svn commit: r368455 - in head/sys: arm64/arm64 arm64/include cddl/dev/dtrace/aarch64 cddl/dev/fbt

John Baldwin jhb at FreeBSD.org
Tue Dec 8 18:01:00 UTC 2020


Author: jhb
Date: Tue Dec  8 18:00:58 2020
New Revision: 368455
URL: https://svnweb.freebsd.org/changeset/base/368455

Log:
  Check that the frame pointer is within the current stack.
  
  This same check is used on other architectures.  Previously this would
  permit a stack frame to unwind into any arbitrary kernel address
  (including unmapped addresses).
  
  Reviewed by:	andrew, markj
  Obtained from:	CheriBSD
  Sponsored by:	DARPA
  Differential Revision:	https://reviews.freebsd.org/D27362

Modified:
  head/sys/arm64/arm64/db_trace.c
  head/sys/arm64/arm64/stack_machdep.c
  head/sys/arm64/arm64/unwind.c
  head/sys/arm64/include/csan.h
  head/sys/arm64/include/stack.h
  head/sys/cddl/dev/dtrace/aarch64/dtrace_isa.c
  head/sys/cddl/dev/fbt/fbt.c

Modified: head/sys/arm64/arm64/db_trace.c
==============================================================================
--- head/sys/arm64/arm64/db_trace.c	Tue Dec  8 17:57:18 2020	(r368454)
+++ head/sys/arm64/arm64/db_trace.c	Tue Dec  8 18:00:58 2020	(r368455)
@@ -65,7 +65,7 @@ db_md_set_watchpoint(db_expr_t addr, db_expr_t size)
 }
 
 static void
-db_stack_trace_cmd(struct unwind_state *frame)
+db_stack_trace_cmd(struct thread *td, struct unwind_state *frame)
 {
 	c_db_sym_t sym;
 	const char *name;
@@ -74,10 +74,8 @@ db_stack_trace_cmd(struct unwind_state *frame)
 
 	while (1) {
 		uintptr_t pc = frame->pc;
-		int ret;
 
-		ret = unwind_frame(frame);
-		if (ret < 0)
+		if (!unwind_frame(td, frame))
 			break;
 
 		sym = db_search_symbol(pc, DB_STGY_ANY, &offset);
@@ -112,7 +110,7 @@ db_trace_thread(struct thread *thr, int count)
 		frame.sp = (uintptr_t)ctx->pcb_sp;
 		frame.fp = (uintptr_t)ctx->pcb_x[29];
 		frame.pc = (uintptr_t)ctx->pcb_x[30];
-		db_stack_trace_cmd(&frame);
+		db_stack_trace_cmd(thr, &frame);
 	} else
 		db_trace_self();
 	return (0);
@@ -129,5 +127,5 @@ db_trace_self(void)
 	frame.sp = sp;
 	frame.fp = (uintptr_t)__builtin_frame_address(0);
 	frame.pc = (uintptr_t)db_trace_self;
-	db_stack_trace_cmd(&frame);
+	db_stack_trace_cmd(curthread, &frame);
 }

Modified: head/sys/arm64/arm64/stack_machdep.c
==============================================================================
--- head/sys/arm64/arm64/stack_machdep.c	Tue Dec  8 17:57:18 2020	(r368454)
+++ head/sys/arm64/arm64/stack_machdep.c	Tue Dec  8 18:00:58 2020	(r368455)
@@ -43,15 +43,15 @@ __FBSDID("$FreeBSD$");
 #include <machine/stack.h>
 
 static void
-stack_capture(struct stack *st, struct unwind_state *frame)
+stack_capture(struct thread *td, struct stack *st, struct unwind_state *frame)
 {
 
 	stack_zero(st);
 	while (1) {
-		unwind_frame(frame);
-		if (!INKERNEL((vm_offset_t)frame->fp) ||
-		     !INKERNEL((vm_offset_t)frame->pc))
+		if (!unwind_frame(td, frame))
 			break;
+		if (!INKERNEL((vm_offset_t)frame->pc))
+			break;
 		if (stack_put(st, frame->pc) == -1)
 			break;
 	}
@@ -73,7 +73,7 @@ stack_save_td(struct stack *st, struct thread *td)
 	frame.fp = td->td_pcb->pcb_x[29];
 	frame.pc = td->td_pcb->pcb_x[30];
 
-	stack_capture(st, &frame);
+	stack_capture(td, st, &frame);
 	return (0);
 }
 
@@ -89,5 +89,5 @@ stack_save(struct stack *st)
 	frame.fp = (uintptr_t)__builtin_frame_address(0);
 	frame.pc = (uintptr_t)stack_save;
 
-	stack_capture(st, &frame);
+	stack_capture(curthread, st, &frame);
 }

Modified: head/sys/arm64/arm64/unwind.c
==============================================================================
--- head/sys/arm64/arm64/unwind.c	Tue Dec  8 17:57:18 2020	(r368454)
+++ head/sys/arm64/arm64/unwind.c	Tue Dec  8 18:00:58 2020	(r368455)
@@ -30,24 +30,26 @@
 #include <sys/cdefs.h>
 __FBSDID("$FreeBSD$");
 #include <sys/param.h>
+#include <sys/proc.h>
 
