1. 26 11月, 2014 1 次提交
    • S
      x86/nmi: Fix use of unallocated cpumask_var_t · db086554
      Sasha Levin 提交于
      Commit "x86/nmi: Perform a safe NMI stack trace on all CPUs" has introduced
      a cpumask_var_t variable:
      
      	+static cpumask_var_t printtrace_mask;
      
      But never allocated it before using it, which caused a NULL ptr deref when
      trying to print the stack trace:
      
      [ 1110.296154] BUG: unable to handle kernel NULL pointer dereference at           (null)
      [ 1110.296169] IP: __memcpy (arch/x86/lib/memcpy_64.S:151)
      [ 1110.296178] PGD 4c34b3067 PUD 4c351b067 PMD 0
      [ 1110.296186] Oops: 0002 [#1] PREEMPT SMP KASAN
      [ 1110.296234] Dumping ftrace buffer:
      [ 1110.296330]    (ftrace buffer empty)
      [ 1110.296339] Modules linked in:
      [ 1110.296345] CPU: 1 PID: 10538 Comm: trinity-c99 Not tainted 3.18.0-rc5-next-20141124-sasha-00058-ge2a8c09-dirty #1499
      [ 1110.296348] task: ffff880152650000 ti: ffff8804c3560000 task.ti: ffff8804c3560000
      [ 1110.296357] RIP: __memcpy (arch/x86/lib/memcpy_64.S:151)
      [ 1110.296360] RSP: 0000:ffff8804c3563870  EFLAGS: 00010246
      [ 1110.296363] RAX: 0000000000000000 RBX: ffffe8fff3c4a809 RCX: 0000000000000000
      [ 1110.296366] RDX: 0000000000000008 RSI: ffffffff9e254040 RDI: 0000000000000000
      [ 1110.296369] RBP: ffff8804c3563908 R08: 0000000000ffffff R09: 0000000000ffffff
      [ 1110.296371] R10: 0000000000000000 R11: 0000000000000006 R12: 0000000000000000
      [ 1110.296375] R13: 0000000000000000 R14: ffffffff9e254040 R15: ffffe8fff3c4a809
      [ 1110.296379] FS:  00007f9e43b0b700(0000) GS:ffff880107e00000(0000) knlGS:0000000000000000
      [ 1110.296382] CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
      [ 1110.296385] CR2: 0000000000000000 CR3: 00000004e4334000 CR4: 00000000000006a0
      [ 1110.296400] Stack:
      [ 1110.296406]  ffffffff81b1e46c 0000000000000000 ffff880107e03fb8 000000000000000b
      [ 1110.296413]  ffff880107dfffc0 ffff880107e03fc0 0000000000000008 ffffffff93f2e9c8
      [ 1110.296419]  0000000000000000 ffffda0020fc07f7 0000000000000008 ffff8804c3563901
      [ 1110.296420] Call Trace:
      [ 1110.296429] ? memcpy (mm/kasan/kasan.c:275)
      [ 1110.296437] ? arch_trigger_all_cpu_backtrace (include/linux/bitmap.h:215 include/linux/cpumask.h:506 arch/x86/kernel/apic/hw_nmi.c:76)
      [ 1110.296444] arch_trigger_all_cpu_backtrace (include/linux/bitmap.h:215 include/linux/cpumask.h:506 arch/x86/kernel/apic/hw_nmi.c:76)
      [ 1110.296451] ? dump_stack (./arch/x86/include/asm/preempt.h:95 lib/dump_stack.c:55)
      [ 1110.296458] do_raw_spin_lock (./arch/x86/include/asm/spinlock.h:86 kernel/locking/spinlock_debug.c:130 kernel/locking/spinlock_debug.c:137)
      [ 1110.296468] _raw_spin_lock (include/linux/spinlock_api_smp.h:143 kernel/locking/spinlock.c:151)
      [ 1110.296474] ? __page_check_address (include/linux/spinlock.h:309 mm/rmap.c:630)
      [ 1110.296481] __page_check_address (include/linux/spinlock.h:309 mm/rmap.c:630)
      [ 1110.296487] ? preempt_count_sub (kernel/sched/core.c:2615)
      [ 1110.296493] try_to_unmap_one (include/linux/rmap.h:202 mm/rmap.c:1146)
