x86: Prevent KASAN false positive warnings in __show_regs

[PATCH -next v2] x86: Prevent KASAN false positive warnings in __show_regs

Posted by Tengda Wu 1 month ago

When task A walks task B's stack without suspending it, the continuous
changes in task B's stack (and corresponding KASAN shadow tags) may cause
task A to hit KASAN redzones when accessing obsolete `regs->` contents,
resulting in false positive reports. [1][2]

The specific issue occurs as follows:

Task A (walk other task's stack)            Task B (running)
1. echo t > /proc/sysrq-trigger

show_trace_log_lvl
  regs = unwind_get_entry_regs()
  show_regs_if_on_stack(regs)
                                            2. The stack data pointed by
                                               `regs` keeps changing, and
                                               so are the tags in its
                                               KASAN shadow region.
    __show_regs(regs)
      regs->ax, regs->bx, ...
        3. hit KASAN redzones, OOB

Fix this by detecting asynchronous stack unwinding scenarios through
checking whether the `regs` are located in the current task's stack
during unwinding, and disabling KASAN checks when this scenario occurs.

[1] https://lore.kernel.org/all/000000000000cb8e3a05c4ed84bb@google.com/
[2] KASAN out-of-bounds:
[332706.552324] BUG: KASAN: out-of-bounds in __show_regs+0x4b/0x340
[332706.552433] Read of size 8 at addr ffff88d24999fb20 by task sysrq_t_test.sh/3977032
[332706.552562]
[332706.552652] CPU: 36 PID: 3977032 Comm: sysrq_t_test.sh Kdump: loaded Not tainted 6.6.0+ #20
[332706.552783] Hardware name: Huawei RH2288H V3/BC11HGSA0, BIOS 3.35 10/20/2016
[332706.552906] Call Trace:
[332706.552998]  <TASK>
[332706.553089]  dump_stack_lvl+0x32/0x50
[332706.553193]  print_address_description.constprop.0+0x6b/0x3d0
[332706.553303]  print_report+0xbe/0x280
[332706.553409]  ? __virt_addr_valid+0xed/0x160
[332706.553512]  ? __show_regs+0x4b/0x340
[332706.553612]  kasan_report+0xa8/0xe0
[332706.553716]  ? __show_regs+0x4b/0x340
[332706.553816]  ? asm_exc_page_fault+0x22/0x30
[332706.553919]  __show_regs+0x4b/0x340
[332706.554021]  ? asm_exc_page_fault+0x22/0x30
[332706.554123]  show_trace_log_lvl+0x274/0x3b0
[332706.554229]  ? load_elf_binary+0xf6e/0x1610
[332706.554330]  ? rep_stos_alternative+0x40/0x80
[332706.554439]  sched_show_task+0x211/0x290
[332706.554544]  ? __pfx_sched_show_task+0x10/0x10
[332706.554648]  ? _find_next_bit+0x6/0xc0
[332706.554749]  ? _find_next_bit+0x37/0xc0
[332706.554852]  show_state_filter+0x72/0x130
[332706.554956]  sysrq_handle_showstate+0x7/0x10
[332706.555062]  __handle_sysrq+0x146/0x2d0
[332706.555165]  write_sysrq_trigger+0x2f/0x50
[332706.555270]  proc_reg_write+0xdd/0x140
[332706.555372]  vfs_write+0x1ff/0x5f0
[332706.555474]  ? __pfx_vfs_write+0x10/0x10
[332706.555576]  ? __pfx___handle_mm_fault+0x10/0x10
[332706.555682]  ? __fget_light+0x99/0xf0
[332706.555785]  ksys_write+0xb8/0x150
[332706.555887]  ? __pfx_ksys_write+0x10/0x10
[332706.555989]  ? ktime_get_coarse_real_ts64+0x4e/0x70
[332706.556094]  do_syscall_64+0x55/0x100
[332706.556196]  entry_SYSCALL_64_after_hwframe+0x78/0xe2

