Re: [PATCH v3 09/51] x86/dumpstack: fix x86_32 kernel_stack_pointer() previous stack access

[Brian Gerst]

On Sun, Aug 14, 2016 at 3:26 AM, Andy Lutomirski <luto@xxxxxxxxxxxxxx> wrote:
> On Fri, Aug 12, 2016 at 7:28 AM, Josh Poimboeuf <jpoimboe@xxxxxxxxxx> wrote:
>> On x86_32, when an interrupt happens from kernel space, SS and SP aren't
>> pushed and the existing stack is used.  So pt_regs is effectively two
>> words shorter, and the previous stack pointer is normally the memory
>> after the shortened pt_regs, aka '&regs->sp'.
>>
>> But in the rare case where the interrupt hits right after the stack
>> pointer has been changed to point to an empty stack, like for example
>> when call_on_stack() is used, the address immediately after the
>> shortened pt_regs is no longer on the stack.  In that case, instead of
>> '&regs->sp', the previous stack pointer should be retrieved from the
>> beginning of the current stack page.
>>
>> kernel_stack_pointer() wants to do that, but it forgets to dereference
>> the pointer.  So instead of returning a pointer to the previous stack,
>> it returns a pointer to the beginning of the current stack.
>>
>> Fixes: 0788aa6a23cb ("x86: Prepare removal of previous_esp from i386 thread_info structure")
>> Signed-off-by: Josh Poimboeuf <jpoimboe@xxxxxxxxxx>
>
> This seems like a valid fix, but I'm not sure I agree with the intent
> of the code.  &regs->sp really is the previous stack pointer in the
> sense that the stack pointer was &regs->sp when the entry happened.
> From an unwinder's perspective, how is:
>
> movl [whatever], $esp
> <-- interrupt
>
> any different from:
>
> movl [whatever], $esp
> pushl [something]
> <-- interrupt
>
> Also, does x86_32 do this type of stack switching at all?  AFAICS
> 32-bit kernels don't use IRQ stacks in the first place.  Do they?  Am
> I just missing the code that does it?

32-bit uses a software-based stack switch to run on the IRQ stack.
See execute_on_irq_stack() in irq_32.c.

--
Brian Gerst