linux_dsm_epyc7002/arch
Josh Poimboeuf 7fbe6ac024 x86/unwind: Fix empty stack dereference in guess unwinder
Vince Waver reported the following bug:

  WARNING: CPU: 0 PID: 21338 at arch/x86/mm/fault.c:435 vmalloc_fault+0x58/0x1f0
  CPU: 0 PID: 21338 Comm: perf_fuzzer Not tainted 4.8.0+ #37
  Hardware name: Hewlett-Packard HP Compaq Pro 6305 SFF/1850, BIOS K06 v02.57 08/16/2013
  Call Trace:
   <NMI>  ? dump_stack+0x46/0x59
   ? __warn+0xd5/0xee
   ? vmalloc_fault+0x58/0x1f0
   ? __do_page_fault+0x6d/0x48e
   ? perf_log_throttle+0xa4/0xf4
   ? trace_page_fault+0x22/0x30
   ? __unwind_start+0x28/0x42
   ? perf_callchain_kernel+0x75/0xac
   ? get_perf_callchain+0x13a/0x1f0
   ? perf_callchain+0x6a/0x6c
   ? perf_prepare_sample+0x71/0x2eb
   ? perf_event_output_forward+0x1a/0x54
   ? __default_send_IPI_shortcut+0x10/0x2d
   ? __perf_event_overflow+0xfb/0x167
   ? x86_pmu_handle_irq+0x113/0x150
   ? native_read_msr+0x6/0x34
   ? perf_event_nmi_handler+0x22/0x39
   ? perf_ibs_nmi_handler+0x4a/0x51
   ? perf_event_nmi_handler+0x22/0x39
   ? nmi_handle+0x4d/0xf0
   ? perf_ibs_handle_irq+0x3d1/0x3d1
   ? default_do_nmi+0x3c/0xd5
   ? do_nmi+0x92/0x102
   ? end_repeat_nmi+0x1a/0x1e
   ? entry_SYSCALL_64_after_swapgs+0x12/0x4a
   ? entry_SYSCALL_64_after_swapgs+0x12/0x4a
   ? entry_SYSCALL_64_after_swapgs+0x12/0x4a
   <EOE> ^A4---[ end trace 632723104d47d31a ]---
  BUG: stack guard page was hit at ffffc90008500000 (stack is ffffc900084fc000..ffffc900084fffff)
  kernel stack overflow (page fault): 0000 [#1] SMP
  ...

The NMI hit in the entry code right after setting up the stack pointer
from 'cpu_current_top_of_stack', so the kernel stack was empty.  The
'guess' version of __unwind_start() attempted to dereference the "top of
stack" pointer, which is not actually *on* the stack.

Add a check in the guess unwinder to deal with an empty stack.  (The
frame pointer unwinder already has such a check.)

Reported-by: Vince Weaver <vincent.weaver@maine.edu>
Signed-off-by: Josh Poimboeuf <jpoimboe@redhat.com>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Arnaldo Carvalho de Melo <acme@kernel.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Fixes: 7c7900f897 ("x86/unwind: Add new unwind interface and implementations")
Link: http://lkml.kernel.org/r/20161024133127.e5evgeebdbohnmpb@treble
Signed-off-by: Ingo Molnar <mingo@kernel.org>
2016-10-25 11:36:43 +02:00
..
alpha Merge branch 'gup_flag-cleanups' 2016-10-19 08:39:47 -07:00
arc Merge branch 'work.uaccess' into for-linus 2016-10-14 20:42:44 -04:00
arm arm/arm64: KVM: Map the BSS at HYP 2016-10-21 17:26:24 +01:00
arm64 KVM fixes for v4.9-rc2 2016-10-21 19:09:29 -07:00
avr32 Merge branch 'akpm' (patches from Andrew) 2016-10-07 21:38:00 -07:00
blackfin Merge branch 'gup_flag-cleanups' 2016-10-19 08:39:47 -07:00
c6x nmi_backtrace: generate one-line reports for idle cpus 2016-10-07 18:46:30 -07:00
cris mm: replace access_process_vm() write parameter with gup_flags 2016-10-19 08:31:25 -07:00
frv Merge branch 'work.uaccess2' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2016-10-11 23:38:39 -07:00
h8300 nmi_backtrace: generate one-line reports for idle cpus 2016-10-07 18:46:30 -07:00
hexagon nmi_backtrace: generate one-line reports for idle cpus 2016-10-07 18:46:30 -07:00
ia64 Merge branch 'gup_flag-cleanups' 2016-10-19 08:39:47 -07:00
m32r mm: replace access_process_vm() write parameter with gup_flags 2016-10-19 08:31:25 -07:00
m68k Merge branch 'kbuild' of git://git.kernel.org/pub/scm/linux/kernel/git/mmarek/kbuild 2016-10-14 14:26:58 -07:00
metag Metag architecture fixes for v4.9-rc1 2016-10-14 11:11:39 -07:00
microblaze Merge branch 'work.uaccess2' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2016-10-11 23:38:39 -07:00
mips KVM fixes for v4.9-rc2 2016-10-21 19:09:29 -07:00
mn10300 Merge branch 'work.uaccess2' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2016-10-11 23:38:39 -07:00
nios2 nios2 update for v4.9-rc1 2016-10-10 11:31:19 -07:00
openrisc Merge branch 'work.uaccess2' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2016-10-11 23:38:39 -07:00
parisc Merge branch 'parisc-4.9-2' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux 2016-10-11 23:59:07 -07:00
powerpc powerpc fixes for 4.9 #3 2016-10-21 19:13:00 -07:00
s390 KVM fixes for v4.9-rc2 2016-10-21 19:09:29 -07:00
score Merge branch 'gup_flag-cleanups' 2016-10-19 08:39:47 -07:00
sh Minor changes to improve J2 support and match Kconfig expectations of 2016-10-19 11:21:06 -07:00
sparc Merge branch 'gup_flag-cleanups' 2016-10-19 08:39:47 -07:00
tile tile: use simpler API for random address requests 2016-10-11 15:06:32 -07:00
um nmi_backtrace: generate one-line reports for idle cpus 2016-10-07 18:46:30 -07:00
unicore32 unicore32: use simpler API for random address requests 2016-10-11 15:06:32 -07:00
x86 x86/unwind: Fix empty stack dereference in guess unwinder 2016-10-25 11:36:43 +02:00
xtensa Merge branch 'work.uaccess2' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2016-10-11 23:38:39 -07:00
.gitignore
Kconfig This adds a new gcc plugin named "latent_entropy". It is designed to 2016-10-15 10:03:15 -07:00