From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pf1-f175.google.com (mail-pf1-f175.google.com [209.85.210.175]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B8F6A31B118 for ; Mon, 10 Nov 2025 16:37:48 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.175 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1762792670; cv=none; b=Ef/cBVvGiiCEr0GSPBXTYZoBGZIevtSptOwxF11wAfqUr+LcbGKFkTUYOlZ/eln5U6YnMxsls3f6EzVHZWmVTgCGYEv9diargFhzH4Ax/5t2bmE4kyRcOOcVIELPKPmuBizHZ/C7kynCORJ11HeM/Gy9MFcqLm0bVMWvarP0Nzc= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1762792670; c=relaxed/simple; bh=e4vkEHA+9PTiYMh5yLQWM+MeyKZuslfqcgr629D3+7E=; h=From:To:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Im4Cwwq7ZmOj8K+IbwZ14HRlradHFHZo5BnDIxCxRrZgvvAJV/T41/9lJVXrHxF3Uh8plMLDd222rRE5q0C3SB9APDt1XS4MV4g+z3gK3NN79x04IZE5cxDRUgjY57XPM8lkGFlkWiF7CpBBcQ6bRyGOjkokA02lVkzhg3Q7dkc= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=NWsClEav; arc=none smtp.client-ip=209.85.210.175 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="NWsClEav" Received: by mail-pf1-f175.google.com with SMTP id d2e1a72fcca58-782e93932ffso2676563b3a.3 for ; Mon, 10 Nov 2025 08:37:48 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1762792668; x=1763397468; darn=lists.linux.dev; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to; bh=mbgbln0r/0DljbZ66YwwMMl7cTrgB9t9J30U0WpMJ+k=; b=NWsClEavJkv3CeMKBhYp9W4/AM1ljs6o8JWUN4c3x8PQFZUItmKnXfFlGaVsAl8Ib7 7ZAcBmYAHGycTTfJbUvasjLRyO4K1nG6K46MhooBJFs1BUnM+lW7XyzusUbrt/C0h6bW +tWZKJU3oRn0Mh+EnZl29fn1Au477I8lnGpPv2r2Q4ut4nWvpGyzqKTe8maTPEJxiLOy x5Hyp6kTCJZARr9ZYMh3wiGqNDeZgxNs4LjbgAUx9wZ4aT/8PDuP+qE2sC05qyM58Js2 EMKfKW57uSZIe2CP83KIMpIyHUxa+biqf1xbEGLyenqfSX8FN7AKQBeescrY4ZEvuwFA mjig== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1762792668; x=1763397468; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=mbgbln0r/0DljbZ66YwwMMl7cTrgB9t9J30U0WpMJ+k=; b=F7jnNrFC5kIglkl92pEmcGK88xd55pvpCeV6dc5dSXwDU1plEVpTzQ/JR/9uLdf0bz 4nmuBJLUZBT+ddeWXoNbek7o5Yp7RSGujmUjlrlg+Je2evQDsK4K3WJhQzOkcZl5SY8l 0j3WQnMPsyudVptr1MyWM0JCyto984akMQ0DggcZaD72EXF/jzPOBhnnuvYe+vBriwHZ EAntFlkq/4O18U9JV4mAqdaBSFDiRRY2uCCNwvV2jIlZCXPPhAYePoDWTaecvAROHci6 K6yMjvCXmOrmgO45fV/tbf+0VHjtwYyFVCDdctrHJFwFsPzdDacsz4AmuOsHzq9iq6wH 12fg== X-Forwarded-Encrypted: i=1; AJvYcCUqp+j+Ga2W/TaeA8q/fG0rJt4b/YbhgPmjSQokEOw0uTI5ZRCj6aKUiRr2n6Woglm9MjIq@lists.linux.dev X-Gm-Message-State: AOJu0Ywoozz903KFwerNCkcsXLu31Cd1H7ouJ5JAAJ93TN0mwdGDd4wK sRNPVQBDItLEG5977HJZmNqYgGUUOA63cTNvFTjLiZHSB9yEgO+C/ZxL X-Gm-Gg: ASbGnctBZ5O0BA70VsnnVNOL3lRHI7mBXIjNpKLdgr9+79KiJcDy2FHpke+VdWZGgDL F2ZjupZV8f8DREdN02lAYXChyyYPgfJhZyHNc+gTNzpqqLgrE/CCcl070JneV3LP9iWcBxMRBMP BM5zSdZgyKdgb/b0p15Y+S6/NhjqSuY4x621EQQInjtfsgW+76oGmlb0lRF1eXHfu4Mq4Ib0+le QZCPmswMaipste5KhT9GVKzBf3r/7K+XCVbjfU+W4U6TzYplZxI02uhoQs0bXJFQtDWP8ZpqlOi 7y/zAMJ8tO4rb90LoHK9Rs7Vn5xTKvEM5ThScnl0nkEc193LvujMktos6ffDrTL9EEc8AgpCxfv YPVh04ksuC7i4BPX5d5OXClnl+1TZRG48mHXtxIlcd0LQ6bbnCKVkEmabUTnoKVG/FrewGs7aC7 DcKymoTp4uQa4= X-Google-Smtp-Source: AGHT+IF9D2s5oh2IOSIoqnbGH6eyisWVL5PhHGPCW6i2QHK95VMIMn4wu9hvntS0Aig4CKNxr1HiEw== X-Received: by 2002:a17:902:ebc1:b0:294:cc8d:c0c2 with SMTP id d9443c01a7336-297e5663a67mr107303455ad.27.1762792667923; Mon, 10 Nov 2025 08:37:47 -0800 (PST) Received: from localhost ([103.88.46.62]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-29651c92cddsm154610615ad.83.2025.11.10.08.37.46 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 10 Nov 2025 08:37:47 -0800 (PST) From: Jinchao Wang To: Andrew Morton , "Masami Hiramatsu (Google)" , Peter Zijlstra , Randy Dunlap , Marco Elver , Mike Rapoport , Alexander Potapenko , Adrian Hunter , Alexander Shishkin , Alice Ryhl , Andrey Konovalov , Andrey Ryabinin , Andrii