In the Linux kernel, the following vulnerability has been resolved: riscv: fgraph: Fix stack layout to match _archftraceregs argument of ftracereturntohandler Naresh Kamboju reported a "Bad frame pointer" kernel warning while running LTP trace ftracestresstest.sh in riscv. We can reproduce the same issue with the following command: $ cd /sys/kernel/debug/tracing $ echo 'f:myprobe do_nanosleep%return args1=$retval' > dynamic_events $ echo 1 > events/fprobes/enable $ echo 1 > tracing_on $ sleep 1
And we can get the following kernel warning: [ 127.692888] ------------[ cut here ]------------ [ 127.693755] Bad frame pointer: expected ff2000000065be50, received ba34c141e9594000 [ 127.693755] from func donanosleep return to ffffffff800ccb16 [ 127.698699] WARNING: CPU: 1 PID: 129 at kernel/trace/fgraph.c:755 ftracereturntohandler+0x1b2/0x1be [ 127.699894] Modules linked in: [ 127.700908] CPU: 1 UID: 0 PID: 129 Comm: sleep Not tainted 6.14.0-rc3-g0ab191c74642 #32 [ 127.701453] Hardware name: riscv-virtio,qemu (DT) [ 127.701859] epc : ftracereturntohandler+0x1b2/0x1be [ 127.702032] ra : ftracereturntohandler+0x1b2/0x1be [ 127.702151] epc : ffffffff8013b5e0 ra : ffffffff8013b5e0 sp : ff2000000065bd10 [ 127.702221] gp : ffffffff819c12f8 tp : ff60000080853100 t0 : 6e00000000000000 [ 127.702284] t1 : 0000000000000020 t2 : 6e7566206d6f7266 s0 : ff2000000065bd80 [ 127.702346] s1 : ff60000081262000 a0 : 000000000000007b a1 : ffffffff81894f20 [ 127.702408] a2 : 0000000000000010 a3 : fffffffffffffffe a4 : 0000000000000000 [ 127.702470] a5 : 0000000000000000 a6 : 0000000000000008 a7 : 0000000000000038 [ 127.702530] s2 : ba34c141e9594000 s3 : 0000000000000000 s4 : ff2000000065bdd0 [ 127.702591] s5 : 00007fff8adcf400 s6 : 000055556dc1d8c0 s7 : 0000000000000068 [ 127.702651] s8 : 00007fff8adf5d10 s9 : 000000000000006d s10: 0000000000000001 [ 127.702710] s11: 00005555737377c8 t3 : ffffffff819d899e t4 : ffffffff819d899e [ 127.702769] t5 : ffffffff819d89a0 t6 : ff2000000065bb18 [ 127.702826] status: 0000000200000120 badaddr: 0000000000000000 cause: 0000000000000003 [ 127.703292] [<ffffffff8013b5e0>] ftracereturntohandler+0x1b2/0x1be [ 127.703760] [<ffffffff80017bce>] returntohandler+0x16/0x26 [ 127.704009] [<ffffffff80017bb8>] returntohandler+0x0/0x26 [ 127.704057] [<ffffffff800d3352>] commonnsleep+0x42/0x54 [ 127.704117] [<ffffffff800d44a2>] _riscvsysclocknanosleep+0xba/0x10a [ 127.704176] [<ffffffff80901c56>] dotrapecallu+0x188/0x218 [ 127.704295] [<ffffffff8090cc3e>] handleexception+0x14a/0x156 [ 127.705436] ---[ end trace 0000000000000000 ]--- The reason is that the stack layout for constructing argument for the ftracereturntohandler in the returntohandler does not match the _archftraceregs structure of riscv, leading to unexpected results.
