1 files changed, 48 insertions, 14 deletions

diff --git a/arch/arm64/kernel/stacktrace.c b/arch/arm64/kernel/stacktrace.c
index 62d395151abe..a336cb124320 100644
--- a/arch/arm64/kernel/stacktrace.c
+++ b/arch/arm64/kernel/stacktrace.c
@@ -7,6 +7,7 @@
 #include <linux/kernel.h>
 #include <linux/export.h>
 #include <linux/ftrace.h>
+#include <linux/kprobes.h>
 #include <linux/sched.h>
 #include <linux/sched/debug.h>
 #include <linux/sched/task_stack.h>
@@ -29,9 +30,18 @@
  *      ldp     x29, x30, [sp]
  *      add     sp, sp, #0x10
  */
+
+/*
+ * Unwind from one frame record (A) to the next frame record (B).
+ *
+ * We terminate early if the location of B indicates a malformed chain of frame
+ * records (e.g. a cycle), determined based on the location and fp value of A
+ * and the location (but not the fp value) of B.
+ */
 int notrace unwind_frame(struct task_struct *tsk, struct stackframe *frame)
 {
         unsigned long fp = frame->fp;
+        struct stack_info info;
 
         if (fp & 0xf)
                 return -EINVAL;
@@ -39,11 +49,40 @@ int notrace unwind_frame(struct task_struct *tsk, struct stackframe *frame)
         if (!tsk)
                 tsk = current;
 
-        if (!on_accessible_stack(tsk, fp, NULL))
+        if (!on_accessible_stack(tsk, fp, &info))
+                return -EINVAL;
+
+        if (test_bit(info.type, frame->stacks_done))
                 return -EINVAL;
 
+        /*
+         * As stacks grow downward, any valid record on the same stack must be
+         * at a strictly higher address than the prior record.
+         *
+         * Stacks can nest in several valid orders, e.g.
+         *
+         * TASK -> IRQ -> OVERFLOW -> SDEI_NORMAL
+         * TASK -> SDEI_NORMAL -> SDEI_CRITICAL -> OVERFLOW
+         *
+         * ... but the nesting itself is strict. Once we transition from one
+         * stack to another, it's never valid to unwind back to that first
+         * stack.
+         */
+        if (info.type == frame->prev_type) {
+                if (fp <= frame->prev_fp)
+                        return -EINVAL;
+        } else {
+                set_bit(frame->prev_type, frame->stacks_done);
+        }
+
+        /*
+         * Record this frame record's values and location. The prev_fp and
+         * prev_type are only meaningful to the next unwind_frame() invocation.
+         */
         frame->fp = READ_ONCE_NOCHECK(*(unsigned long *)(fp));
         frame->pc = READ_ONCE_NOCHECK(*(unsigned long *)(fp + 8));
+        frame->prev_fp = fp;
+        frame->prev_type = info.type;
 
 #ifdef CONFIG_FUNCTION_GRAPH_TRACER
         if (tsk->ret_stack &&
@@ -73,6 +112,7 @@ int notrace unwind_frame(struct task_struct *tsk, struct stackframe *frame)
 
         return 0;
 }
+NOKPROBE_SYMBOL(unwind_frame);
 
 void notrace walk_stackframe(struct task_struct *tsk, struct stackframe *frame,
                      int (*fn)(struct stackframe *, void *), void *data)
@@ -87,6 +127,7 @@ void notrace walk_stackframe(struct task_struct *tsk, struct stackframe *frame,
                         break;
         }
 }
+NOKPROBE_SYMBOL(walk_stackframe);
 
 #ifdef CONFIG_STACKTRACE
 struct stack_trace_data {
@@ -122,12 +163,7 @@ void save_stack_trace_regs(struct pt_regs *regs, struct stack_trace *trace)
         data.skip = trace->skip;
         data.no_sched_functions = 0;
 
-        frame.fp = regs->regs[29];
-        frame.pc = regs->pc;
-#ifdef CONFIG_FUNCTION_GRAPH_TRACER
-        frame.graph = 0;
-#endif
-
+        start_backtrace(&frame, regs->regs[29], regs->pc);
         walk_stackframe(current, &frame, save_trace, &data);
 }
 EXPORT_SYMBOL_GPL(save_stack_trace_regs);
@@ -146,17 +182,15 @@ static noinline void __save_stack_trace(struct task_struct *tsk,
         data.no_sched_functions = nosched;
 
         if (tsk != current) {
-                frame.fp = thread_saved_fp(tsk);
-                frame.pc = thread_saved_pc(tsk);
+                start_backtrace(&frame, thread_saved_fp(tsk),
+                                thread_saved_pc(tsk));
         } else {
                 /* We don't want this function nor the caller */
                 data.skip += 2;
-                frame.fp = (unsigned long)__builtin_frame_address(0);
-                frame.pc = (unsigned long)__save_stack_trace;
+                start_backtrace(&frame,
+                                (unsigned long)__builtin_frame_address(0),
+                                (unsigned long)__save_stack_trace);
         }
-#ifdef CONFIG_FUNCTION_GRAPH_TRACER
-        frame.graph = 0;
-#endif
 
         walk_stackframe(tsk, &frame, save_trace, &data);