Fixes: 3b3fa11bc700 ("x86/dumpstack: Print any pt_regs found on the stack")
Signed-off-by: Tengda Wu <wutengda@huaweicloud.com>
---
v2: Use kasan_disable_current() instead of __no_sanitize_address.
v1: https://lore.kernel.org/all/20250818130715.2904264-1-wutengda@huaweicloud.com/

 arch/x86/kernel/dumpstack.c | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/arch/x86/kernel/dumpstack.c b/arch/x86/kernel/dumpstack.c
index 71ee20102a8a..5413534de490 100644
--- a/arch/x86/kernel/dumpstack.c
+++ b/arch/x86/kernel/dumpstack.c
@@ -152,6 +152,18 @@ void show_iret_regs(struct pt_regs *regs, const char *log_lvl)
 static void show_regs_if_on_stack(struct stack_info *info, struct pt_regs *regs,
 				  bool partial, const char *log_lvl)
 {
+	bool kasan_disabled = false;
+
+	/*
+	 * When 'regs' resides in another task's stack space, KASAN should be
+	 * disabled to prevent false positives during 'regs->' operation, as
+	 * the 'regs' contents may change concurrently with task execution.
+	 */
+	if (!object_is_on_stack(regs)) {
+		kasan_disable_current();
+		kasan_disabled = true;
+	}
+
 	/*
 	 * These on_stack() checks aren't strictly necessary: the unwind code
 	 * has already validated the 'regs' pointer.  The checks are done for
@@ -173,6 +185,9 @@ static void show_regs_if_on_stack(struct stack_info *info, struct pt_regs *regs,
 		 */
 		show_iret_regs(regs, log_lvl);
 	}
+
+	if (kasan_disabled)
+		kasan_enable_current();
 }
 
 /*
-- 
2.34.1

Re: [PATCH -next v2] x86: Prevent KASAN false positive warnings in __show_regs

Posted by Josh Poimboeuf 1 month ago

On Fri, Aug 29, 2025 at 09:47:44AM +0000, Tengda Wu wrote:
>  static void show_regs_if_on_stack(struct stack_info *info, struct pt_regs *regs,
>  				  bool partial, const char *log_lvl)
>  {
> +	bool kasan_disabled = false;
> +
> +	/*
> +	 * When 'regs' resides in another task's stack space, KASAN should be
> +	 * disabled to prevent false positives during 'regs->' operation, as
> +	 * the 'regs' contents may change concurrently with task execution.
> +	 */
> +	if (!object_is_on_stack(regs)) {
> +		kasan_disable_current();
> +		kasan_disabled = true;
> +	}

I don't think this is right.  object_is_on_stack() only checks current's
*task* stack.  However the regs might be on a different stack used by
current (e.g., exception stack).  In which case there's no need to
disable KASAN.

What really determines the KASAN-safety is whether it's the current task
or not.

-- 
Josh

Re: [PATCH -next v2] x86: Prevent KASAN false positive warnings in __show_regs

Posted by Tengda Wu 1 month ago


On 2025/8/30 5:01, Josh Poimboeuf wrote:
> On Fri, Aug 29, 2025 at 09:47:44AM +0000, Tengda Wu wrote:
>>  static void show_regs_if_on_stack(struct stack_info *info, struct pt_regs *regs,
>>  				  bool partial, const char *log_lvl)
>>  {
>> +	bool kasan_disabled = false;
>> +
>> +	/*
>> +	 * When 'regs' resides in another task's stack space, KASAN should be
>> +	 * disabled to prevent false positives during 'regs->' operation, as
>> +	 * the 'regs' contents may change concurrently with task execution.
>> +	 */
>> +	if (!object_is_on_stack(regs)) {
>> +		kasan_disable_current();
>> +		kasan_disabled = true;
>> +	}
> 
> I don't think this is right.  object_is_on_stack() only checks current's
> *task* stack.  However the regs might be on a different stack used by
> current (e.g., exception stack).  In which case there's no need to
> disable KASAN.
> 
> What really determines the KASAN-safety is whether it's the current task
> or not.
> 

I see.

Since operations walking other tasks' regs-> only occur in show_regs_if_on_stack,
to cover a more accurate range and targets, it seems we have no choice but to add
a task parameter to show_regs_if_on_stack and then perform the check, right?

