From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9A398C433EF for ; Mon, 27 Sep 2021 23:47:43 +0000 (UTC) Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 5A11F61156 for ; Mon, 27 Sep 2021 23:47:43 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.1 mail.kernel.org 5A11F61156 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=redhat.com Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=lists.infradead.org DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:In-Reply-To:MIME-Version:References: Message-ID:Subject:Cc:To:From:Date:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=9BawddUBm1bQfCPKtL7eNzlvUv/R/OqBt0pFFbb8UxU=; b=aD1Y1zWYCYSzoF Qzpp7M61TYGJfLgzoASw2rPtluOn06JYbiJXMm0+MzgKBd5s7LOTSKkBOKil3GI7yRTUB37jy5/Iv uTazN63SjqICn+hIPR64O25E1Y823GcswXwxpJ43HbQWytq8sZUhNgbpDwClC3qQdvl9USZlgdpSM vlY9t8Eh1LVRcqDnOVMGMfKmNkulbod+h5sjS01lr8s2f7oTfPvzE+x8Py2ce62ySa3IfaIe49y8g KU/jLutIb8V4kw/LKNnCMgVKFvwxIT55/LIb9R2paxPyZdW+Rr5foE9gAuErW5qB5j0Hy+Za/KQIJ 6P6QffYVMSWItvCnMMhg==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.94.2 #2 (Red Hat Linux)) id 1mV0Jn-004ufG-0u; Mon, 27 Sep 2021 23:45:55 +0000 Received: from us-smtp-delivery-124.mimecast.com ([170.10.129.124]) by bombadil.infradead.org with esmtps (Exim 4.94.2 #2 (Red Hat Linux)) id 1mV0Ji-004udw-AL for linux-arm-kernel@lists.infradead.org; Mon, 27 Sep 2021 23:45:52 +0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1632786348; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=nsnSPMX2S/Qat0JZTZ1IQ/fql2yzNENw+yYwIO5gmA8=; b=EleK6qrBrs4A+zqxEH65X56uM85OJ10FVUvpe6FndAGAPwJxf3fP+kq3HySM7YDv9uu6zI k0D/TJp8bSoh8IH2djagrCVkdNX88f1GYp5cK9aCUPrBsazb/NlcQTU99ADJVioX3XOMjE ejeQFmWvLL7H7zn65KqNe6YOAgn1tkw= Received: from mail-oi1-f198.google.com (mail-oi1-f198.google.com [209.85.167.198]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-23-H118Li1iN8eu9rhzUgveAg-1; Mon, 27 Sep 2021 19:45:47 -0400 X-MC-Unique: H118Li1iN8eu9rhzUgveAg-1 Received: by mail-oi1-f198.google.com with SMTP id m189-20020aca58c6000000b0027381ff1c37so16867906oib.22 for ; Mon, 27 Sep 2021 16:45:47 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:date:from:to:cc:subject:message-id:references :mime-version:content-disposition:in-reply-to; bh=nsnSPMX2S/Qat0JZTZ1IQ/fql2yzNENw+yYwIO5gmA8=; b=hkiQBm5N1UB6Razc6+jPXzcf+pKk2PSRnOcvlfm0KaeQNZ27/1fFGhCdjBlbpr+jQM ntTQKlCCWVlcKiPvE2lp1cBPiELkAMYqShdkwPNHoYlv26XVki2/BC0CKKMEtN4cRqYC hRVoc22X57Xo7zPMWzolGmAgLU2NfgczVvb06UbwhNMcwOIfD0oJPUZwfTwiBnTEmauF slXUrLHLIouqJLALrP+GMXf/MtfoS3laRTgcUhKxf6rXcW7wt6iArtqg08JwYrt4xsbc A5+/mjxv5OAX2xANOqsK4qj8By04111yJ9qO86YwrCDxTzhINQvU8AVD0W5wd7Rt9dXu mQbA== X-Gm-Message-State: AOAM530srAySVj65gXe98GO3l+VGDgE30ranysTe0+M9sFdy2xbl7hMu GrLadXTWWAQDn3ZwbtvKX1nwUGHHSQMQ12BbuZvzGzr9bFVFre8CcBBHqdnhIdYAasiosWdN9Di yS/QTWhm3jLJgvBFMJDXgeX3uSAjycCSW3+A= X-Received: by 2002:a05:6830:246f:: with SMTP id x47mr2385802otr.287.1632786346785; Mon, 27 Sep 2021 16:45:46 -0700 (PDT) X-Google-Smtp-Source: ABdhPJzEwgyyipAso5Lnpv6vJwXUFrYJKO6zGLcI7AhX5ImXTFSCGu/useHx1lO4JT1d7wgEAIOV2g== X-Received: by 2002:a05:6830:246f:: with SMTP id x47mr2385776otr.287.1632786346571; Mon, 27 Sep 2021 16:45:46 -0700 (PDT) Received: from treble ([2600:1700:6e32:6c00::15]) by smtp.gmail.com with ESMTPSA id o62sm434028ota.14.2021.09.27.16.45.45 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 27 Sep 2021 16:45:46 -0700 (PDT) Date: Mon, 27 Sep 2021 16:45:43 -0700 From: Josh Poimboeuf To: Sean