Archive-only list for patches
 help / color / mirror / Atom feed
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: stable@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	patches@lists.linux.dev, Chen Zhongjin <chenzhongjin@huawei.com>,
	Josh Poimboeuf <jpoimboe@kernel.org>,
	Peter Zijlstra <peterz@infradead.org>,
	Sasha Levin <sashal@kernel.org>
Subject: [PATCH 5.4 37/64] x86/unwind/orc: Fix unreliable stack dump with gcov
Date: Wed,  2 Nov 2022 03:34:03 +0100	[thread overview]
Message-ID: <20221102022053.018053491@linuxfoundation.org> (raw)
In-Reply-To: <20221102022051.821538553@linuxfoundation.org>

From: Chen Zhongjin <chenzhongjin@huawei.com>

[ Upstream commit 230db82413c091bc16acee72650f48d419cebe49 ]

When a console stack dump is initiated with CONFIG_GCOV_PROFILE_ALL
enabled, show_trace_log_lvl() gets out of sync with the ORC unwinder,
causing the stack trace to show all text addresses as unreliable:

  # echo l > /proc/sysrq-trigger
  [  477.521031] sysrq: Show backtrace of all active CPUs
  [  477.523813] NMI backtrace for cpu 0
  [  477.524492] CPU: 0 PID: 1021 Comm: bash Not tainted 6.0.0 #65
  [  477.525295] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.0-1.fc36 04/01/2014
  [  477.526439] Call Trace:
  [  477.526854]  <TASK>
  [  477.527216]  ? dump_stack_lvl+0xc7/0x114
  [  477.527801]  ? dump_stack+0x13/0x1f
  [  477.528331]  ? nmi_cpu_backtrace.cold+0xb5/0x10d
  [  477.528998]  ? lapic_can_unplug_cpu+0xa0/0xa0
  [  477.529641]  ? nmi_trigger_cpumask_backtrace+0x16a/0x1f0
  [  477.530393]  ? arch_trigger_cpumask_backtrace+0x1d/0x30
  [  477.531136]  ? sysrq_handle_showallcpus+0x1b/0x30
  [  477.531818]  ? __handle_sysrq.cold+0x4e/0x1ae
  [  477.532451]  ? write_sysrq_trigger+0x63/0x80
  [  477.533080]  ? proc_reg_write+0x92/0x110
  [  477.533663]  ? vfs_write+0x174/0x530
  [  477.534265]  ? handle_mm_fault+0x16f/0x500
  [  477.534940]  ? ksys_write+0x7b/0x170
  [  477.535543]  ? __x64_sys_write+0x1d/0x30
  [  477.536191]  ? do_syscall_64+0x6b/0x100
  [  477.536809]  ? entry_SYSCALL_64_after_hwframe+0x63/0xcd
  [  477.537609]  </TASK>

This happens when the compiled code for show_stack() has a single word
on the stack, and doesn't use a tail call to show_stack_log_lvl().
(CONFIG_GCOV_PROFILE_ALL=y is the only known case of this.)  Then the
__unwind_start() skip logic hits an off-by-one bug and fails to unwind
all the way to the intended starting frame.

Fix it by reverting the following commit:

  f1d9a2abff66 ("x86/unwind/orc: Don't skip the first frame for inactive tasks")

The original justification for that commit no longer exists.  That
original issue was later fixed in a different way, with the following
commit:

  f2ac57a4c49d ("x86/unwind/orc: Fix inactive tasks with stack pointer in %sp on GCC 10 compiled kernels")

