Messages in this thread |  | | Date | Fri, 14 Oct 2016 14:08:26 +0100 | From | Mark Rutland <> | Subject | Re: [PATCH v4] kprobes: unpoison stack in jprobe_return() for KASAN |
| |
On Fri, Oct 14, 2016 at 01:54:30PM +0200, Dmitry Vyukov wrote: > KASAN stack instrumentation poisons stack redzones on function entry > and unpoisons them on function exit. If a function exits abnormally > (e.g. with a longjmp like jprobe_return()), stack redzones are left > poisoned. Later this leads to random KASAN false reports. > > Unpoison stack redzones in the frames we are going to jump over > before doing actual longjmp in jprobe_return(). > > Signed-off-by: Dmitry Vyukov <dvyukov@google.com> > Reviewed-by: Mark Rutland <mark.rutland@arm.com>
... judging by the kbuild test robot I spoke too soon, and should have been more thorough. :/
> +/* > + * Clear all poison for the region between the current SP and a provided > + * watermark value, as is sometimes required prior to hand-crafted asm function > + * returns in the middle of functions. > + */ > +void kasan_unpoison_stack_above_sp_to(const void *watermark) > +{ > + const void *sp = (void *)current_stack_pointer();
Aargh; it seems current_stack_pointer() is only function-like on some arches, and not on others (arm64 included). I should have known better; sorry for the bad suggestion.
I'm not overjoyed about taking the address of a stack variable to implement this ourselves. Can we use __builtin_frame_address(0) instead? Or are there cases where that won't work on x86?
> + size_t size = watermark - sp; > + > + if (WARN_ON(sp > watermark)) > + return;
... not a new problem, but we should also include <linux/bug.h> for WARN_ON().
Thanks, Mark.
|  |