stacktrace/x86: add function for detecting reliable stack traces

For live patching and possibly other use cases, a stack trace is only
useful if it can be assured that it's completely reliable.  Add a new
save_stack_trace_tsk_reliable() function to achieve that.

Note that if the target task isn't the current task, and the target task
is allowed to run, then it could be writing the stack while the unwinder
is reading it, resulting in possible corruption.  So the caller of
save_stack_trace_tsk_reliable() must ensure that the task is either
'current' or inactive.

save_stack_trace_tsk_reliable() relies on the x86 unwinder's detection
of pt_regs on the stack.  If the pt_regs are not user-mode registers
from a syscall, then they indicate an in-kernel interrupt or exception
(e.g. preemption or a page fault), in which case the stack is considered
unreliable due to the nature of frame pointers.

It also relies on the x86 unwinder's detection of other issues, such as:

- corrupted stack data
- stack grows the wrong way
- stack walk doesn't reach the bottom
- user didn't provide a large enough entries array

Such issues are reported by checking unwind_error() and !unwind_done().

Also add CONFIG_HAVE_RELIABLE_STACKTRACE so arch-independent code can
determine at build time whether the function is implemented.

Signed-off-by: Josh Poimboeuf <jpoimboe@redhat.com>
Reviewed-by: Miroslav Benes <mbenes@suse.cz>
Acked-by: Ingo Molnar <mingo@kernel.org>	# for the x86 changes
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

diff --git a/arch/Kconfig b/arch/Kconfig
index cd211a14a88f7774bec3abbe3b371f0302e624a0..6ad00ad73459f3e557c7acc6f4f8f6c196dcd243 100644 (file)
--- a/arch/Kconfig
+++ b/arch/Kconfig
@@ -713,6 +713,12 @@ config HAVE_STACK_VALIDATION
          Architecture supports the 'objtool check' host tool command, which
          performs compile-time stack metadata validation.
 
+config HAVE_RELIABLE_STACKTRACE
+       bool
+       help
+         Architecture has a save_stack_trace_tsk_reliable() function which
+         only returns a stack trace if it can guarantee the trace is reliable.
+
 config HAVE_ARCH_HASH
        bool
        default n

diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index cc98d5a294eee25c56209d92e38bdb08f379780d..2a26852c11b653c8135fd353229bf1ec50da2dc7 100644 (file)
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -160,6 +160,7 @@ config X86
        select HAVE_PERF_REGS
        select HAVE_PERF_USER_STACK_DUMP
        select HAVE_REGS_AND_STACK_ACCESS_API
+       select HAVE_RELIABLE_STACKTRACE         if X86_64 && FRAME_POINTER && STACK_VALIDATION
        select HAVE_STACK_VALIDATION            if X86_64
        select HAVE_SYSCALL_TRACEPOINTS
        select HAVE_UNSTABLE_SCHED_CLOCK

diff --git a/arch/x86/include/asm/unwind.h b/arch/x86/include/asm/unwind.h
index 6fa75b17aec33aea051e1de2aea9199b0f6c836f..137e9cce2ab4d019f9db877472adee37e36009e5 100644 (file)
--- a/arch/x86/include/asm/unwind.h
+++ b/arch/x86/include/asm/unwind.h
@@ -11,6 +11,7 @@ struct unwind_state {
        unsigned long stack_mask;
        struct task_struct *task;
        int graph_idx;
+       bool error;
 #ifdef CONFIG_FRAME_POINTER
        unsigned long *bp, *orig_sp;
        struct pt_regs *regs;
@@ -40,6 +41,11 @@ void unwind_start(struct unwind_state *state, struct task_struct *task,
        __unwind_start(state, task, regs, first_frame);
 }
 
+static inline bool unwind_error(struct unwind_state *state)
+{
+       return state->error;
+}
+
 #ifdef CONFIG_FRAME_POINTER
 
 static inline

diff --git a/arch/x86/kernel/stacktrace.c b/arch/x86/kernel/stacktrace.c
index 8e2b79b88e512f2636ae76075895405c7a2aa2fc..8dabd7bf16730918f1a8c91fcd5df503d73b056a 100644 (file)
--- a/arch/x86/kernel/stacktrace.c
+++ b/arch/x86/kernel/stacktrace.c
@@ -76,6 +76,101 @@ void save_stack_trace_tsk(struct task_struct *tsk, struct stack_trace *trace)
 }
 EXPORT_SYMBOL_GPL(save_stack_trace_tsk);
 
