Re: BUG: KASAN: stack-out-of-bounds in unwind_next_frame+0x1df5/0x2650
From: Josh Poimboeuf <hidden>
Date: 2021-02-04 00:19:06
Also in:
bpf, dm-devel, lkml, netdev
Subsystem:
the rest, x86 architecture (32-bit and 64-bit) · Maintainers:
Linus Torvalds, Thomas Gleixner, Ingo Molnar, Borislav Petkov, Dave Hansen
On Wed, Feb 03, 2021 at 03:30:35PM -0800, Ivan Babrou wrote:
quoted
quoted
quoted
Can you recreate with this patch, and add "unwind_debug" to the cmdline? It will spit out a bunch of stack data.Here's the three I'm building: * https://github.com/bobrik/linux/tree/ivan/static-call-5.9 It contains: * v5.9 tag as the base * static_call-2020-10-12 tag * dm-crypt patches to reproduce the issue with KASAN * x86/unwind: Add 'unwind_debug' cmdline option * tracepoint: Fix race between tracing and removing tracepoint The very same issue can be reproduced on 5.10.11 with no patches, but I'm going with 5.9, since it boils down to static call changes. Here's the decoded stack from the kernel with unwind debug enabled: * https://gist.github.com/bobrik/ed052ac0ae44c880f3170299ad4af56b See my first email for the exact commands that trigger this.Thanks. Do you happen to have the original dmesg, before running it through the post-processing script?Yes, here it is: * https://gist.github.com/bobrik/8c13e6a02555fb21cadabb74cdd6f9ab
It appears the unwinder is getting lost in crypto code. No idea what this has to do with static calls though. Or maybe you're seeing multiple issues. Does this fix it?
diff --git a/arch/x86/crypto/Makefile b/arch/x86/crypto/Makefile
index a31de0c6ccde..36c55341137c 100644
--- a/arch/x86/crypto/Makefile
+++ b/arch/x86/crypto/Makefile@@ -2,7 +2,14 @@ # # x86 crypto algorithms -OBJECT_FILES_NON_STANDARD := y +OBJECT_FILES_NON_STANDARD_sha256-avx2-asm.o := y +OBJECT_FILES_NON_STANDARD_sha512-ssse3-asm.o := y +OBJECT_FILES_NON_STANDARD_sha512-avx-asm.o := y +OBJECT_FILES_NON_STANDARD_sha512-avx2-asm.o := y +OBJECT_FILES_NON_STANDARD_crc32c-pcl-intel-asm_64.o := y +OBJECT_FILES_NON_STANDARD_camellia-aesni-avx2-asm_64.o := y +OBJECT_FILES_NON_STANDARD_sha1_avx2_x86_64_asm.o := y +OBJECT_FILES_NON_STANDARD_sha1_ni_asm.o := y obj-$(CONFIG_CRYPTO_GLUE_HELPER_X86) += glue_helper.o
diff --git a/arch/x86/crypto/aesni-intel_avx-x86_64.S b/arch/x86/crypto/aesni-intel_avx-x86_64.S
index 5fee47956f3b..59c36b88954f 100644
--- a/arch/x86/crypto/aesni-intel_avx-x86_64.S
+++ b/arch/x86/crypto/aesni-intel_avx-x86_64.S@@ -237,8 +237,8 @@ define_reg j %j .noaltmacro .endm -# need to push 4 registers into stack to maintain -STACK_OFFSET = 8*4 +# need to push 5 registers into stack to maintain +STACK_OFFSET = 8*5 TMP1 = 16*0 # Temporary storage for AAD TMP2 = 16*1 # Temporary storage for AES State 2 (State 1 is stored in an XMM register)
@@ -257,6 +257,8 @@ VARIABLE_OFFSET = 16*8 .macro FUNC_SAVE #the number of pushes must equal STACK_OFFSET + push %rbp + mov %rsp, %rbp push %r12 push %r13 push %r14
@@ -271,12 +273,14 @@ VARIABLE_OFFSET = 16*8 .endm .macro FUNC_RESTORE + add $VARIABLE_OFFSET, %rsp mov %r14, %rsp pop %r15 pop %r14 pop %r13 pop %r12 + pop %rbp .endm # Encryption of a single block