 #include <machine/stack.h>
 #include <machine/vmparam.h>
 
-int
-unwind_frame(struct unwind_state *frame)
+bool
+unwind_frame(struct thread *td, struct unwind_state *frame)
 {
 	uintptr_t fp;
 
 	fp = frame->fp;
-	if (!INKERNEL(fp))
-		return (-1);
 
+	if (!kstack_contains(td, fp, sizeof(uintptr_t) * 2))
+		return (false);
+
 	frame->sp = fp + sizeof(uintptr_t) * 2;
 	/* FP to previous frame (X29) */
 	frame->fp = ((uintptr_t *)fp)[0];
 	/* LR (X30) */
 	frame->pc = ((uintptr_t *)fp)[1] - 4;
 
-	return (0);
+	return (true);
 }

Modified: head/sys/arm64/include/csan.h
==============================================================================
--- head/sys/arm64/include/csan.h	Tue Dec  8 17:57:18 2020	(r368454)
+++ head/sys/arm64/include/csan.h	Tue Dec  8 18:00:58 2020	(r368455)
@@ -87,9 +87,9 @@ kcsan_md_unwind(void)
 	nsym = 0;
 
 	while (1) {
-		unwind_frame(&frame);
-		if (!INKERNEL((vm_offset_t)frame.fp) ||
-		     !INKERNEL((vm_offset_t)frame.pc))
+		if (!unwind_frame(curthread, &frame))
+			break;
+		if (!INKERNEL((vm_offset_t)frame.pc))
 			break;
 
 #ifdef DDB

Modified: head/sys/arm64/include/stack.h
==============================================================================
--- head/sys/arm64/include/stack.h	Tue Dec  8 17:57:18 2020	(r368454)
+++ head/sys/arm64/include/stack.h	Tue Dec  8 18:00:58 2020	(r368455)
@@ -38,6 +38,6 @@ struct unwind_state {
 	uintptr_t pc;
 };
 
-int unwind_frame(struct unwind_state *);
+bool unwind_frame(struct thread *, struct unwind_state *);
 
 #endif /* !_MACHINE_STACK_H_ */

Modified: head/sys/cddl/dev/dtrace/aarch64/dtrace_isa.c
==============================================================================
--- head/sys/cddl/dev/dtrace/aarch64/dtrace_isa.c	Tue Dec  8 17:57:18 2020	(r368454)
+++ head/sys/cddl/dev/dtrace/aarch64/dtrace_isa.c	Tue Dec  8 18:00:58 2020	(r368455)
@@ -70,7 +70,7 @@ dtrace_getpcstack(pc_t *pcstack, int pcstack_limit, in
 {
 	struct unwind_state state;
 	int scp_offset;
-	register_t sp, fp;
+	register_t sp;
 	int depth;
 
 	depth = 0;
@@ -88,16 +88,11 @@ dtrace_getpcstack(pc_t *pcstack, int pcstack_limit, in
 	state.pc = (uintptr_t)dtrace_getpcstack;
 
 	while (depth < pcstack_limit) {
-		if (!INKERNEL(state.pc) || !INKERNEL(state.fp))
+		if (!unwind_frame(curthread, &state))
 			break;
+		if (!INKERNEL(state.pc))
+			break;
 
-		fp = state.fp;
-		state.sp = fp + 0x10;
-		/* FP to previous frame (X29) */
-		state.fp = *(register_t *)(fp);
-		/* LR (X30) */
-		state.pc = *(register_t *)(fp + 8) - 4;
-
 		/*
 		 * NB: Unlike some other architectures, we don't need to
 		 * explicitly insert cpu_dtrace_caller as it appears in the
@@ -274,10 +269,10 @@ dtrace_getstackdepth(int aframes)
 	int scp_offset;
 	register_t sp;
 	int depth;
-	int done;
+	bool done;
 
 	depth = 1;
-	done = 0;
+	done = false;
 
 	__asm __volatile("mov %0, sp" : "=&r" (sp));
 
@@ -286,7 +281,7 @@ dtrace_getstackdepth(int aframes)
 	state.pc = (uintptr_t)dtrace_getstackdepth;
 
 	do {
-		done = unwind_frame(&state);
+		done = !unwind_frame(curthread, &state);
 		if (!INKERNEL(state.pc) || !INKERNEL(state.fp))
 			break;
 		depth++;

Modified: head/sys/cddl/dev/fbt/fbt.c
==============================================================================
--- head/sys/cddl/dev/fbt/fbt.c	Tue Dec  8 17:57:18 2020	(r368454)
+++ head/sys/cddl/dev/fbt/fbt.c	Tue Dec  8 18:00:58 2020	(r368455)
@@ -140,7 +140,7 @@ fbt_excluded(const char *name)
 	 * Stack unwinders may be called from probe context on some
 	 * platforms.
 	 */
-#if defined(__riscv)
+#if defined(__aarch64__) || defined(__riscv)
 	if (strcmp(name, "unwind_frame") == 0)
 		return (1);
 #endif


More information about the svn-src-head mailing list