| Message ID | 20221103134515.1934867-1-glider@google.com (mailing list archive) |
|---|---|
| State | New |
| Headers | show |
| Series | [v2] x86/traps: avoid KMSAN bugs originating from handle_bug() | expand |
On Thu, Nov 03, 2022 at 02:45:15PM +0100, Alexander Potapenko wrote: > There is a case in exc_invalid_op handler that is executed outside the > irqentry_enter()/irqentry_exit() region when an UD2 instruction is used > to encode a call to __warn(). > > In that case the `struct pt_regs` passed to the interrupt handler is > never unpoisoned by KMSAN (this is normally done in irqentry_enter()), > which leads to false positives inside handle_bug(). > > Use kmsan_unpoison_entry_regs() to explicitly unpoison those registers > before using them. > > Cc: Andrew Morton <akpm@linux-foundation.org> > Cc: Borislav Petkov <bp@alien8.de> > Cc: Dave Hansen <dave.hansen@linux.intel.com> > Cc: Ingo Molnar <mingo@redhat.com> > Cc: Peter Zijlstra (Intel) <peterz@infradead.org> > Cc: Thomas Gleixner <tglx@linutronix.de> > Cc: x86@kernel.org > Signed-off-by: Alexander Potapenko <glider@google.com> > > --- > > v2: > - move the call to kmsan_unpoison_entry_regs() after the > instrumentation_begin(), as suggested by Peter Zijlstra Thanks! Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c index 178015a820f08..66701b4d99acd 100644 --- a/arch/x86/kernel/traps.c +++ b/arch/x86/kernel/traps.c @@ -15,6 +15,7 @@ #include <linux/context_tracking.h> #include <linux/interrupt.h> #include <linux/kallsyms.h> +#include <linux/kmsan.h> #include <linux/spinlock.h> #include <linux/kprobes.h> #include <linux/uaccess.h> @@ -308,6 +309,13 @@ static noinstr bool handle_bug(struct pt_regs *regs) * All lies, just get the WARN/BUG out. */ instrumentation_begin(); + + /* + * Normally @regs are unpoisoned by irqentry_enter(), but handle_bug() + * is a rare case that uses @regs without passing them to + * irqentry_enter(). + */ + kmsan_unpoison_entry_regs(regs); /* * Since we're emulating a CALL with exceptions, restore the interrupt * state to what it was at the exception site.
There is a case in exc_invalid_op handler that is executed outside the irqentry_enter()/irqentry_exit() region when an UD2 instruction is used to encode a call to __warn(). In that case the `struct pt_regs` passed to the interrupt handler is never unpoisoned by KMSAN (this is normally done in irqentry_enter()), which leads to false positives inside handle_bug(). Use kmsan_unpoison_entry_regs() to explicitly unpoison those registers before using them. Cc: Andrew Morton <akpm@linux-foundation.org> Cc: Borislav Petkov <bp@alien8.de> Cc: Dave Hansen <dave.hansen@linux.intel.com> Cc: Ingo Molnar <mingo@redhat.com> Cc: Peter Zijlstra (Intel) <peterz@infradead.org> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: x86@kernel.org Signed-off-by: Alexander Potapenko <glider@google.com> --- v2: - move the call to kmsan_unpoison_entry_regs() after the instrumentation_begin(), as suggested by Peter Zijlstra --- arch/x86/kernel/traps.c | 8 ++++++++ 1 file changed, 8 insertions(+)