{ "availability": "No subscription required", "binaries": [ { "binary_version": "7.6.0+6.14.0-22.22", "binary_name": "bpftool" }, { "binary_version": "6.14.0-22.22", "binary_name": "linux-bpf-dev" }, { "binary_version": "6.14.0-22.22", "binary_name": "linux-buildinfo-6.14.0-22-generic" }, { "binary_version": "6.14.0-22.22", "binary_name": "linux-buildinfo-6.14.0-22-generic-64k" }, { "binary_version": "6.14.0-22.22", "binary_name": "linux-cloud-tools-6.14.0-22" }, { "binary_version": "6.14.0-22.22", "binary_name": "linux-cloud-tools-6.14.0-22-generic" }, { "binary_version": "6.14.0-22.22", "binary_name": "linux-cloud-tools-common" }, { "binary_version": "6.14.0-22.22", "binary_name": "linux-doc" }, { "binary_version": "6.14.0-22.22", "binary_name": "linux-headers-6.14.0-22" }, { "binary_version": "6.14.0-22.22", "binary_name": "linux-headers-6.14.0-22-generic" }, { "binary_version": "6.14.0-22.22", "binary_name": "linux-headers-6.14.0-22-generic-64k" }, { "binary_version": "6.14.0-22.22", "binary_name": "linux-image-6.14.0-22-generic" }, { "binary_version": "6.14.0-22.22", "binary_name": "linux-image-6.14.0-22-generic-dbgsym" }, { "binary_version": "6.14.0-22.22", "binary_name": "linux-image-unsigned-6.14.0-22-generic" }, { "binary_version": "6.14.0-22.22", "binary_name": "linux-image-unsigned-6.14.0-22-generic-64k" }, { "binary_version": "6.14.0-22.22", "binary_name": "linux-image-unsigned-6.14.0-22-generic-64k-dbgsym" }, { "binary_version": "6.14.0-22.22", "binary_name": "linux-image-unsigned-6.14.0-22-generic-dbgsym" }, { "binary_version": "6.14.0-22.22", "binary_name": "linux-lib-rust-6.14.0-22-generic" }, { "binary_version": "6.14.0-22.22", "binary_name": "linux-libc-dev" }, { "binary_version": "6.14.0-22.22", "binary_name": "linux-modules-6.14.0-22-generic" }, { "binary_version": "6.14.0-22.22", "binary_name": "linux-modules-6.14.0-22-generic-64k" }, { "binary_version": "6.14.0-22.22", "binary_name": "linux-modules-extra-6.14.0-22-generic" }, { "binary_version": "6.14.0-22.22", "binary_name": "linux-modules-ipu6-6.14.0-22-generic" }, { "binary_version": "6.14.0-22.22", "binary_name": "linux-modules-ipu7-6.14.0-22-generic" }, { "binary_version": "6.14.0-22.22", "binary_name": "linux-modules-iwlwifi-6.14.0-22-generic" }, { "binary_version": "6.14.0-22.22", "binary_name": "linux-modules-usbio-6.14.0-22-generic" }, { "binary_version": "6.14.0-22.22", "binary_name": "linux-modules-vision-6.14.0-22-generic" }, { "binary_version": "6.14.0-22.22", "binary_name": "linux-perf" }, { "binary_version": "6.14.0-22.22", "binary_name": "linux-source-6.14.0" }, { "binary_version": "6.14.0-22.22", "binary_name": "linux-tools-6.14.0-22" }, { "binary_version": "6.14.0-22.22", "binary_name": "linux-tools-6.14.0-22-generic" }, { "binary_version": "6.14.0-22.22", "binary_name": "linux-tools-6.14.0-22-generic-64k" }, { "binary_version": "6.14.0-22.22", "binary_name": "linux-tools-common" }, { "binary_version": "6.14.0-22.22", "binary_name": "linux-tools-host" } ] }
{ "availability": "No subscription required", "binaries": [ { "binary_version": "6.14.0-1007.7", "binary_name": "linux-aws-cloud-tools-6.14.0-1007" }, { "binary_version": "6.14.0-1007.7", "binary_name": "linux-aws-headers-6.14.0-1007" }, { "binary_version": "6.14.0-1007.7", "binary_name": "linux-aws-tools-6.14.0-1007" }, { "binary_version": "6.14.0-1007.7", "binary_name": "linux-buildinfo-6.14.0-1007-aws" }, { "binary_version": "6.14.0-1007.7", "binary_name": "linux-buildinfo-6.14.0-1007-aws-64k" }, { "binary_version": "6.14.0-1007.7", "binary_name": "linux-cloud-tools-6.14.0-1007-aws" }, { "binary_version": "6.14.0-1007.7", "binary_name": "linux-cloud-tools-6.14.0-1007-aws-64k" }, { "binary_version": "6.14.0-1007.7", "binary_name": "linux-headers-6.14.0-1007-aws" }, { "binary_version": "6.14.0-1007.7", "binary_name": "linux-headers-6.14.0-1007-aws-64k" }, { "binary_version": "6.14.0-1007.7", "binary_name": "