Fixes: f1d9a2abff66 ("x86/unwind/orc: Don't skip the first frame for inactive tasks")
Signed-off-by: Chen Zhongjin <chenzhongjin@huawei.com>
[jpoimboe: rewrite commit log]
Signed-off-by: Josh Poimboeuf <jpoimboe@kernel.org>
Signed-off-by: Peter Zijlstra <peterz@infradead.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/x86/kernel/unwind_orc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/x86/kernel/unwind_orc.c b/arch/x86/kernel/unwind_orc.c
index 4e7c49fcf003..c85634152d30 100644
--- a/arch/x86/kernel/unwind_orc.c
+++ b/arch/x86/kernel/unwind_orc.c
@@ -687,7 +687,7 @@ void __unwind_start(struct unwind_state *state, struct task_struct *task,
 	/* Otherwise, skip ahead to the user-specified starting frame: */
 	while (!unwind_done(state) &&
 	       (!on_stack(&state->stack_info, first_frame, sizeof(long)) ||
-			state->sp < (unsigned long)first_frame))
+			state->sp <= (unsigned long)first_frame))
 		unwind_next_frame(state);
 
 	return;
-- 
2.35.1




  parent reply	other threads:[~2022-11-02  3:23 UTC|newest]

Thread overview: 70+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-11-02  2:33 [PATCH 5.4 00/64] 5.4.223-rc1 review Greg Kroah-Hartman
2022-11-02  2:33 ` [PATCH 5.4 01/64] can: j1939: transport: j1939_session_skb_drop_old(): spin_unlock_irqrestore() before kfree_skb() Greg Kroah-Hartman
2022-11-02  2:33 ` [PATCH 5.4 02/64] can: kvaser_usb: Fix possible completions during init_completion Greg Kroah-Hartman
2022-11-02  2:33 ` [PATCH 5.4 03/64] ALSA: Use del_timer_sync() before freeing timer Greg Kroah-Hartman
2022-11-02  2:33 ` [PATCH 5.4 04/64] ALSA: au88x0: use explicitly signed char Greg Kroah-Hartman
2022-11-02  2:33 ` [PATCH 5.4 05/64] USB: add RESET_RESUME quirk for NVIDIA Jetson devices in RCM Greg Kroah-Hartman
2022-11-02  2:33 ` [PATCH 5.4 06/64] usb: dwc3: gadget: Stop processing more requests on IMI Greg Kroah-Hartman
2022-11-02  2:33 ` [PATCH 5.4 07/64] usb: dwc3: gadget: Dont set IMI for no_interrupt Greg Kroah-Hartman
2022-11-02  2:33 ` [PATCH 5.4 08/64] usb: bdc: change state when port disconnected Greg Kroah-Hartman
2022-11-02  2:33 ` [PATCH 5.4 09/64] usb: xhci: add XHCI_SPURIOUS_SUCCESS to ASM1042 despite being a V0.96 controller Greg Kroah-Hartman
2022-11-02  2:33 ` [PATCH 5.4 10/64] mtd: rawnand: marvell: Use correct logic for nand-keep-config Greg Kroah-Hartman
2022-11-02  2:33 ` [PATCH 5.4 11/64] xhci: Remove device endpoints from bandwidth list when freeing the device Greg Kroah-Hartman
2022-11-02  2:33 ` [PATCH 5.4 12/64] tools: iio: iio_utils: fix digit calculation Greg Kroah-Hartman
2022-11-02  2:33 ` [PATCH 5.4 13/64] iio: light: tsl2583: Fix module unloading Greg Kroah-Hartman
2022-11-02  2:33 ` [PATCH 5.4 14/64] fbdev: smscufx: Fix several use-after-free bugs Greg Kroah-Hartman
2022-11-02  2:33 ` [PATCH 5.4 15/64] mac802154: Fix LQI recording Greg Kroah-Hartman
2022-11-02  2:33 ` [PATCH 5.4 16/64] drm/msm/dsi: fix memory corruption with too many bridges Greg Kroah-Hartman
