From nobody Mon May 11 01:33:16 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A5E80C433F5 for ; Tue, 19 Apr 2022 07:35:23 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1349437AbiDSHiC (ORCPT ); Tue, 19 Apr 2022 03:38:02 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59366 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231706AbiDSHh7 (ORCPT ); Tue, 19 Apr 2022 03:37:59 -0400 Received: from outback3o.mail.yandex.net (outback3o.mail.yandex.net [IPv6:2a02:6b8:0:1a2d::503]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 296DA22535 for ; Tue, 19 Apr 2022 00:35:15 -0700 (PDT) Received: from myt5-5423fe16b941.qloud-c.yandex.net (myt5-5423fe16b941.qloud-c.yandex.net [IPv6:2a02:6b8:c12:2507:0:640:5423:fe16]) by outback3o.mail.yandex.net (Yandex) with ESMTP id B4CF91D1375A; Tue, 19 Apr 2022 10:35:11 +0300 (MSK) Received: from kernel1.search.yandex.net (kernel1.search.yandex.net [2a02:6b8:c02:550:0:604:9094:6282]) by myt5-5423fe16b941.qloud-c.yandex.net (yaback/Yandex) with ESMTP id oGfduu1KhX-ZAre6LNW; Tue, 19 Apr 2022 10:35:10 +0300 X-Yandex-Fwd: 1 Authentication-Results: myt5-5423fe16b941.qloud-c.yandex.net; dkim=pass Received: by kernel1.search.yandex.net (Postfix, from userid 55271) id 58D75560029; Tue, 19 Apr 2022 10:35:10 +0300 (MSK) From: Dmitry Monakhov To: linux-kernel@vger.kernel.org Cc: x86@kernel.org, mingo@redhat.com, jpoimboe@redhat.com, Dmitry Monakhov Subject: [PATCH v3] x86/unwind/orc: Recheck address range after stack info was updated Date: Tue, 19 Apr 2022 10:34:16 +0300 Message-Id: <1650353656-956624-1-git-send-email-dmtrmonakhov@yandex-team.ru> X-Mailer: git-send-email 2.7.4 Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Otherwise crash is possible in case of other bug in IBS handling code which is passing invalid regs to the unwinder. Original OOPS log: BUG: stack guard page was hit at 000000000dd984a2 (stack is 00000000d1caafc= a..00000000613712f0) kernel stack overflow (page fault): 0000 [#1] SMP NOPTI CPU: 93 PID: 23787 Comm: context_switch1 Not tainted 5.4.145 #1 RIP: 0010:unwind_next_frame Call Trace: perf_callchain_kernel get_perf_callchain perf_callchain perf_prepare_sample perf_event_output_forward __perf_event_overflow perf_ibs_handle_irq perf_ibs_nmi_handler nmi_handle default_do_nmi do_nmi end_repeat_nmi Signed-off-by: Dmitry Monakhov --- Changelog: v1->v2: Do not call on_stack() twice for valid range v2->v3: Update commit message accrording to Josh's comments arch/x86/kernel/unwind_orc.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/arch/x86/kernel/unwind_orc.c b/arch/x86/kernel/unwind_orc.c index 794fdef2501a..38185aedf7d1 100644 --- a/arch/x86/kernel/unwind_orc.c +++ b/arch/x86/kernel/unwind_orc.c @@ -339,11 +339,11 @@ static bool stack_access_ok(struct unwind_state *stat= e, unsigned long _addr, struct stack_info *info =3D &state->stack_info; void *addr =3D (void *)_addr; =20 - if (!on_stack(info, addr, len) && - (get_stack_info(addr, state->task, info, &state->stack_mask))) - return false; + if (on_stack(info, addr, len)) + return true; =20 - return true; + return !get_stack_info(addr, state->task, info, &state->stack_mask) && + on_stack(info, addr, len); } =20 static bool deref_stack_reg(struct unwind_state *state, unsigned long addr, --=20 2.7.4