linux-image-unsigned-6.14.0-1007-aws" }, { "binary_version": "6.14.0-1007.7", "binary_name": "linux-image-unsigned-6.14.0-1007-aws-64k" }, { "binary_version": "6.14.0-1007.7", "binary_name": "linux-image-unsigned-6.14.0-1007-aws-64k-dbgsym" }, { "binary_version": "6.14.0-1007.7", "binary_name": "linux-image-unsigned-6.14.0-1007-aws-dbgsym" }, { "binary_version": "6.14.0-1007.7", "binary_name": "linux-modules-6.14.0-1007-aws" }, { "binary_version": "6.14.0-1007.7", "binary_name": "linux-modules-6.14.0-1007-aws-64k" }, { "binary_version": "6.14.0-1007.7", "binary_name": "linux-modules-extra-6.14.0-1007-aws" }, { "binary_version": "6.14.0-1007.7", "binary_name": "linux-modules-extra-6.14.0-1007-aws-64k" }, { "binary_version": "6.14.0-1007.7", "binary_name": "linux-tools-6.14.0-1007-aws" }, { "binary_version": "6.14.0-1007.7", "binary_name": "linux-tools-6.14.0-1007-aws-64k" } ] }
{ "availability": "No subscription required", "binaries": [ { "binary_version": "6.14.0-1007.7", "binary_name": "linux-azure-cloud-tools-6.14.0-1007" }, { "binary_version": "6.14.0-1007.7", "binary_name": "linux-azure-headers-6.14.0-1007" }, { "binary_version": "6.14.0-1007.7", "binary_name": "linux-azure-tools-6.14.0-1007" }, { "binary_version": "6.14.0-1007.7", "binary_name": "linux-buildinfo-6.14.0-1007-azure" }, { "binary_version": "6.14.0-1007.7", "binary_name": "linux-cloud-tools-6.14.0-1007-azure" }, { "binary_version": "6.14.0-1007.7", "binary_name": "linux-headers-6.14.0-1007-azure" }, { "binary_version": "6.14.0-1007.7", "binary_name": "linux-image-unsigned-6.14.0-1007-azure" }, { "binary_version": "6.14.0-1007.7", "binary_name": "linux-image-unsigned-6.14.0-1007-azure-dbgsym" }, { "binary_version": "6.14.0-1007.7", "binary_name": "linux-modules-6.14.0-1007-azure" }, { "binary_version": "6.14.0-1007.7", "binary_name": "linux-modules-extra-6.14.0-1007-azure" }, { "binary_version": "6.14.0-1007.7", "binary_name": "linux-tools-6.14.0-1007-azure" } ] }
{ "availability": "No subscription required", "binaries": [ { "binary_version": "6.14.0-1008.8", "binary_name": "linux-buildinfo-6.14.0-1008-gcp" }, { "binary_version": "6.14.0-1008.8", "binary_name": "linux-buildinfo-6.14.0-1008-gcp-64k" }, { "binary_version": "6.14.0-1008.8", "binary_name": "linux-gcp-headers-6.14.0-1008" }, { "binary_version": "6.14.0-1008.8", "binary_name": "linux-gcp-tools-6.14.0-1008" }, { "binary_version": "6.14.0-1008.8", "binary_name": "linux-headers-6.14.0-1008-gcp" }, { "binary_version": "6.14.0-1008.8", "binary_name": "linux-headers-6.14.0-1008-gcp-64k" }, { "binary_version": "6.14.0-1008.8", "binary_name": "linux-image-unsigned-6.14.0-1008-gcp" }, { "binary_version": "6.14.0-1008.8", "binary_name": "linux-image-unsigned-6.14.0-1008-gcp-64k" }, { "binary_version": "6.14.0-1008.8", "binary_name": "linux-image-unsigned-6.14.0-1008-gcp-64k-dbgsym" }, { "binary_version": "6.14.0-1008.8", "binary_name": "linux-image-unsigned-6.14.0-1008-gcp-dbgsym" }, { "binary_version": "6.14.0-1008.8", "binary_name": "linux-modules-6.14.0-1008-gcp" }, { "binary_version": "6.14.0-1008.8", "binary_name": "linux-modules-6.14.0-1008-gcp-64k" }, { "binary_version": "6.14.0-1008.8", "binary_name": "linux-modules-extra-6.14.0-1008-gcp" }, { "binary_version": "6.14.0-1008.8", "binary_name": "linux-modules-extra-6.14.0-1008-gcp-64k" }, { "binary_version": "6.14.0-1008.8", "binary_name": "linux-tools-6.14.0-1008-gcp" }, { "binary_version": "6.14.0-1008.8", "binary_name": "linux-tools-6.14.0-1008-gcp-64k" } ] }