2022-11-02  2:33 ` [PATCH 5.4 17/64] drm/msm/hdmi: " Greg Kroah-Hartman
2022-11-02  2:33 ` [PATCH 5.4 18/64] mmc: core: Fix kernel panic when remove non-standard SDIO card Greg Kroah-Hartman
2022-11-02  2:33 ` [PATCH 5.4 19/64] kernfs: fix use-after-free in __kernfs_remove Greg Kroah-Hartman
2022-11-02  2:33 ` [PATCH 5.4 20/64] perf auxtrace: Fix address filter symbol name match for modules Greg Kroah-Hartman
2022-11-02  2:33 ` [PATCH 5.4 21/64] s390/futex: add missing EX_TABLE entry to __futex_atomic_op() Greg Kroah-Hartman
2022-11-02  2:33 ` [PATCH 5.4 22/64] s390/pci: add missing EX_TABLE entries to __pcistg_mio_inuser()/__pcilg_mio_inuser() Greg Kroah-Hartman
2022-11-02  2:33 ` [PATCH 5.4 23/64] xfs: finish dfops on every insert range shift iteration Greg Kroah-Hartman
2022-11-02  2:33 ` [PATCH 5.4 24/64] xfs: clear XFS_DQ_FREEING if we cant lock the dquot buffer to flush Greg Kroah-Hartman
2022-11-02  2:33 ` [PATCH 5.4 25/64] xfs: force the log after remapping a synchronous-writes file Greg Kroah-Hartman
2022-11-02  2:33 ` [PATCH 5.4 26/64] Xen/gntdev: dont ignore kernel unmapping error Greg Kroah-Hartman
2022-11-02  2:33 ` [PATCH 5.4 27/64] xen/gntdev: Prevent leaking grants Greg Kroah-Hartman
2022-11-02  2:33 ` [PATCH 5.4 28/64] cgroup-v1: add disabled controller check in cgroup1_parse_param() Greg Kroah-Hartman
2022-11-02  2:33 ` [PATCH 5.4 29/64] mm,hugetlb: take hugetlb_lock before decrementing h->resv_huge_pages Greg Kroah-Hartman
2022-11-02  2:33 ` [PATCH 5.4 30/64] net: ieee802154: fix error return code in dgram_bind() Greg Kroah-Hartman
2022-11-02  2:33 ` [PATCH 5.4 31/64] media: v4l2: Fix v4l2_i2c_subdev_set_name function documentation Greg Kroah-Hartman
2022-11-02  2:33 ` [PATCH 5.4 32/64] drm/msm: Fix return type of mdp4_lvds_connector_mode_valid Greg Kroah-Hartman
2022-11-02  2:33 ` [PATCH 5.4 33/64] arc: iounmap() arg is volatile Greg Kroah-Hartman
2022-11-02  2:34 ` [PATCH 5.4 34/64] ALSA: ac97: fix possible memory leak in snd_ac97_dev_register() Greg Kroah-Hartman
2022-11-02  2:34 ` [PATCH 5.4 35/64] tipc: fix a null-ptr-deref in tipc_topsrv_accept Greg Kroah-Hartman
2022-11-02  2:34 ` [PATCH 5.4 36/64] net: netsec: fix error handling in netsec_register_mdio() Greg Kroah-Hartman
2022-11-02  2:34 ` Greg Kroah-Hartman [this message]
2022-11-02  2:34 ` [PATCH 5.4 38/64] amd-xgbe: fix the SFP compliance codes check for DAC cables Greg Kroah-Hartman
2022-11-02  2:34 ` [PATCH 5.4 39/64] amd-xgbe: add the bit rate quirk for Molex cables Greg Kroah-Hartman
2022-11-02  2:34 ` [PATCH 5.4 40/64] kcm: annotate data-races around kcm->rx_psock Greg Kroah-Hartman
2022-11-02  2:34 ` [PATCH 5.4 41/64] kcm: annotate data-races around kcm->rx_wait Greg Kroah-Hartman
2022-11-02  2:34 ` [PATCH 5.4 42/64] net: fix UAF issue in nfqnl_nf_hook_drop() when ops_init() failed Greg Kroah-Hartman
2022-11-02  2:34 ` [PATCH 5.4 43/64] net: lantiq_etop: dont free skb when returning NETDEV_TX_BUSY Greg Kroah-Hartman