Nakryiko , Ard Biesheuvel , Arnaldo Carvalho de Melo , Ben Segall , Bill Wendling , Borislav Petkov , Catalin Marinas , Dave Hansen , David Hildenbrand , David Kaplan , "David S. Miller" , Dietmar Eggemann , Dmitry Vyukov , "H. Peter Anvin" , Ian Rogers , Ingo Molnar , James Clark , Jinchao Wang , Jinjie Ruan , Jiri Olsa , Jonathan Corbet , Juri Lelli , Justin Stitt , kasan-dev@googlegroups.com, Kees Cook , "Liam R. Howlett" , "Liang Kan" , Linus Walleij , linux-arm-kernel@lists.infradead.org, linux-doc@vger.kernel.org, linux-kernel@vger.kernel.org, linux-mm@kvack.org, linux-perf-users@vger.kernel.org, linux-trace-kernel@vger.kernel.org, llvm@lists.linux.dev, Lorenzo Stoakes , Mark Rutland , Masahiro Yamada , Mathieu Desnoyers , Mel Gorman , Michal Hocko , Miguel Ojeda , Nam Cao , Namhyung Kim , Nathan Chancellor , Naveen N Rao , Nick Desaulniers , Rong Xu , Sami Tolvanen , Steven Rostedt , Suren Baghdasaryan , Thomas Gleixner , =?UTF-8?q?Thomas=20Wei=C3=9Fschuh?= , Valentin Schneider , Vincent Guittot , Vincenzo Frascino , Vlastimil Babka , Will Deacon , workflows@vger.kernel.org, x86@kernel.org Subject: [PATCH v8 15/27] mm/ksw: limit canary search to current stack frame Date: Tue, 11 Nov 2025 00:36:10 +0800 Message-ID: <20251110163634.3686676-16-wangjinchao600@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20251110163634.3686676-1-wangjinchao600@gmail.com> References: <20251110163634.3686676-1-wangjinchao600@gmail.com> Precedence: bulk X-Mailing-List: llvm@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Use the compiler-provided frame pointer when CONFIG_FRAME_POINTER is enabled to restrict the stack canary search range to the current function frame. This prevents scanning beyond valid stack bounds and improves reliability across architectures. Also add explicit handling for missing CONFIG_STACKPROTECTOR and make the failure message more visible. Signed-off-by: Jinchao Wang --- mm/kstackwatch/stack.c | 29 +++++++++++++++++++++-------- 1 file changed, 21 insertions(+), 8 deletions(-) diff --git a/mm/kstackwatch/stack.c b/mm/kstackwatch/stack.c index 60371b292915..3455d1e70db9 100644 --- a/mm/kstackwatch/stack.c +++ b/mm/kstackwatch/stack.c @@ -64,15 +64,32 @@ static unsigned long ksw_find_stack_canary_addr(struct pt_regs *regs) unsigned long *stack_ptr, *stack_end, *stack_base; unsigned long expected_canary; unsigned int i; +#ifdef CONFIG_FRAME_POINTER + unsigned long *fp = NULL; +#endif stack_ptr = (unsigned long *)kernel_stack_pointer(regs); - stack_base = (unsigned long *)(current->stack); - // TODO: limit it to the current frame stack_end = (unsigned long *)((char *)current->stack + THREAD_SIZE); +#ifdef CONFIG_FRAME_POINTER + /* + * Use the compiler-provided frame pointer. + * Limit the search to the current frame + * Works on any arch that keeps FP when CONFIG_FRAME_POINTER=y. + */ + fp = __builtin_frame_address(0); + if (fp > stack_ptr && fp < stack_end) + stack_end = fp; +#endif + +#ifdef CONFIG_STACKPROTECTOR expected_canary = current->stack_canary; +#else + pr_err("no canary without CONFIG_STACKPROTECTOR\n"); + return 0; +#endif if (stack_ptr < stack_base || stack_ptr >= stack_end) { pr_err("Stack pointer 0x%lx out of bounds [0x%lx, 0x%lx)\n", @@ -85,15 +102,11 @@ static unsigned long ksw_find_stack_canary_addr(struct pt_regs *regs) if (&stack_ptr[i] >= stack_end) break; - if (stack_ptr[i] == expected_canary) { - pr_debug("canary found i:%d 0x%lx\n", i, - (unsigned long)&stack_ptr[i]); + if (stack_ptr[i] == expected_canary) return (unsigned long)&stack_ptr[i]; - } } - pr_debug("canary not found in first %d steps\n", - MAX_CANARY_SEARCH_STEPS); + pr_err("canary not found in first %d steps\n", MAX_CANARY_SEARCH_STEPS); return 0; } -- 2.43.0