Re: [PATCH -next v2] x86: Prevent KASAN false positive warnings in __show_regs

Posted by Josh Poimboeuf 1 month ago

On Sat, Aug 30, 2025 at 09:34:59AM +0800, Tengda Wu wrote:
> 
> 
> On 2025/8/30 5:01, Josh Poimboeuf wrote:
> > On Fri, Aug 29, 2025 at 09:47:44AM +0000, Tengda Wu wrote:
> >>  static void show_regs_if_on_stack(struct stack_info *info, struct pt_regs *regs,
> >>  				  bool partial, const char *log_lvl)
> >>  {
> >> +	bool kasan_disabled = false;
> >> +
> >> +	/*
> >> +	 * When 'regs' resides in another task's stack space, KASAN should be
> >> +	 * disabled to prevent false positives during 'regs->' operation, as
> >> +	 * the 'regs' contents may change concurrently with task execution.
> >> +	 */
> >> +	if (!object_is_on_stack(regs)) {
> >> +		kasan_disable_current();
> >> +		kasan_disabled = true;
> >> +	}
> > 
> > I don't think this is right.  object_is_on_stack() only checks current's
> > *task* stack.  However the regs might be on a different stack used by
> > current (e.g., exception stack).  In which case there's no need to
> > disable KASAN.
> > 
> > What really determines the KASAN-safety is whether it's the current task
> > or not.
> > 
> 
> I see.
> 
> Since operations walking other tasks' regs-> only occur in show_regs_if_on_stack,
> to cover a more accurate range and targets, it seems we have no choice but to add
> a task parameter to show_regs_if_on_stack and then perform the check, right?

Reading another task's stack while it's running is problematic in
general -- not only for reading saved regs, but for reading any other
values on the stack.  So why not just do it in show_trace_log_lvl()?

-- 
Josh

Re: [PATCH -next v2] x86: Prevent KASAN false positive warnings in __show_regs

Posted by Tengda Wu 1 month ago


On 2025/8/30 10:18, Josh Poimboeuf wrote:
> On Sat, Aug 30, 2025 at 09:34:59AM +0800, Tengda Wu wrote:
>>
>>
>> On 2025/8/30 5:01, Josh Poimboeuf wrote:
>>> On Fri, Aug 29, 2025 at 09:47:44AM +0000, Tengda Wu wrote:
>>>>  static void show_regs_if_on_stack(struct stack_info *info, struct pt_regs *regs,
>>>>  				  bool partial, const char *log_lvl)
>>>>  {
>>>> +	bool kasan_disabled = false;
>>>> +
>>>> +	/*
>>>> +	 * When 'regs' resides in another task's stack space, KASAN should be
>>>> +	 * disabled to prevent false positives during 'regs->' operation, as
>>>> +	 * the 'regs' contents may change concurrently with task execution.
>>>> +	 */
>>>> +	if (!object_is_on_stack(regs)) {
>>>> +		kasan_disable_current();
>>>> +		kasan_disabled = true;
>>>> +	}
>>>
>>> I don't think this is right.  object_is_on_stack() only checks current's
>>> *task* stack.  However the regs might be on a different stack used by
>>> current (e.g., exception stack).  In which case there's no need to
>>> disable KASAN.
>>>
>>> What really determines the KASAN-safety is whether it's the current task
>>> or not.
>>>
>>
>> I see.
>>
>> Since operations walking other tasks' regs-> only occur in show_regs_if_on_stack,
>> to cover a more accurate range and targets, it seems we have no choice but to add
>> a task parameter to show_regs_if_on_stack and then perform the check, right?
> 
> Reading another task's stack while it's running is problematic in
> general -- not only for reading saved regs, but for reading any other
> values on the stack.  So why not just do it in show_trace_log_lvl()?
> 

Theoretically, that's correct. I was too focused on the regs itself and overlooked
this fact. Additionally, I just discovered a potentially missed fix: there is also
code in show_trace_log_lvl that directly accesses regs->:

		if (regs && stack == &regs->ip)
			goto next;

Simply disabling KASAN within show_regs_if_on_stack is indeed insufficient.

Thank you very much for the reminder. I will send out a v3 to move the KASAN check
back into show_trace_log_lvl.

