalds
2016-06-21 4:01 ` Linus Torvalds
2016-06-21 16:45 ` Andy Lutomirski
2016-06-21 16:45 ` Andy Lutomirski
2016-06-21 17:16 ` Linus Torvalds
2016-06-21 17:16 ` Linus Torvalds
2016-06-21 17:27 ` Andy Lutomirski
2016-06-21 17:27 ` Andy Lutomirski
2016-06-21 18:12 ` Kees Cook
2016-06-21 18:12 ` Kees Cook
2016-06-21 18:19 ` Rik van Riel
2016-06-21 18:19 ` [kernel-hardening] " Rik van Riel
2016-06-23 1:22 ` Andy Lutomirski
2016-06-23 6:02 ` Linus Torvalds
2016-06-23 6:02 ` Linus Torvalds
2016-06-23 14:31 ` Oleg Nesterov
2016-06-23 16:30 ` Linus Torvalds
2016-06-23 16:41 ` Andy Lutomirski
2016-06-23 17:10 ` Oleg Nesterov
2016-06-23 17:10 ` Oleg Nesterov
2016-09-06 16:19 ` Jann Horn
2016-09-06 16:40 ` Andy Lutomirski
2016-09-06 16:40 ` Andy Lutomirski
2016-06-23 17:03 ` Oleg Nesterov
2016-06-23 17:44 ` Linus Torvalds
2016-06-23 17:44 ` Linus Torvalds
2016-06-23 17:52 ` Linus Torvalds
2016-06-23 18:00 ` Kees Cook
2016-06-23 18:00 ` Kees Cook
2016-06-23 18:54 ` Peter Zijlstra
2016-06-23 18:54 ` Peter Zijlstra
2016-06-23 18:12 ` Oleg Nesterov
2016-06-23 18:55 ` Peter Zijlstra
2016-06-23 18:46 ` Linus Torvalds
2016-06-23 19:08 ` Andy Lutomirski
2016-06-23 19:08 ` Andy Lutomirski
2016-06-23 18:53 ` Peter Zijlstra
2016-06-23 18:53 ` Peter Zijlstra
2016-06-23 19:09 ` Andy Lutomirski
2016-06-23 19:09 ` Andy Lutomirski
2016-06-23 19:13 ` Peter Zijlstra
2016-06-23 19:17 ` Linus Torvalds
2016-06-24 6:17 ` Linus Torvalds
2016-06-24 12:25 ` Brian Gerst
2016-06-24 17:21 ` Linus Torvalds
2016-06-24 17:40 ` Linus Torvalds
2016-06-24 17:40 ` Linus Torvalds
2016-06-24 17:47 ` Andy Lutomirski
2016-06-24 17:56 ` Linus Torvalds
2016-06-24 18:36 ` Andy Lutomirski
2016-06-24 18:36 ` Andy Lutomirski
2016-06-24 17:51 ` Linus Torvalds
2016-06-24 18:11 ` Linus Torvalds
2016-06-24 20:25 ` Josh Poimboeuf [this message]
2016-06-24 20:51 ` Josh Poimboeuf
2016-06-24 20:51 ` Josh Poimboeuf
2016-06-24 20:53 ` Andy Lutomirski
2016-06-24 20:53 ` Andy Lutomirski
2016-06-24 21:06 ` Linus Torvalds
2016-06-24 21:06 ` Linus Torvalds
2016-06-24 21:25 ` Andy Lutomirski
2016-06-24 21:25 ` Andy Lutomirski
2016-06-24 21:32 ` Linus Torvalds
2016-06-24 21:32 ` Linus Torvalds
2016-06-24 21:34 ` Andy Lutomirski
2016-06-24 21:34 ` Andy Lutomirski
2016-06-25 2:41 ` Linus Torvalds
2016-06-25 23:19 ` Andy Lutomirski
2016-06-25 23:19 ` Andy Lutomirski
2016-06-25 23:30 ` Andy Lutomirski
2016-06-26 1:23 ` Linus Torvalds
2016-06-23 18:52 ` Oleg Nesterov
2016-06-23 18:52 ` Oleg Nesterov
2016-06-24 14:05 ` Michal Hocko
2016-06-24 14:05 ` Michal Hocko
2016-06-24 15:06 ` Michal Hocko
2016-06-24 15:06 ` Michal Hocko
2016-06-24 20:22 ` Oleg Nesterov
2016-06-27 10:36 ` Michal Hocko
2016-06-23 19:11 ` Peter Zijlstra
2016-06-23 19:34 ` Linus Torvalds
2016-06-23 19:34 ` Linus Torvalds
2016-06-23 19:46 ` Peter Zijlstra
2016-06-23 19:46 ` Peter Zijlstra
2016-06-21 9:24 ` Arnd Bergmann
2016-06-21 9:24 ` Arnd Bergmann
2016-06-21 17:16 ` Kees Cook
2016-06-21 17:16 ` Kees Cook
2016-06-21 18:02 ` Rik van Riel
2016-06-21 18:02 ` [kernel-hardening] " Rik van Riel
2016-06-21 18:05 ` Andy Lutomirski
2016-06-21 18:05 ` [kernel-hardening] " Andy Lutomirski
2016-06-21 19:47 ` Arnd Bergmann
2016-06-21 19:47 ` Andy Lutomirski
2016-06-21 19:47 ` Andy Lutomirski
2016-06-21 20:18 ` Kees Cook
2016-06-21 20:18 ` Kees Cook
2016-06-21 19:47 ` Arnd Bergmann
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20160624202530.unmidps4kpebo2na@treble \
--to=jpoimboe@redhat.com \
--cc=bp@alien8.de \
--cc=brgerst@gmail.com \
--cc=heiko.carstens@de.ibm.com \
--cc=jann@thejh.net \
--cc=keescook@chromium.org \
--cc=kernel-hardening@lists.openwall.com \
--cc=linux-arch@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=luto@amacapital.net \
--cc=luto@kernel.org \
--cc=nadav.amit@gmail.com \
--cc=oleg@redhat.com \
--cc=peterz@infradead.org \
--cc=torvalds@linux-foundation.org \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).