+#ifdef CONFIG_HAVE_RELIABLE_STACKTRACE
+
+#define STACKTRACE_DUMP_ONCE(task) ({                          \
+       static bool __section(.data.unlikely) __dumped;         \
+                                                               \
+       if (!__dumped) {                                        \
+               __dumped = true;                                \
+               WARN_ON(1);                                     \
+               show_stack(task, NULL);                         \
+       }                                                       \
+})
+
+static int __save_stack_trace_reliable(struct stack_trace *trace,
+                                      struct task_struct *task)
+{
+       struct unwind_state state;
+       struct pt_regs *regs;
+       unsigned long addr;
+
+       for (unwind_start(&state, task, NULL, NULL); !unwind_done(&state);
+            unwind_next_frame(&state)) {
+
+               regs = unwind_get_entry_regs(&state);
+               if (regs) {
+                       /*
+                        * Kernel mode registers on the stack indicate an
+                        * in-kernel interrupt or exception (e.g., preemption
+                        * or a page fault), which can make frame pointers
+                        * unreliable.
+                        */
+                       if (!user_mode(regs))
+                               return -EINVAL;
+
+                       /*
+                        * The last frame contains the user mode syscall
+                        * pt_regs.  Skip it and finish the unwind.
+                        */
+                       unwind_next_frame(&state);
+                       if (!unwind_done(&state)) {
+                               STACKTRACE_DUMP_ONCE(task);
+                               return -EINVAL;
+                       }
+                       break;
+               }
+
+               addr = unwind_get_return_address(&state);
+
+               /*
+                * A NULL or invalid return address probably means there's some
+                * generated code which __kernel_text_address() doesn't know
+                * about.
+                */
+               if (!addr) {
+                       STACKTRACE_DUMP_ONCE(task);
+                       return -EINVAL;
+               }
+
+               if (save_stack_address(trace, addr, false))
+                       return -EINVAL;
+       }
+
+       /* Check for stack corruption */
+       if (unwind_error(&state)) {
+               STACKTRACE_DUMP_ONCE(task);
+               return -EINVAL;
+       }
+
+       if (trace->nr_entries < trace->max_entries)
+               trace->entries[trace->nr_entries++] = ULONG_MAX;
+
+       return 0;
+}
+
+/*
+ * This function returns an error if it detects any unreliable features of the
+ * stack.  Otherwise it guarantees that the stack trace is reliable.
+ *
+ * If the task is not 'current', the caller *must* ensure the task is inactive.
+ */
+int save_stack_trace_tsk_reliable(struct task_struct *tsk,
+                                 struct stack_trace *trace)
+{
+       int ret;
+
+       if (!try_get_task_stack(tsk))
+               return -EINVAL;
+
+       ret = __save_stack_trace_reliable(trace, tsk);
+
+       put_task_stack(tsk);
+
+       return ret;
+}
+#endif /* CONFIG_HAVE_RELIABLE_STACKTRACE */
+
 /* Userspace stacktrace - based on kernel/trace/trace_sysprof.c */
 
 struct stack_frame_user {
@@ -138,4 +233,3 @@ void save_stack_trace_user(struct stack_trace *trace)
        if (trace->nr_entries < trace->max_entries)
                trace->entries[trace->nr_entries++] = ULONG_MAX;
 }
-

diff --git a/arch/x86/kernel/unwind_frame.c b/arch/x86/kernel/unwind_frame.c
index 478d15dbaee41b251c8bb28b59183e2b6c733326..5ed43910e04b97cc188ee6546eaf6f21ebafb30c 100644 (file)
--- a/arch/x86/kernel/unwind_frame.c
+++ b/arch/x86/kernel/unwind_frame.c
@@ -225,6 +225,8 @@ bool unwind_next_frame(struct unwind_state *state)
        return true;
 
 bad_address:
+       state->error = true;
+
        /*
         * When unwinding a non-current task, the task might actually be
         * running on another CPU, in which case it could be modifying its

diff --git a/include/linux/stacktrace.h b/include/linux/stacktrace.h
index 0a34489a46b62a4c526e27b39b53d3d571db6727..4205f71a5f0e99e9900ec47de977aed8f6453aaf 100644 (file)
--- a/include/linux/stacktrace.h
+++ b/include/linux/stacktrace.h
@@ -18,6 +18,8 @@ extern void save_stack_trace_regs(struct pt_regs *regs,
                                  struct stack_trace *trace);
 extern void save_stack_trace_tsk(struct task_struct *tsk,
                                struct stack_trace *trace);
+extern int save_stack_trace_tsk_reliable(struct task_struct *tsk,
+                                        struct stack_trace *trace);
 
 extern void print_stack_trace(struct stack_trace *trace, int spaces);
 extern int snprint_stack_trace(char *buf, size_t size,
@@ -29,12 +31,13 @@ extern void save_stack_trace_user(struct stack_trace *trace);
 # define save_stack_trace_user(trace)              do { } while (0)
 #endif
 
-#else
+#else /* !CONFIG_STACKTRACE */
 # define save_stack_trace(trace)                       do { } while (0)
 # define save_stack_trace_tsk(tsk, trace)              do { } while (0)
 # define save_stack_trace_user(trace)                  do { } while (0)
 # define print_stack_trace(trace, spaces)              do { } while (0)
 # define snprint_stack_trace(buf, size, trace, spaces) do { } while (0)
-#endif
+# define save_stack_trace_tsk_reliable(tsk, trace)     ({ -ENOSYS; })
+#endif /* CONFIG_STACKTRACE */
 
-#endif
+#endif /* __LINUX_STACKTRACE_H */

diff --git a/kernel/stacktrace.c b/kernel/stacktrace.c
index 9c15a9124e83b50661414fa425393cdb51866313..f8edee9c792de527cfb968664cc1ae91ea062d1f 100644 (file)
--- a/kernel/stacktrace.c
+++ b/kernel/stacktrace.c
@@ -54,8 +54,8 @@ int snprint_stack_trace(char *buf, size_t size,
 EXPORT_SYMBOL_GPL(snprint_stack_trace);
 
 /*
- * Architectures that do not implement save_stack_trace_tsk or
- * save_stack_trace_regs get this weak alias and a once-per-bootup warning
+ * Architectures that do not implement save_stack_trace_*()
+ * get these weak aliases and once-per-bootup warnings
  * (whenever this facility is utilized - for example by procfs):
  */
 __weak void
@@ -69,3 +69,11 @@ save_stack_trace_regs(struct pt_regs *regs, struct stack_trace *trace)
 {
        WARN_ONCE(1, KERN_INFO "save_stack_trace_regs() not implemented yet.\n");
 }
+
+__weak int
+save_stack_trace_tsk_reliable(struct task_struct *tsk,
+                             struct stack_trace *trace)
+{
+       WARN_ONCE(1, KERN_INFO "save_stack_tsk_reliable() not implemented yet.\n");
+       return -ENOSYS;
+}