From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.1 (2015-04-28) on archive.lwn.net X-Spam-Level: X-Spam-Status: No, score=-6.0 required=5.0 tests=HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,RCVD_IN_DNSWL_HI autolearn=ham autolearn_force=no version=3.4.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by archive.lwn.net (Postfix) with ESMTP id C2A037D08A for ; Thu, 8 Nov 2018 14:44:43 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726710AbeKIAUb (ORCPT ); Thu, 8 Nov 2018 19:20:31 -0500 Received: from mx1.redhat.com ([209.132.183.28]:47298 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726359AbeKIAUb (ORCPT ); Thu, 8 Nov 2018 19:20:31 -0500 Received: from smtp.corp.redhat.com (int-mx04.intmail.prod.int.phx2.redhat.com [10.5.11.14]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 93B063078AB9; Thu, 8 Nov 2018 14:44:41 +0000 (UTC) Received: from treble (ovpn-124-61.rdu2.redhat.com [10.10.124.61]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 0D1B56871F; Thu, 8 Nov 2018 14:44:38 +0000 (UTC) Date: Thu, 8 Nov 2018 08:44:37 -0600 From: Josh Poimboeuf To: Aleksa Sarai Cc: Steven Rostedt , "Naveen N. Rao" , Anil S Keshavamurthy , "David S. Miller" , Masami Hiramatsu , Jonathan Corbet , Peter Zijlstra , Ingo Molnar , Arnaldo Carvalho de Melo , Alexander Shishkin , Jiri Olsa , Namhyung Kim , Shuah Khan , Alexei Starovoitov , Daniel Borkmann , Brendan Gregg , Christian Brauner , Aleksa Sarai , netdev@vger.kernel.org, linux-doc@vger.kernel.org, linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org Subject: Re: [PATCH v3 1/2] kretprobe: produce sane stack traces Message-ID: <20181108144437.l3proaovfqm5osnr@treble> References: <20181101083551.3805-2-cyphar@cyphar.com> <20181101204720.6ed3fe37@vmware.local.home> <20181102050509.tw3dhvj5urudvtjl@yavin> <20181102065932.bdt4pubbrkvql4mp@yavin> <20181102091658.1bc979a4@gandalf.local.home> <20181103070253.ajrqzs5xu2vf5stu@yavin> <20181104115913.74l4yzecisvtt2j5@yavin> <20181106171501.59ccabbc@gandalf.local.home> <20181108074612.ldy6rozdpsdps6bf@yavin> <20181108080448.rggfn4zawi3por23@yavin> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: <20181108080448.rggfn4zawi3por23@yavin> User-Agent: NeoMutt/20180716 X-Scanned-By: MIMEDefang 2.79 on 10.5.11.14 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.48]); Thu, 08 Nov 2018 14:44:42 +0000 (UTC) Sender: linux-doc-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-doc@vger.kernel.org On Thu, Nov 08, 2018 at 07:04:48PM +1100, Aleksa Sarai wrote: > On 2018-11-08, Aleksa Sarai wrote: > > I will attach what I have at the moment to hopefully explain what the > > issue I've found is (re-using the kretprobe architecture but with the > > shadow-stack idea). > > Here is the patch I have at the moment (it works, except for the > question I have about how to handle the top-level pt_regs -- I've marked > that code with XXX). > > -- > Aleksa Sarai > Senior Software Engineer (Containers) > SUSE Linux GmbH > > > --8<--------------------------------------------------------------------- > > Since the return address is modified by kretprobe, the various unwinders > can produce invalid and confusing stack traces. ftrace mostly solved > this problem by teaching each unwinder how to find the original return > address for stack trace purposes. This same technique can be applied to > kretprobes by simply adding a pointer to where the return address was > replaced in the stack, and then looking up the relevant > kretprobe_instance when a stack trace is requested. > > [WIP: This is currently broken because the *first entry* will not be > overwritten since it looks like the stack pointer is different > when we are provided pt_regs. All other addresses are correctly > handled.] When you see this problem, what does regs->ip point to? If it's pointing to generated code, then we don't _currently_ have a way of dealing with that. If it's pointing to a real function, we can fix that with unwind hints. -- Josh