{ "availability": "No subscription required", "binaries": [ { "binary_version": "6.14.0-1007.7", "binary_name": "linux-buildinfo-6.14.0-1007-oracle" }, { "binary_version": "6.14.0-1007.7", "binary_name": "linux-buildinfo-6.14.0-1007-oracle-64k" }, { "binary_version": "6.14.0-1007.7", "binary_name": "linux-headers-6.14.0-1007-oracle" }, { "binary_version": "6.14.0-1007.7", "binary_name": "linux-headers-6.14.0-1007-oracle-64k" }, { "binary_version": "6.14.0-1007.7", "binary_name": "linux-image-unsigned-6.14.0-1007-oracle" }, { "binary_version": "6.14.0-1007.7", "binary_name": "linux-image-unsigned-6.14.0-1007-oracle-64k" }, { "binary_version": "6.14.0-1007.7", "binary_name": "linux-image-unsigned-6.14.0-1007-oracle-64k-dbgsym" }, { "binary_version": "6.14.0-1007.7", "binary_name": "linux-image-unsigned-6.14.0-1007-oracle-dbgsym" }, { "binary_version": "6.14.0-1007.7", "binary_name": "linux-modules-6.14.0-1007-oracle" }, { "binary_version": "6.14.0-1007.7", "binary_name": "linux-modules-6.14.0-1007-oracle-64k" }, { "binary_version": "6.14.0-1007.7", "binary_name": "linux-modules-extra-6.14.0-1007-oracle" }, { "binary_version": "6.14.0-1007.7", "binary_name": "linux-modules-extra-6.14.0-1007-oracle-64k" }, { "binary_version": "6.14.0-1007.7", "binary_name": "linux-oracle-headers-6.14.0-1007" }, { "binary_version": "6.14.0-1007.7", "binary_name": "linux-oracle-tools-6.14.0-1007" }, { "binary_version": "6.14.0-1007.7", "binary_name": "linux-tools-6.14.0-1007-oracle" }, { "binary_version": "6.14.0-1007.7", "binary_name": "linux-tools-6.14.0-1007-oracle-64k" } ] }
{ "availability": "No subscription required", "binaries": [ { "binary_version": "6.14.0-1007.7", "binary_name": "linux-buildinfo-6.14.0-1007-raspi" }, { "binary_version": "6.14.0-1007.7", "binary_name": "linux-headers-6.14.0-1007-raspi" }, { "binary_version": "6.14.0-1007.7", "binary_name": "linux-image-6.14.0-1007-raspi" }, { "binary_version": "6.14.0-1007.7", "binary_name": "linux-image-6.14.0-1007-raspi-dbgsym" }, { "binary_version": "6.14.0-1007.7", "binary_name": "linux-modules-6.14.0-1007-raspi" }, { "binary_version": "6.14.0-1007.7", "binary_name": "linux-raspi-headers-6.14.0-1007" }, { "binary_version": "6.14.0-1007.7", "binary_name": "linux-raspi-tools-6.14.0-1007" }, { "binary_version": "6.14.0-1007.7", "binary_name": "linux-tools-6.14.0-1007-raspi" } ] }
{ "availability": "No subscription required", "binaries": [ { "binary_version": "6.14.0-1004.4", "binary_name": "linux-buildinfo-6.14.0-1004-realtime" }, { "binary_version": "6.14.0-1004.4", "binary_name": "linux-cloud-tools-6.14.0-1004-realtime" }, { "binary_version": "6.14.0-1004.4", "binary_name": "linux-headers-6.14.0-1004-realtime" }, { "binary_version": "6.14.0-1004.4", "binary_name": "linux-image-unsigned-6.14.0-1004-realtime" }, { "binary_version": "6.14.0-1004.4", "binary_name": "linux-image-unsigned-6.14.0-1004-realtime-dbgsym" }, { "binary_version": "6.14.0-1004.4", "binary_name": "linux-modules-6.14.0-1004-realtime" }, { "binary_version": "6.14.0-1004.4", "binary_name": "linux-modules-extra-6.14.0-1004-realtime" }, { "binary_version": "6.14.0-1004.4", "binary_name": "linux-modules-iwlwifi-6.14.0-1004-realtime" }, { "binary_version": "6.14.0-1004.4", "binary_name": "linux-realtime-cloud-tools-6.14.0-1004" }, { "binary_version": "6.14.0-1004.4", "binary_name": "linux-realtime-headers-6.14.0-1004" }, { "binary_version": "6.14.0-1004.4", "binary_name": "linux-realtime-tools-6.14.0-1004" }, { "binary_version": "6.14.0-1004.4", "binary_name": "linux-tools-6.14.0-1004-realtime" } ] }
{ "availability": "No subscription required", "binaries": [ { "binary_version": "6.14.0-22.22.1", "binary_name": "linux-buildinfo-6.14.0-22-generic" }, { "binary_version": "6.14.0-22.22.1", "binary_name": "linux-headers-6.14.0-22-generic" }, { "binary_version": "6.14.0-22.22.1", "binary_name": "linux-image-6.14.0-22-generic" }, { "binary_version": "6.14.0-22.22.1", "binary_name": "linux-image-6.14.0-22-generic-dbgsym" }, { "binary_version": "6.14.0-22.22.1", "binary_name": "linux-modules-6.14.0-22-generic" }, { "binary_version": "6.14.0-22.22.1", "binary_name": "linux-riscv-headers-6.14.0-22" }, { "binary_version": "6.14.0-22.22.1", "binary_name": "linux-riscv-tools-6.14.0-22" }, { "binary_version": "6.14.0-22.22.1", "binary_name": "linux-tools-6.14.0-22-generic" } ] }