      [ 1110.296504] ? anon_vma_interval_tree_iter_next (mm/interval_tree.c:72 mm/interval_tree.c:103)
      [ 1110.296514] rmap_walk (mm/rmap.c:1653 mm/rmap.c:1725)
      [ 1110.296521] ? page_get_anon_vma (include/linux/rcupdate.h:423 include/linux/rcupdate.h:935 mm/rmap.c:435)
      [ 1110.296530] try_to_unmap (mm/rmap.c:1545)
      [ 1110.296536] ? page_get_anon_vma (mm/rmap.c:437)
      [ 1110.296545] ? try_to_unmap_nonlinear (mm/rmap.c:1138)
      [ 1110.296551] ? SyS_msync (mm/rmap.c:1501)
      [ 1110.296558] ? page_remove_rmap (mm/rmap.c:1409)
      [ 1110.296565] ? page_get_anon_vma (mm/rmap.c:448)
      [ 1110.296571] ? anon_vma_ctor (mm/rmap.c:1496)
      [ 1110.296579] migrate_pages (mm/migrate.c:913 mm/migrate.c:956 mm/migrate.c:1136)
      [ 1110.296586] ? _raw_spin_unlock_irq (./arch/x86/include/asm/preempt.h:95 include/linux/spinlock_api_smp.h:169 kernel/locking/spinlock.c:199)
      [ 1110.296593] ? buffer_migrate_lock_buffers (mm/migrate.c:1584)
      [ 1110.296601] ? handle_mm_fault (mm/memory.c:3163 mm/memory.c:3223 mm/memory.c:3336 mm/memory.c:3365)
      [ 1110.296607] migrate_misplaced_page (mm/migrate.c:1738)
      [ 1110.296614] handle_mm_fault (mm/memory.c:3170 mm/memory.c:3223 mm/memory.c:3336 mm/memory.c:3365)
      [ 1110.296623] __do_page_fault (arch/x86/mm/fault.c:1246)
      [ 1110.296630] ? vtime_account_user (kernel/sched/cputime.c:701)
      [ 1110.296638] ? get_parent_ip (kernel/sched/core.c:2559)
      [ 1110.296646] ? context_tracking_user_exit (kernel/context_tracking.c:144)
      [ 1110.296656] trace_do_page_fault (arch/x86/mm/fault.c:1329 include/linux/jump_label.h:114 include/linux/context_tracking_state.h:27 include/linux/context_tracking.h:45 arch/x86/mm/fault.c:1330)
      [ 1110.296664] do_async_page_fault (arch/x86/kernel/kvm.c:280)
      [ 1110.296670] async_page_fault (arch/x86/kernel/entry_64.S:1285)
      [ 1110.296755] Code: 08 4c 8b 54 16 f0 4c 8b 5c 16 f8 4c 89 07 4c 89 4f 08 4c 89 54 17 f0 4c 89 5c 17 f8 c3 90 83 fa 08 72 1b 4c 8b 06 4c 8b 4c 16 f8 <4c> 89 07 4c 89 4c 17 f8 c3 66 2e 0f 1f 84 00 00 00 00 00 83 fa
      All code
      ========
         0:   08 4c 8b 54             or     %cl,0x54(%rbx,%rcx,4)
         4:   16                      (bad)
         5:   f0 4c 8b 5c 16 f8       lock mov -0x8(%rsi,%rdx,1),%r11
         b:   4c 89 07                mov    %r8,(%rdi)
         e:   4c 89 4f 08             mov    %r9,0x8(%rdi)
        12:   4c 89 54 17 f0          mov    %r10,-0x10(%rdi,%rdx,1)
        17:   4c 89 5c 17 f8          mov    %r11,-0x8(%rdi,%rdx,1)
        1c:   c3                      retq
        1d:   90                      nop
        1e:   83 fa 08                cmp    $0x8,%edx
        21:   72 1b                   jb     0x3e
        23:   4c 8b 06                mov    (%rsi),%r8
        26:   4c 8b 4c 16 f8          mov    -0x8(%rsi,%rdx,1),%r9
        2b:*  4c 89 07                mov    %r8,(%rdi)               <-- trapping instruction
        2e:   4c 89 4c 17 f8          mov    %r9,-0x8(%rdi,%rdx,1)
        33:   c3                      retq
        34:   66 2e 0f 1f 84 00 00    nopw   %cs:0x0(%rax,%rax,1)
        3b:   00 00 00
        3e:   83 fa 00                cmp    $0x0,%edx
      