-- Tengda

Re: [PATCH -next v2] x86: Prevent KASAN false positive warnings in __show_regs

Posted by Andrey Ryabinin 1 month ago


On 8/29/25 11:47 AM, Tengda Wu wrote:
> When task A walks task B's stack without suspending it, the continuous
> changes in task B's stack (and corresponding KASAN shadow tags) may cause
> task A to hit KASAN redzones when accessing obsolete `regs->` contents,
> resulting in false positive reports. [1][2]
> 
> The specific issue occurs as follows:
> 
> Task A (walk other task's stack)            Task B (running)
> 1. echo t > /proc/sysrq-trigger
> 
> show_trace_log_lvl
>   regs = unwind_get_entry_regs()
>   show_regs_if_on_stack(regs)
>                                             2. The stack data pointed by
>                                                `regs` keeps changing, and
>                                                so are the tags in its
>                                                KASAN shadow region.
>     __show_regs(regs)
>       regs->ax, regs->bx, ...
>         3. hit KASAN redzones, OOB
> 
> Fix this by detecting asynchronous stack unwinding scenarios through
> checking whether the `regs` are located in the current task's stack
> during unwinding, and disabling KASAN checks when this scenario occurs.
> 
> [1] https://lore.kernel.org/all/000000000000cb8e3a05c4ed84bb@google.com/
> [2] KASAN out-of-bounds:
> [332706.552324] BUG: KASAN: out-of-bounds in __show_regs+0x4b/0x340
> [332706.552433] Read of size 8 at addr ffff88d24999fb20 by task sysrq_t_test.sh/3977032
> [332706.552562]
> [332706.552652] CPU: 36 PID: 3977032 Comm: sysrq_t_test.sh Kdump: loaded Not tainted 6.6.0+ #20
> [332706.552783] Hardware name: Huawei RH2288H V3/BC11HGSA0, BIOS 3.35 10/20/2016
> [332706.552906] Call Trace:
> [332706.552998]  <TASK>
> [332706.553089]  dump_stack_lvl+0x32/0x50
> [332706.553193]  print_address_description.constprop.0+0x6b/0x3d0
> [332706.553303]  print_report+0xbe/0x280
> [332706.553409]  ? __virt_addr_valid+0xed/0x160
> [332706.553512]  ? __show_regs+0x4b/0x340
> [332706.553612]  kasan_report+0xa8/0xe0
> [332706.553716]  ? __show_regs+0x4b/0x340
> [332706.553816]  ? asm_exc_page_fault+0x22/0x30
> [332706.553919]  __show_regs+0x4b/0x340
> [332706.554021]  ? asm_exc_page_fault+0x22/0x30
> [332706.554123]  show_trace_log_lvl+0x274/0x3b0
> [332706.554229]  ? load_elf_binary+0xf6e/0x1610
> [332706.554330]  ? rep_stos_alternative+0x40/0x80
> [332706.554439]  sched_show_task+0x211/0x290
> [332706.554544]  ? __pfx_sched_show_task+0x10/0x10
> [332706.554648]  ? _find_next_bit+0x6/0xc0
> [332706.554749]  ? _find_next_bit+0x37/0xc0
> [332706.554852]  show_state_filter+0x72/0x130
> [332706.554956]  sysrq_handle_showstate+0x7/0x10
> [332706.555062]  __handle_sysrq+0x146/0x2d0
> [332706.555165]  write_sysrq_trigger+0x2f/0x50
> [332706.555270]  proc_reg_write+0xdd/0x140
> [332706.555372]  vfs_write+0x1ff/0x5f0
> [332706.555474]  ? __pfx_vfs_write+0x10/0x10
> [332706.555576]  ? __pfx___handle_mm_fault+0x10/0x10
> [332706.555682]  ? __fget_light+0x99/0xf0
> [332706.555785]  ksys_write+0xb8/0x150
> [332706.555887]  ? __pfx_ksys_write+0x10/0x10
> [332706.555989]  ? ktime_get_coarse_real_ts64+0x4e/0x70
> [332706.556094]  do_syscall_64+0x55/0x100
> [332706.556196]  entry_SYSCALL_64_after_hwframe+0x78/0xe2
> 
> Fixes: 3b3fa11bc700 ("x86/dumpstack: Print any pt_regs found on the stack")
> Signed-off-by: Tengda Wu <wutengda@huaweicloud.com>

Reviewed-by: Andrey Ryabinin <ryabinin.a.a@gmail.com>