Christopherson Cc: Dmitry Vyukov , Marco Elver , syzbot , linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com, viro@zeniv.linux.org.uk, the arch/x86 maintainers , Linux ARM , kasan-dev , Peter Zijlstra Subject: Re: [syzbot] upstream test error: KFENCE: use-after-free in kvm_fastop_exception Message-ID: <20210927234543.6waods7rraxseind@treble> References: <000000000000d6b66705cb2fffd4@google.com> MIME-Version: 1.0 In-Reply-To: Authentication-Results: relay.mimecast.com; auth=pass smtp.auth=CUSA124A263 smtp.mailfrom=jpoimboe@redhat.com X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Disposition: inline X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20210927_164550_667656_FADE03B8 X-CRM114-Status: GOOD ( 23.06 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org On Mon, Sep 27, 2021 at 04:07:51PM +0000, Sean Christopherson wrote: > I was asking about the exact location to confirm that the explosion is indeed > from exception fixup, which is the "unwinder scenario get confused" I was thinking > of. Based on the disassembly from syzbot, that does indeed appear to be the case > here, i.e. this > > 2a: 4c 8b 21 mov (%rcx),%r12 > > is from exception fixup from somewhere in __d_lookup (can't tell exactly what > it's from, maybe KASAN?). > > > Is there more info on this "the unwinder gets confused"? Bug filed > > somewhere or an email thread? Is it on anybody's radar? > > I don't know if there's a bug report or if this is on anyone's radar. The issue > I've encountered in the past, and what I'm pretty sure is being hit here, is that > the ORC unwinder doesn't play nice with out-of-line fixup code, presumably because > there are no tables for the fixup. I believe kvm_fastop_exception() gets blamed > because it's the first label that's found when searching back through the tables. The ORC unwinder actually knows about .fixup, and unwinding through the .fixup code worked here, as evidenced by the entire stacktrace getting printed. Otherwise there would have been a bunch of question marks in the stack trace. The problem reported here -- falsely printing kvm_fastop_exception -- is actually in the arch-independent printing of symbol names, done by __sprint_symbol(). Most .fixup code fragments are anonymous, in the sense that they don't have symbols associated with them. For x86, here are the only defined symbols in .fixup: ffffffff81e02408 T kvm_fastop_exception ffffffff81e02728 t .E_read_words ffffffff81e0272b t .E_leading_bytes ffffffff81e0272d t .E_trailing_bytes ffffffff81e02734 t .E_write_words ffffffff81e02740 t .E_copy There's a lot of anonymous .fixup code which happens to be placed in the gap between "kvm_fastop_exception" and ".E_read_words". The kernel symbol printing code will go backwards from the given address and will print the first symbol it finds. So any anonymous code in that gap will falsely be reported as kvm_fastop_exception(). I'm thinking the ideal way to fix this would be getting rid of the .fixup section altogether, and instead place a function's corresponding fixup code in a cold part of the original function, with the help of asm_goto and cold label attributes. That way, the original faulting function would be printed instead of an obscure reference to an anonymous .fixup code fragment. It would have other benefits as well. For example, not breaking livepatch... I'll try to play around with it. -- Josh _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel