From patchwork Mon Feb 15 10:03:16 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andrew Cooper X-Patchwork-Id: 8312241 Return-Path: X-Original-To: patchwork-xen-devel@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork1.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork1.web.kernel.org (Postfix) with ESMTP id 5C6189F6E4 for ; Mon, 15 Feb 2016 10:06:22 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id D742D203A9 for ; Mon, 15 Feb 2016 10:06:16 +0000 (UTC) Received: from lists.xen.org (lists.xenproject.org [50.57.142.19]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id F155D20392 for ; Mon, 15 Feb 2016 10:06:15 +0000 (UTC) Received: from localhost ([127.0.0.1] helo=lists.xen.org) by lists.xen.org with esmtp (Exim 4.72) (envelope-from ) id 1aVG04-0001qB-Hc; Mon, 15 Feb 2016 10:03:24 +0000 Received: from mail6.bemta14.messagelabs.com ([193.109.254.103]) by lists.xen.org with esmtp (Exim 4.72) (envelope-from ) id 1aVG02-0001q6-HU for xen-devel@lists.xen.org; Mon, 15 Feb 2016 10:03:22 +0000 Received: from [193.109.254.147] by server-10.bemta-14.messagelabs.com id 93/4F-25438-962A1C65; Mon, 15 Feb 2016 10:03:21 +0000 X-Env-Sender: prvs=846845d4a=Andrew.Cooper3@citrix.com X-Msg-Ref: server-10.tower-27.messagelabs.com!1455530598!23862177!1 X-Originating-IP: [66.165.176.63] X-SpamReason: No, hits=0.0 required=7.0 tests=sa_preprocessor: VHJ1c3RlZCBJUDogNjYuMTY1LjE3Ni42MyA9PiAzMDYwNDg=\n, received_headers: No Received headers X-StarScan-Received: X-StarScan-Version: 7.35.1; banners=-,-,- X-VirusChecked: Checked Received: (qmail 8485 invoked from network); 15 Feb 2016 10:03:21 -0000 Received: from smtp02.citrix.com (HELO SMTP02.CITRIX.COM) (66.165.176.63) by server-10.tower-27.messagelabs.com with RC4-SHA encrypted SMTP; 15 Feb 2016 10:03:21 -0000 X-IronPort-AV: E=Sophos;i="5.22,449,1449532800"; d="scan'208";a="338193562" From: Andrew Cooper To: Xen-devel Date: Mon, 15 Feb 2016 10:03:16 +0000 Message-ID: <1455530596-14548-1-git-send-email-andrew.cooper3@citrix.com> X-Mailer: git-send-email 2.1.4 MIME-Version: 1.0 X-DLP: MIA1 Cc: Andrew Cooper , Jan Beulich Subject: [Xen-devel] [PATCH] x86/traps: Improve hypervisor stack overflow detection X-BeenThere: xen-devel@lists.xen.org X-Mailman-Version: 2.1.13 Precedence: list List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: xen-devel-bounces@lists.xen.org Errors-To: xen-devel-bounces@lists.xen.org X-Spam-Status: No, score=-4.2 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_MED, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP A sample Gentoo compliation of Xen contains lea -0x1058(%rsp),%rsp orq $0x0,(%rsp) lea 0x1020(%rsp),%rsp Whatever the reason for silly code like this, it fools the current stack overflow detection logic in the #DF handler (which triggers reliably on the 'orq' instruction). Update the overflow condition to declare an overflow if %esp is anywhere within the guard page, rather than just within the upper 8th of the page. Additionally, check %esp against the expected stack base in all builds. Signed-off-by: Andrew Cooper --- CC: Jan Beulich v2: Reintroduce 512 bytes of slop on top of the guard page. --- xen/arch/x86/traps.c | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-) diff --git a/xen/arch/x86/traps.c b/xen/arch/x86/traps.c index 26a5026..3604753 100644 --- a/xen/arch/x86/traps.c +++ b/xen/arch/x86/traps.c @@ -451,10 +451,17 @@ void show_stack(const struct cpu_user_regs *regs) void show_stack_overflow(unsigned int cpu, const struct cpu_user_regs *regs) { -#ifdef MEMORY_GUARD unsigned long esp = regs->rsp; + unsigned long curr_stack_base = esp & ~(STACK_SIZE - 1); +#ifdef MEMORY_GUARD unsigned long esp_top, esp_bottom; +#endif + + if ( _p(curr_stack_base) != stack_base[cpu] ) + printk("Current stack base %p differs from expected %p\n", + _p(curr_stack_base), stack_base[cpu]); +#ifdef MEMORY_GUARD esp_bottom = (esp | (STACK_SIZE - 1)) + 1; esp_top = esp_bottom - PRIMARY_STACK_SIZE; @@ -462,9 +469,12 @@ void show_stack_overflow(unsigned int cpu, const struct cpu_user_regs *regs) (void *)esp_top, (void *)esp_bottom, (void *)esp, (void *)per_cpu(init_tss, cpu).esp0); - /* Trigger overflow trace if %esp is within 512 bytes of the guard page. */ - if ( ((unsigned long)(esp - esp_top) > 512) && - ((unsigned long)(esp_top - esp) > 512) ) + /* + * Trigger overflow trace if %esp is anywhere within the guard page, or + * with fewer than 512 bytes remaining on the primary stack. + */ + if ( (esp > (esp_top + 512)) || + (esp < (esp_top - PAGE_SIZE)) ) { printk("No stack overflow detected. Skipping stack trace.\n"); return;