Alexandre Ghiti a99a61d9e1 riscv: Use READ_ONCE_NOCHECK in imprecise unwinding stack mode ... [ Upstream commit 76950340cf03b149412fe0d5f0810e52ac1df8cb ] When CONFIG_FRAME_POINTER is unset, the stack unwinding function walk_stackframe randomly reads the stack and then, when KASAN is enabled, it can lead to the following backtrace: [ 0.000000] ================================================================== [ 0.000000] BUG: KASAN: stack-out-of-bounds in walk_stackframe+0xa6/0x11a [ 0.000000] Read of size 8 at addr ffffffff81807c40 by task swapper/0 [ 0.000000] [ 0.000000] CPU: 0 PID: 0 Comm: swapper Not tainted 6.2.0-12919-g24203e6db61f #43 [ 0.000000] Hardware name: riscv-virtio,qemu (DT) [ 0.000000] Call Trace: [ 0.000000] [<ffffffff80007ba8>] walk_stackframe+0x0/0x11a [ 0.000000] [<ffffffff80099ecc>] init_param_lock+0x26/0x2a [ 0.000000] [<ffffffff80007c4a>] walk_stackframe+0xa2/0x11a [ 0.000000] [<ffffffff80c49c80>] dump_stack_lvl+0x22/0x36 [ 0.000000] [<ffffffff80c3783e>] print_report+0x198/0x4a8 [ 0.000000] [<ffffffff80099ecc>] init_param_lock+0x26/0x2a [ 0.000000] [<ffffffff80007c4a>] walk_stackframe+0xa2/0x11a [ 0.000000] [<ffffffff8015f68a>] kasan_report+0x9a/0xc8 [ 0.000000] [<ffffffff80007c4a>] walk_stackframe+0xa2/0x11a [ 0.000000] [<ffffffff80007c4a>] walk_stackframe+0xa2/0x11a [ 0.000000] [<ffffffff8006e99c>] desc_make_final+0x80/0x84 [ 0.000000] [<ffffffff8009a04e>] stack_trace_save+0x88/0xa6 [ 0.000000] [<ffffffff80099fc2>] filter_irq_stacks+0x72/0x76 [ 0.000000] [<ffffffff8006b95e>] devkmsg_read+0x32a/0x32e [ 0.000000] [<ffffffff8015ec16>] kasan_save_stack+0x28/0x52 [ 0.000000] [<ffffffff8006e998>] desc_make_final+0x7c/0x84 [ 0.000000] [<ffffffff8009a04a>] stack_trace_save+0x84/0xa6 [ 0.000000] [<ffffffff8015ec52>] kasan_set_track+0x12/0x20 [ 0.000000] [<ffffffff8015f22e>] __kasan_slab_alloc+0x58/0x5e [ 0.000000] [<ffffffff8015e7ea>] __kmem_cache_create+0x21e/0x39a [ 0.000000] [<ffffffff80e133ac>] create_boot_cache+0x70/0x9c [ 0.000000] [<ffffffff80e17ab2>] kmem_cache_init+0x6c/0x11e [ 0.000000] [<ffffffff80e00fd6>] mm_init+0xd8/0xfe [ 0.000000] [<ffffffff80e011d8>] start_kernel+0x190/0x3ca [ 0.000000] [ 0.000000] The buggy address belongs to stack of task swapper/0 [ 0.000000] and is located at offset 0 in frame: [ 0.000000] stack_trace_save+0x0/0xa6 [ 0.000000] [ 0.000000] This frame has 1 object: [ 0.000000] [32, 56) 'c' [ 0.000000] [ 0.000000] The buggy address belongs to the physical page: [ 0.000000] page:(____ptrval____) refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x81a07 [ 0.000000] flags: 0x1000(reserved|zone=0) [ 0.000000] raw: 0000000000001000 ff600003f1e3d150 ff600003f1e3d150 0000000000000000 [ 0.000000] raw: 0000000000000000 0000000000000000 00000001ffffffff [ 0.000000] page dumped because: kasan: bad access detected [ 0.000000] [ 0.000000] Memory state around the buggy address: [ 0.000000] ffffffff81807b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 0.000000] ffffffff81807b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 0.000000] >ffffffff81807c00: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 00 00 f3 [ 0.000000] ^ [ 0.000000] ffffffff81807c80: f3 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 [ 0.000000] ffffffff81807d00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 0.000000] ================================================================== Fix that by using READ_ONCE_NOCHECK when reading the stack in imprecise mode. Fixes: 5d8544e2d0 ("RISC-V: Generic library routines and assembly") Reported-by: Chathura Rajapaksha <chathura.abeyrathne.lk@gmail.com> Link: https://lore.kernel.org/all/CAD7mqryDQCYyJ1gAmtMm8SASMWAQ4i103ptTb0f6Oda=tPY2=A@mail.gmail.com/ Suggested-by: Dmitry Vyukov <dvyukov@google.com> Signed-off-by: Alexandre Ghiti <alexghiti@rivosinc.com> Link: https://lore.kernel.org/r/20230308091639.602024-1-alexghiti@rivosinc.com Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com> Signed-off-by: Sasha Levin <sashal@kernel.org>		2023-03-17 08:32:52 +01:00
..