      Code starting with the faulting instruction
      ===========================================
         0:   4c 89 07                mov    %r8,(%rdi)
         3:   4c 89 4c 17 f8          mov    %r9,-0x8(%rdi,%rdx,1)
         8:   c3                      retq
         9:   66 2e 0f 1f 84 00 00    nopw   %cs:0x0(%rax,%rax,1)
        10:   00 00 00
        13:   83 fa 00                cmp    $0x0,%edx
      [ 1110.296760] RIP __memcpy (arch/x86/lib/memcpy_64.S:151)
      [ 1110.296763]  RSP <ffff8804c3563870>
      [ 1110.296765] CR2: 0000000000000000
      
      Link: http://lkml.kernel.org/r/1416931560-10603-1-git-send-email-sasha.levin@oracle.comSigned-off-by: NSasha Levin <sasha.levin@oracle.com>
      Signed-off-by: NSteven Rostedt <rostedt@goodmis.org>
      db086554
  2. 20 11月, 2014 3 次提交
  3. 12 11月, 2014 2 次提交
    • S
      ftrace: Add more information to ftrace_bug() output · 4fd3279b
      Steven Rostedt (Red Hat) 提交于
      With the introduction of the dynamic trampolines, it is useful that if
      things go wrong that ftrace_bug() produces more information about what
      the current state is. This can help debug issues that may arise.
      
      Ftrace has lots of checks to make sure that the state of the system it
      touchs is exactly what it expects it to be. When it detects an abnormality
      it calls ftrace_bug() and disables itself to prevent any further damage.
      It is crucial that ftrace_bug() produces sufficient information that
      can be used to debug the situation.
      
      Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
      Acked-by: NBorislav Petkov <bp@suse.de>
      Tested-by: NMasami Hiramatsu <masami.hiramatsu.pt@hitachi.com>
      Tested-by: NJiri Kosina <jkosina@suse.cz>
      Signed-off-by: NSteven Rostedt <rostedt@goodmis.org>
      4fd3279b
    • S
      ftrace/x86: Allow !CONFIG_PREEMPT dynamic ops to use allocated trampolines · 12cce594
      Steven Rostedt (Red Hat) 提交于
      When the static ftrace_ops (like function tracer) enables tracing, and it
      is the only callback that is referencing a function, a trampoline is
      dynamically allocated to the function that calls the callback directly
      instead of calling a loop function that iterates over all the registered
      ftrace ops (if more than one ops is registered).
      
      But when it comes to dynamically allocated ftrace_ops, where they may be
      freed, on a CONFIG_PREEMPT kernel there's no way to know when it is safe
      to free the trampoline. If a task was preempted while executing on the
      trampoline, there's currently no way to know when it will be off that
      trampoline.
      
      But this is not true when it comes to !CONFIG_PREEMPT. The current method
      of calling schedule_on_each_cpu() will force tasks off the trampoline,
      becaues they can not schedule while on it (kernel preemption is not
      configured). That means it is safe to free a dynamically allocated
      ftrace ops trampoline when CONFIG_PREEMPT is not configured.
      
      Cc: H. Peter Anvin <hpa@linux.intel.com>
      Cc: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
      Acked-by: NBorislav Petkov <bp@suse.de>
      Tested-by: NMasami Hiramatsu <masami.hiramatsu.pt@hitachi.com>
      Tested-by: NJiri Kosina <jkosina@suse.cz>
      Signed-off-by: NSteven Rostedt <rostedt@goodmis.org>
      12cce594
  4. 01 11月, 2014 2 次提交
    • S
      ftrace/x86: Show trampoline call function in enabled_functions · 15d5b02c
      Steven Rostedt (Red Hat) 提交于
      The file /sys/kernel/debug/tracing/eneabled_functions is used to debug
      ftrace function hooks. Add to the output what function is being called
      by the trampoline if the arch supports it.
      
      Add support for this feature in x86_64.
      
      Cc: H. Peter Anvin <hpa@linux.intel.com>
      Tested-by: NMasami Hiramatsu <masami.hiramatsu.pt@hitachi.com>
      Tested-by: NJiri Kosina <jkosina@suse.cz>
      Signed-off-by: NSteven Rostedt <rostedt@goodmis.org>
      15d5b02c
    • S
      ftrace/x86: Add dynamic allocated trampoline for ftrace_ops · f3bea491
      Steven Rostedt (Red Hat) 提交于
      The current method of handling multiple function callbacks is to register
      a list function callback that calls all the other callbacks based on
      their hash tables and compare it to the function that the callback was
      called on. But this is very inefficient.
      