2022-11-02  2:34 ` [PATCH 5.4 44/64] tcp: fix indefinite deferral of RTO with SACK reneging Greg Kroah-Hartman
2022-11-02  2:34 ` [PATCH 5.4 45/64] can: mscan: mpc5xxx: mpc5xxx_can_probe(): add missing put_clock() in error path Greg Kroah-Hartman
2022-11-02  2:34 ` [PATCH 5.4 46/64] PM: hibernate: Allow hybrid sleep to work with s2idle Greg Kroah-Hartman
2022-11-02  2:34 ` [PATCH 5.4 47/64] media: vivid: s_fbuf: add more sanity checks Greg Kroah-Hartman
2022-11-02  2:34 ` [PATCH 5.4 48/64] media: vivid: dev->bitmap_cap wasnt freed in all cases Greg Kroah-Hartman
2022-11-02  2:34 ` [PATCH 5.4 49/64] media: v4l2-dv-timings: add sanity checks for blanking values Greg Kroah-Hartman
2022-11-02  2:34 ` [PATCH 5.4 50/64] media: videodev2.h: V4L2_DV_BT_BLANKING_HEIGHT should check interlaced Greg Kroah-Hartman
2022-11-02  2:34 ` [PATCH 5.4 51/64] i40e: Fix ethtool rx-flow-hash setting for X722 Greg Kroah-Hartman
2022-11-02  2:34 ` [PATCH 5.4 52/64] i40e: Fix VF hang when reset is triggered on another VF Greg Kroah-Hartman
2022-11-02  2:34 ` [PATCH 5.4 53/64] i40e: Fix flow-type by setting GL_HASH_INSET registers Greg Kroah-Hartman
2022-11-02  2:34 ` [PATCH 5.4 54/64] net: ksz884x: fix missing pci_disable_device() on error in pcidev_init() Greg Kroah-Hartman
2022-11-02  2:34 ` [PATCH 5.4 55/64] PM: domains: Fix handling of unavailable/disabled idle states Greg Kroah-Hartman
2022-11-02  2:34 ` [PATCH 5.4 56/64] ALSA: aoa: i2sbus: fix possible memory leak in i2sbus_add_dev() Greg Kroah-Hartman
2022-11-02  2:34 ` [PATCH 5.4 57/64] ALSA: aoa: Fix I2S device accounting Greg Kroah-Hartman
2022-11-02  2:34 ` [PATCH 5.4 58/64] openvswitch: switch from WARN to pr_warn Greg Kroah-Hartman
2022-11-02  2:34 ` [PATCH 5.4 59/64] net: ehea: fix possible memory leak in ehea_register_port() Greg Kroah-Hartman
2022-11-02  2:34 ` [PATCH 5.4 60/64] nh: fix scope used to find saddr when adding non gw nh Greg Kroah-Hartman
2022-11-02  2:34 ` [PATCH 5.4 61/64] net/mlx5e: Do not increment ESN when updating IPsec ESN state Greg Kroah-Hartman
2022-11-02  2:34 ` [PATCH 5.4 62/64] net/mlx5: Fix possible use-after-free in async command interface Greg Kroah-Hartman
2022-11-02  2:34 ` [PATCH 5.4 63/64] net: enetc: survive memory pressure without crashing Greg Kroah-Hartman
2022-11-02  2:34 ` [PATCH 5.4 64/64] can: rcar_canfd: rcar_canfd_handle_global_receive(): fix IRQ storm on global FIFO receive Greg Kroah-Hartman
2022-11-02 10:07 ` [PATCH 5.4 00/64] 5.4.223-rc1 review Jon Hunter
2022-11-02 17:50 ` Florian Fainelli
2022-11-02 20:46 ` Guenter Roeck
2022-11-03  9:18 ` Naresh Kamboju
2022-11-03 12:21 ` Sudip Mukherjee

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20221102022053.018053491@linuxfoundation.org \
    --to=gregkh@linuxfoundation.org \
    --cc=chenzhongjin@huawei.com \
    --cc=jpoimboe@kernel.org \
    --cc=patches@lists.linux.dev \
    --cc=peterz@infradead.org \
    --cc=sashal@kernel.org \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox