On Thu, 15 Feb 2024 09:57:39 -0500 Steven Rostedt <rostedt@xxxxxxxxxxx> wrote: > On Wed, 7 Feb 2024 00:11:12 +0900 > "Masami Hiramatsu (Google)" <mhiramat@xxxxxxxxxx> wrote: > > > From: Masami Hiramatsu (Google) <mhiramat@xxxxxxxxxx> > > > > Improve push and data reserve operation on the shadow stack for > > several sequencial interrupts. > > > > To push a ret_stack or data entry on the shadow stack, we need to > > prepare an index (offset) entry before updating the stack pointer > > (curr_ret_stack) so that unwinder from interrupts can find the > > next return address from the shadow stack. Currently we do write index, > > update the curr_ret_stack, and rewrite it again. But that is not enough > > for the case if two interrupts happens and the first one breaks it. > > For example, > > > > 1. write reserved index entry at ret_stack[new_index - 1] and ret addr. > > 2. interrupt comes. > > 2.1. push new index and ret addr on ret_stack. > > 2.2. pop it. (corrupt entries on new_index - 1) > > 3. return from interrupt. > > 4. update curr_ret_stack = new_index > > 5. interrupt comes again. > > 5.1. unwind <------ may not work. > > I'm curious if you saw this happen? > > That is, did you trigger this or only noticed it by inspection? I just noticed this scenario while explaining why we write the same value twice to Jiri. https://lore.kernel.org/all/20231220004540.0af568c69ecaf9170430a383@xxxxxxxxxx/ > > This code is already quite complex, I would like to simplify it more before > we try to fix rare race conditions that only affect the unwinder. > > Let's hold off on this change. OK, then drop this until someone hits the actual problem, maybe that should be rare case. Thank you, > > -- Steve > > > > > > To avoid this issue, this introduces a new rsrv_ret_stack stack > > reservation pointer and a new push code (slow path) to commit > > previous reserved code forcibly. > > > > 0. update rsrv_ret_stack = new_index. > > 1. write reserved index entry at ret_stack[new_index - 1] and ret addr. > > 2. interrupt comes. > > 2.0. if rsrv_ret_stack != curr_ret_stack, add reserved index > > entry on ret_stack[rsrv_ret_stack - 1] to point the previous > > ret_stack pointed by ret_stack[curr_ret_stack - 1]. and > > update curr_ret_stack = rsrv_ret_stack. > > 2.1. push new index and ret addr on ret_stack. > > 2.2. pop it. (corrupt entries on new_index - 1) > > 3. return from interrupt. > > 4. update curr_ret_stack = new_index > > 5. interrupt comes again. > > 5.1. unwind works, because curr_ret_stack points the previously > > saved ret_stack. > > 5.2. this can do push/pop operations too. > > 6. return from interrupt. > > 7. rewrite reserved index entry at ret_stack[new_index] again. > > > > This maybe a bit heavier but safer. > > > > Signed-off-by: Masami Hiramatsu (Google) <mhiramat@xxxxxxxxxx> -- Masami Hiramatsu (Google) <mhiramat@xxxxxxxxxx>
