[lkml]   [2016]   [Oct]   [14]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: [PATCH v4] kprobes: unpoison stack in jprobe_return() for KASAN
On Fri, Oct 14, 2016 at 01:54:30PM +0200, Dmitry Vyukov wrote:
> KASAN stack instrumentation poisons stack redzones on function entry
> and unpoisons them on function exit. If a function exits abnormally
> (e.g. with a longjmp like jprobe_return()), stack redzones are left
> poisoned. Later this leads to random KASAN false reports.
> Unpoison stack redzones in the frames we are going to jump over
> before doing actual longjmp in jprobe_return().
> Signed-off-by: Dmitry Vyukov <>
> Reviewed-by: Mark Rutland <>

... judging by the kbuild test robot I spoke too soon, and should have
been more thorough. :/

> +/*
> + * Clear all poison for the region between the current SP and a provided
> + * watermark value, as is sometimes required prior to hand-crafted asm function
> + * returns in the middle of functions.
> + */
> +void kasan_unpoison_stack_above_sp_to(const void *watermark)
> +{
> + const void *sp = (void *)current_stack_pointer();

Aargh; it seems current_stack_pointer() is only function-like on some
arches, and not on others (arm64 included). I should have known better;
sorry for the bad suggestion.

I'm not overjoyed about taking the address of a stack variable to
implement this ourselves. Can we use __builtin_frame_address(0) instead?
Or are there cases where that won't work on x86?

> + size_t size = watermark - sp;
> +
> + if (WARN_ON(sp > watermark))
> + return;

... not a new problem, but we should also include <linux/bug.h> for


 \ /
  Last update: 2016-10-14 15:11    [W:0.070 / U:1.136 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site