vdso	RISC-V: vdso: Do not add missing symbols to version section in linker script	2022-12-08 11:22:57 +01:00
.gitignore	RISC-V: Build Infrastructure	2017-09-26 15:26:49 -07:00
asm-offsets.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 286	2019-06-05 17:36:37 +02:00
cacheinfo.c	drivers: base: cacheinfo: Get rid of DEFINE_SMP_CALL_CACHE_FUNCTION()	2021-09-26 14:07:10 +02:00
cpu.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 286	2019-06-05 17:36:37 +02:00
cpufeature.c	riscv: add missing header file includes	2019-10-28 00:46:01 -07:00
entry.S	riscv,entry: fix misaligned base for excp_vect_table	2021-04-16 11:46:38 +02:00
fpu.S	riscv: Using CSR numbers to access CSRs	2019-08-30 11:04:19 -07:00
ftrace.c	RISC-V: Take text_mutex in ftrace_init_nop()	2020-10-01 13:18:14 +02:00
head.h	riscv: add prototypes for assembly language functions from head.S	2019-10-28 00:46:00 -07:00
head.S	riscv: Set text_offset correctly for M-Mode	2020-11-18 19:20:25 +01:00
irq.c	riscv: for C functions called only from assembly, mark with __visible	2019-10-28 00:46:02 -07:00
Makefile	riscv: Add support for perf registers sampling	2019-09-05 00:48:58 -07:00
mcount-dyn.S	riscv/ftrace: Add DYNAMIC_FTRACE_WITH_REGS support	2018-04-02 19:59:13 -07:00
mcount.S	riscv: Workaround mcount name prior to clang-13	2021-05-22 11:38:29 +02:00
module-sections.c	riscv: add missing header file includes	2019-10-28 00:46:01 -07:00
module.c	riscv: Fix auipc+jalr relocation range checks	2022-03-16 13:21:48 +01:00
module.lds	riscv module: remove (NOLOAD)	2022-04-15 14:18:31 +02:00
perf_callchain.c	riscv: Fix fill_callchain return value	2022-04-15 14:18:00 +02:00
perf_event.c	RISC-V: Access CSRs using CSR numbers	2019-05-16 20:42:11 -07:00
perf_regs.c	riscv: Add support for perf registers sampling	2019-09-05 00:48:58 -07:00
process.c	riscv: process: fix kernel info leakage	2022-11-25 17:42:07 +01:00
ptrace.c	riscv: for C functions called only from assembly, mark with __visible	2019-10-28 00:46:02 -07:00
reset.c	riscv: add missing header file includes	2019-10-28 00:46:01 -07:00
riscv_ksyms.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500	2019-06-19 17:09:55 +02:00
setup.c	riscv: add prototypes for assembly language functions from head.S	2019-10-28 00:46:00 -07:00
signal.c	riscv: for C functions called only from assembly, mark with __visible	2019-10-28 00:46:02 -07:00
smp.c	RISC-V: Fix error code returned by riscv_hartid_to_cpuid()	2021-05-19 10:08:26 +02:00
smpboot.c	riscv: topology: fix default topology reporting	2022-10-29 10:20:36 +02:00
stacktrace.c	riscv: Use READ_ONCE_NOCHECK in imprecise unwinding stack mode	2023-03-17 08:32:52 +01:00
sys_riscv.c	riscv: Allow PROT_WRITE-only mmap()	2022-10-26 13:22:15 +02:00
syscall_table.c	riscv: add missing header file includes	2019-10-28 00:46:01 -07:00
time.c	RISC-V: time: initialize hrtimer based broadcast clock event device	2023-03-11 16:43:42 +01:00
traps.c	exit: Add and use make_task_dead.	2023-02-06 07:52:49 +01:00
vdso.c	riscv: add missing header file includes	2019-10-28 00:46:01 -07:00
vmlinux.lds.S	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 286	2019-06-05 17:36:37 +02:00