mirror of
https://github.com/torvalds/linux
synced 2024-11-05 18:23:50 +00:00
78d9d8005e
When CONFIG_FRAME_POINTER=y, calling dump_stack() can always trigger
NULL pointer dereference panic similar as below:
[ 0.396060] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.13.0-rc5+ #47
[ 0.396692] Hardware name: riscv-virtio,qemu (DT)
[ 0.397176] Call Trace:
[ 0.398191] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000960
[ 0.399487] Oops [#1]
[ 0.399739] Modules linked in:
[ 0.400135] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.13.0-rc5+ #47
[ 0.400570] Hardware name: riscv-virtio,qemu (DT)
[ 0.400926] epc : walk_stackframe+0xc4/0xdc
[ 0.401291] ra : dump_backtrace+0x30/0x38
[ 0.401630] epc : ffffffff80004922 ra : ffffffff8000496a sp : ffffffe000f3bd00
[ 0.402115] gp : ffffffff80cfdcb8 tp : ffffffe000f30000 t0 : ffffffff80d0b0cf
[ 0.402602] t1 : ffffffff80d0b0c0 t2 : 0000000000000000 s0 : ffffffe000f3bd60
[ 0.403071] s1 : ffffffff808bc2e8 a0 : 0000000000001000 a1 : 0000000000000000
[ 0.403448] a2 : ffffffff803d7088 a3 : ffffffff808bc2e8 a4 : 6131725dbc24d400
[ 0.403820] a5 : 0000000000001000 a6 : 0000000000000002 a7 : ffffffffffffffff
[ 0.404226] s2 : 0000000000000000 s3 : 0000000000000000 s4 : 0000000000000000
[ 0.404634] s5 : ffffffff803d7088 s6 : ffffffff808bc2e8 s7 : ffffffff80630650
[ 0.405085] s8 : ffffffff80912a80 s9 : 0000000000000008 s10: ffffffff804000fc
[ 0.405388] s11: 0000000000000000 t3 : 0000000000000043 t4 : ffffffffffffffff
[ 0.405616] t5 : 000000000000003d t6 : ffffffe000f3baa8
[ 0.405793] status: 0000000000000100 badaddr: 0000000000000960 cause: 000000000000000d
[ 0.406135] [<ffffffff80004922>] walk_stackframe+0xc4/0xdc
[ 0.407032] [<ffffffff8000496a>] dump_backtrace+0x30/0x38
[ 0.407797] [<ffffffff803d7100>] show_stack+0x40/0x4c
[ 0.408234] [<ffffffff803d9e5c>] dump_stack+0x90/0xb6
[ 0.409019] [<ffffffff8040423e>] ptdump_init+0x20/0xc4
[ 0.409681] [<ffffffff800015b6>] do_one_initcall+0x4c/0x226
[ 0.410110] [<ffffffff80401094>] kernel_init_freeable+0x1f4/0x258
[ 0.410562] [<ffffffff803dba88>] kernel_init+0x22/0x148
[ 0.410959] [<ffffffff800029e2>] ret_from_exception+0x0/0x14
[ 0.412241] ---[ end trace b2ab92c901b96251 ]---
[ 0.413099] Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b
The reason is the task is NULL when we finally call walk_stackframe()
the NULL is passed from __dump_stack():
|static void __dump_stack(void)
|{
| dump_stack_print_info(KERN_DEFAULT);
| show_stack(NULL, NULL, KERN_DEFAULT);
|}
Fix this issue by checking "task == NULL" case in walk_stackframe().