      For example, if you are tracing all functions in the kernel and then
      add a kprobe to a function such that the kprobe uses ftrace, the
      mcount trampoline will switch from calling the function trace callback
      to calling the list callback that will iterate over all registered
      ftrace_ops (in this case, the function tracer and the kprobes callback).
      That means for every function being traced it checks the hash of the
      ftrace_ops for function tracing and kprobes, even though the kprobes
      is only set at a single function. The kprobes ftrace_ops is checked
      for every function being traced!
      
      Instead of calling the list function for functions that are only being
      traced by a single callback, we can call a dynamically allocated
      trampoline that calls the callback directly. The function graph tracer
      already uses a direct call trampoline when it is being traced by itself
      but it is not dynamically allocated. It's trampoline is static in the
      kernel core. The infrastructure that called the function graph trampoline
      can also be used to call a dynamically allocated one.
      
      For now, only ftrace_ops that are not dynamically allocated can have
      a trampoline. That is, users such as function tracer or stack tracer.
      kprobes and perf allocate their ftrace_ops, and until there's a safe
      way to free the trampoline, it can not be used. The dynamically allocated
      ftrace_ops may, although, use the trampoline if the kernel is not
      compiled with CONFIG_PREEMPT. But that will come later.
      Tested-by: NMasami Hiramatsu <masami.hiramatsu.pt@hitachi.com>
      Tested-by: NJiri Kosina <jkosina@suse.cz>
      Signed-off-by: NSteven Rostedt <rostedt@goodmis.org>
      f3bea491
  5. 14 10月, 2014 4 次提交
  6. 08 10月, 2014 3 次提交
  7. 07 10月, 2014 1 次提交
    • A
      x86_64, entry: Filter RFLAGS.NT on entry from userspace · 8c7aa698
      Andy Lutomirski 提交于
      The NT flag doesn't do anything in long mode other than causing IRET
      to #GP.  Oddly, CPL3 code can still set NT using popf.
      
      Entry via hardware or software interrupt clears NT automatically, so
      the only relevant entries are fast syscalls.
      
      If user code causes kernel code to run with NT set, then there's at
      least some (small) chance that it could cause trouble.  For example,
      user code could cause a call to EFI code with NT set, and who knows
      what would happen?  Apparently some games on Wine sometimes do
      this (!), and, if an IRET return happens, they will segfault.  That
      segfault cannot be handled, because signal delivery fails, too.
      
      This patch programs the CPU to clear NT on entry via SYSCALL (both
      32-bit and 64-bit, by my reading of the AMD APM), and it clears NT
      in software on entry via SYSENTER.
      
      To save a few cycles, this borrows a trick from Jan Beulich in Xen:
      it checks whether NT is set before trying to clear it.  As a result,
      it seems to have very little effect on SYSENTER performance on my
      machine.
      
      There's another minor bug fix in here: it looks like the CFI
      annotations were wrong if CONFIG_AUDITSYSCALL=n.
      
      Testers beware: on Xen, SYSENTER with NT set turns into a GPF.
      
      I haven't touched anything on 32-bit kernels.
      
      The syscall mask change comes from a variant of this patch by Anish
      Bhatt.
      
      Note to stable maintainers: there is no known security issue here.
      A misguided program can set NT and cause the kernel to try and fail
      to deliver SIGSEGV, crashing the program.  This patch fixes Far Cry
      on Wine: https://bugs.winehq.org/show_bug.cgi?id=33275
      
      Cc: <stable@vger.kernel.org>
      Reported-by: NAnish Bhatt <anish@chelsio.com>
      Signed-off-by: NAndy Lutomirski <luto@amacapital.net>
      Link: http://lkml.kernel.org/r/395749a5d39a29bd3e4b35899cf3a3c1340e5595.1412189265.git.luto@amacapital.netSigned-off-by: NH. Peter Anvin <hpa@zytor.com>
      8c7aa698
  8. 03 10月, 2014 3 次提交
  9. 24 9月, 2014 18 次提交
  10. 19 9月, 2014 3 次提交