Fixes: eac2f3059e
("riscv: stacktrace: fix the riscv stacktrace when CONFIG_FRAME_POINTER enabled")
Signed-off-by: Jisheng Zhang <jszhang@kernel.org>
Reviewed-by: Atish Patra <atish.patra@wdc.com>
Tested-by: Wende Tan <twd2.me@gmail.com>
Signed-off-by: Palmer Dabbelt <palmerdabbelt@google.com>
152 lines
3.4 KiB
C
152 lines
3.4 KiB
C
// SPDX-License-Identifier: GPL-2.0-only
|
|
/*
|
|
* Copyright (C) 2008 ARM Limited
|
|
* Copyright (C) 2014 Regents of the University of California
|
|
*/
|
|
|
|
#include <linux/export.h>
|
|
#include <linux/kallsyms.h>
|
|
#include <linux/sched.h>
|
|
#include <linux/sched/debug.h>
|
|
#include <linux/sched/task_stack.h>
|
|
#include <linux/stacktrace.h>
|
|
#include <linux/ftrace.h>
|
|
|
|
#include <asm/stacktrace.h>
|
|
|
|
register unsigned long sp_in_global __asm__("sp");
|
|
|
|
#ifdef CONFIG_FRAME_POINTER
|
|
|
|
void notrace walk_stackframe(struct task_struct *task, struct pt_regs *regs,
|
|
bool (*fn)(void *, unsigned long), void *arg)
|
|
{
|
|
unsigned long fp, sp, pc;
|
|
|
|
if (regs) {
|
|
fp = frame_pointer(regs);
|
|
sp = user_stack_pointer(regs);
|
|
pc = instruction_pointer(regs);
|
|
} else if (task == NULL || task == current) {
|
|
fp = (unsigned long)__builtin_frame_address(1);
|
|
sp = (unsigned long)__builtin_frame_address(0);
|
|
pc = (unsigned long)__builtin_return_address(0);
|
|
} else {
|
|
/* task blocked in __switch_to */
|
|
fp = task->thread.s[0];
|
|
sp = task->thread.sp;
|
|
pc = task->thread.ra;
|
|
}
|
|
|
|
for (;;) {
|
|
unsigned long low, high;
|
|
struct stackframe *frame;
|
|
|
|
if (unlikely(!__kernel_text_address(pc) || !fn(arg, pc)))
|
|
break;
|
|
|
|
/* Validate frame pointer */
|
|
low = sp + sizeof(struct stackframe);
|
|
high = ALIGN(sp, THREAD_SIZE);
|
|
if (unlikely(fp < low || fp > high || fp & 0x7))
|
|
break;
|
|
/* Unwind stack frame */
|
|
frame = (struct stackframe *)fp - 1;
|
|
sp = fp;
|
|
if (regs && (regs->epc == pc) && (frame->fp & 0x7)) {
|
|
fp = frame->ra;
|
|
pc = regs->ra;
|
|
} else {
|
|
fp = frame->fp;
|
|
pc = ftrace_graph_ret_addr(current, NULL, frame->ra,
|
|
(unsigned long *)(fp - 8));
|
|
}
|
|
|
|
}
|
|
}
|
|
|
|
#else /* !CONFIG_FRAME_POINTER */
|
|
|
|
void notrace walk_stackframe(struct task_struct *task,
|
|
struct pt_regs *regs, bool (*fn)(void *, unsigned long), void *arg)
|
|
{
|
|
unsigned long sp, pc;
|
|
unsigned long *ksp;
|
|
|
|
if (regs) {
|
|
sp = user_stack_pointer(regs);
|
|
pc = instruction_pointer(regs);
|
|
} else if (task == NULL || task == current) {
|
|
sp = sp_in_global;
|
|
pc = (unsigned long)walk_stackframe;
|
|
} else {
|
|
/* task blocked in __switch_to */
|
|
sp = task->thread.sp;
|
|
pc = task->thread.ra;
|
|
}
|
|
|
|
if (unlikely(sp & 0x7))
|
|
return;
|
|
|
|
ksp = (unsigned long *)sp;
|
|
while (!kstack_end(ksp)) {
|
|
if (__kernel_text_address(pc) && unlikely(!fn(arg, pc)))
|
|
break;
|
|
pc = (*ksp++) - 0x4;
|
|
}
|
|
}
|
|
|
|
#endif /* CONFIG_FRAME_POINTER */
|
|
|
|
static bool print_trace_address(void *arg, unsigned long pc)
|
|
{
|
|
const char *loglvl = arg;
|
|
|
|
print_ip_sym(loglvl, pc);
|
|
return true;
|
|
}
|
|
|
|
noinline void dump_backtrace(struct pt_regs *regs, struct task_struct *task,
|
|
const char *loglvl)
|
|
{
|
|
walk_stackframe(task, regs, print_trace_address, (void *)loglvl);
|
|
}
|
|
|
|
void show_stack(struct task_struct *task, unsigned long *sp, const char *loglvl)
|
|
{
|
|
pr_cont("%sCall Trace:\n", loglvl);
|
|
dump_backtrace(NULL, task, loglvl);
|
|
}
|
|
|
|
static bool save_wchan(void *arg, unsigned long pc)
|
|
{
|
|
if (!in_sched_functions(pc)) {
|
|
unsigned long *p = arg;
|
|
*p = pc;
|
|
return false;
|
|
}
|
|
return true;
|
|
}
|
|
|
|
unsigned long get_wchan(struct task_struct *task)
|
|
{
|
|
unsigned long pc = 0;
|
|
|
|
if (likely(task && task != current && !task_is_running(task))) {
|
|
if (!try_get_task_stack(task))
|
|
return 0;
|
|
walk_stackframe(task, NULL, save_wchan, &pc);
|
|
put_task_stack(task);
|
|
}
|
|
return pc;
|
|
}
|
|
|
|
#ifdef CONFIG_STACKTRACE
|
|
|
|
noinline void arch_stack_walk(stack_trace_consume_fn consume_entry, void *cookie,
|
|
struct task_struct *task, struct pt_regs *regs)
|
|
{
|
|
walk_stackframe(task, regs, consume_entry, cookie);
|
|
}
|
|
|
|
#endif /* CONFIG_STACKTRACE */
|