In the Linux kernel, the following vulnerability has been resolved:
riscv: VMAP_STACK overflow detection thread-safe
commit 31da94c25aea ("riscv: add VMAPSTACK overflow detection") added
support for CONFIGVMAP_STACK. If overflow is detected, CPU switches to
shadow_stack
temporarily before switching finally to per-cpu
overflow_stack
.
If two CPUs/harts are racing and end up in over flowing kernel stack, one
or both will end up corrupting each other state because shadow_stack
is
not per-cpu. This patch optimizes per-cpu overflow stack switch by
directly picking per-cpu overflow_stack
and gets rid of shadow_stack
.
Following are the changes in this patch
Please see Links for additional relevant disccussion and alternative solution.
Tested by echo EXHAUST_STACK > /sys/kernel/debug/provoke-crash/DIRECT
Kernel crash log below
Insufficient stack space to handle exception!/debug/provoke-crash/DIRECT Task stack: [0xff20000010a98000..0xff20000010a9c000] Overflow stack: [0xff600001f7d98370..0xff600001f7d99370] CPU: 1 PID: 205 Comm: bash Not tainted 6.1.0-rc2-00001-g328a1f96f7b9 #34 Hardware name: riscv-virtio,qemu (DT) epc : _memset+0x60/0xfc ra : recursiveloop+0x48/0xc6 [lkdtm] epc : ffffffff808de0e4 ra : ffffffff0163a752 sp : ff20000010a97e80 gp : ffffffff815c0330 tp : ff600000820ea280 t0 : ff20000010a97e88 t1 : 000000000000002e t2 : 3233206874706564 s0 : ff20000010a982b0 s1 : 0000000000000012 a0 : ff20000010a97e88 a1 : 0000000000000000 a2 : 0000000000000400 a3 : ff20000010a98288 a4 : 0000000000000000 a5 : 0000000000000000 a6 : fffffffffffe43f0 a7 : 00007fffffffffff s2 : ff20000010a97e88 s3 : ffffffff01644680 s4 : ff20000010a9be90 s5 : ff600000842ba6c0 s6 : 00aaaaaac29e42b0 s7 : 00fffffff0aa3684 s8 : 00aaaaaac2978040 s9 : 0000000000000065 s10: 00ffffff8a7cad10 s11: 00ffffff8a76a4e0 t3 : ffffffff815dbaf4 t4 : ffffffff815dbaf4 t5 : ffffffff815dbab8 t6 : ff20000010a9bb48 status: 0000000200000120 badaddr: ff20000010a97e88 cause: 000000000000000f Kernel panic - not syncing: Kernel stack overflow CPU: 1 PID: 205 Comm: bash Not tainted 6.1.0-rc2-00001-g328a1f96f7b9 #34 Hardware name: riscv-virtio,qemu (DT) Call Trace: [<ffffffff80006754>] dumpbacktrace+0x30/0x38 [<ffffffff808de798>] showstack+0x40/0x4c [<ffffffff808ea2a8>] dumpstacklvl+0x44/0x5c [<ffffffff808ea2d8>] dumpstack+0x18/0x20 [<ffffffff808dec06>] panic+0x126/0x2fe [<ffffffff800065ea>] walkstackframe+0x0/0xf0 [<ffffffff0163a752>] recursive_loop+0x48/0xc6 [lkdtm] SMP: stopping secondary CPUs ---[ end Kernel panic - not syncing: Kernel stack overflow ]---
{ "vanir_signatures": [ { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@eff53aea3855f71992c043cebb1c00988c17ee20", "signature_type": "Line", "digest": { "threshold": 0.9, "line_hashes": [ "329369366916109119289938835360301115104", "140335383852241630136886944385948311723", "313849596878098560642159191183947738586", "327292730003774712205283013815425302369", "213414850629703947625485838051653851530", "324669679160789758860631481435923136841", "100072596411938864459206498072677073346", "244731171625294332805437759394259933958", "144121286780443319405269429945473915268", "189438437295657685950611903961053416686", "274801965056376310915837951660848685551", "80300010743415969679268657004821860997", "232094737266503657333396784105288871092", "24801319011746805436798484229960811366", "260238797804046030939497573789391804587", "316800230356954604579046282542750356885", "337562747502703261398807580949711124068" ] }, "id": "CVE-2023-52761-00b6b495", "target": { "file": "arch/riscv/kernel/traps.c" }, "deprecated": false, "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@be97d0db5f44c0674480cb79ac6f5b0529b84c76", "signature_type": "Function", "digest": { "function_hash": "35310103805747887436551938858924979958", "length": 543.0 }, "id": "CVE-2023-52761-083e13d0", "target": { "file": "arch/riscv/kernel/traps.c", "function": "handle_bad_stack" }, "deprecated": false, "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@eff53aea3855f71992c043cebb1c00988c17ee20", "signature_type": "Function", "digest": { "function_hash": "184038060703111237884888746817697806847", "length": 115.0 }, "id": "CVE-2023-52761-0af0ea9d", "target": { "file": "arch/riscv/kernel/traps.c", "function": "get_overflow_stack" }, "deprecated": false, "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@eff53aea3855f71992c043cebb1c00988c17ee20", "signature_type": "Line", "digest": { "threshold": 0.9, "line_hashes": [ "108781253502373557805334283935257742357", "287968776358101635562773591212937938708", "325805095301998071846046851384206581200", "75034790480952823036370103200147024642" ] }, "id": "CVE-2023-52761-36d8d44f", "target": { "file": "arch/riscv/include/asm/asm-prototypes.h" }, "deprecated": false, "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1493baaf09e3c1899959c8a107cd1207e16d1788", "signature_type": "Line", "digest": { "threshold": 0.9, "line_hashes": [ "166897470689657198782546344298522841828", "338782468228214373610495238733238648250", "283254807977438152092667971280004225809" ] }, "id": "CVE-2023-52761-534fb9b8", "target": { "file": "arch/riscv/include/asm/asm.h" }, "deprecated": false, "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@eff53aea3855f71992c043cebb1c00988c17ee20", "signature_type": "Line", "digest": { "threshold": 0.9, "line_hashes": [ "185451259063489817191189328063900336949", "312035659996713083325217310032019108641", "314154957340002907226240852546945827608" ] }, "id": "CVE-2023-52761-582d5152", "target": { "file": "arch/riscv/kernel/asm-offsets.c" }, "deprecated": false, "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1493baaf09e3c1899959c8a107cd1207e16d1788", "signature_type": "Function", "digest": { "function_hash": "37966360692978989644511530183657052669", "length": 22837.0 }, "id": "CVE-2023-52761-5ea5802c", "target": { "file": "arch/riscv/kernel/asm-offsets.c", "function": "asm_offsets" }, "deprecated": false, "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1493baaf09e3c1899959c8a107cd1207e16d1788", "signature_type": "Function", "digest": { "function_hash": "35310103805747887436551938858924979958", "length": 543.0 }, "id": "CVE-2023-52761-6476ed71", "target": { "file": "arch/riscv/kernel/traps.c", "function": "handle_bad_stack" }, "deprecated": false, "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1493baaf09e3c1899959c8a107cd1207e16d1788", "signature_type": "Function", "digest": { "function_hash": "184038060703111237884888746817697806847", "length": 115.0 }, "id": "CVE-2023-52761-7721e59e", "target": { "file": "arch/riscv/kernel/traps.c", "function": "get_overflow_stack" }, "deprecated": false, "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1493baaf09e3c1899959c8a107cd1207e16d1788", "signature_type": "Line", "digest": { "threshold": 0.9, "line_hashes": [ "185451259063489817191189328063900336949", "312035659996713083325217310032019108641", "314154957340002907226240852546945827608" ] }, "id": "CVE-2023-52761-78010c03", "target": { "file": "arch/riscv/kernel/asm-offsets.c" }, "deprecated": false, "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1493baaf09e3c1899959c8a107cd1207e16d1788", "signature_type": "Line", "digest": { "threshold": 0.9, "line_hashes": [ "108781253502373557805334283935257742357", "287968776358101635562773591212937938708", "325805095301998071846046851384206581200", "75034790480952823036370103200147024642" ] }, "id": "CVE-2023-52761-89afa5c1", "target": { "file": "arch/riscv/include/asm/asm-prototypes.h" }, "deprecated": false, "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@be97d0db5f44c0674480cb79ac6f5b0529b84c76", "signature_type": "Line", "digest": { "threshold": 0.9, "line_hashes": [ "108781253502373557805334283935257742357", "287968776358101635562773591212937938708", "325805095301998071846046851384206581200", "75034790480952823036370103200147024642" ] }, "id": "CVE-2023-52761-a021f52a", "target": { "file": "arch/riscv/include/asm/asm-prototypes.h" }, "deprecated": false, "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@be97d0db5f44c0674480cb79ac6f5b0529b84c76", "signature_type": "Line", "digest": { "threshold": 0.9, "line_hashes": [ "329369366916109119289938835360301115104", "140335383852241630136886944385948311723", "313849596878098560642159191183947738586", "327292730003774712205283013815425302369", "213414850629703947625485838051653851530", "324669679160789758860631481435923136841", "100072596411938864459206498072677073346", "244731171625294332805437759394259933958", "144121286780443319405269429945473915268", "189438437295657685950611903961053416686", "274801965056376310915837951660848685551", "80300010743415969679268657004821860997", "232094737266503657333396784105288871092", "24801319011746805436798484229960811366", "260238797804046030939497573789391804587", "316800230356954604579046282542750356885", "337562747502703261398807580949711124068" ] }, "id": "CVE-2023-52761-a23560c3", "target": { "file": "arch/riscv/kernel/traps.c" }, "deprecated": false, "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@be97d0db5f44c0674480cb79ac6f5b0529b84c76", "signature_type": "Line", "digest": { "threshold": 0.9, "line_hashes": [ "188704879629474626118565526774504560889", "310940364098274732898945320455864076559", "34501553458894657477515250002390703487", "71877073036632361925784741929876173628", "270956916067000618957763070029610758797" ] }, "id": "CVE-2023-52761-a7b91fbe", "target": { "file": "arch/riscv/include/asm/thread_info.h" }, "deprecated": false, "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@eff53aea3855f71992c043cebb1c00988c17ee20", "signature_type": "Line", "digest": { "threshold": 0.9, "line_hashes": [ "166897470689657198782546344298522841828", "338782468228214373610495238733238648250", "283254807977438152092667971280004225809" ] }, "id": "CVE-2023-52761-aadd354a", "target": { "file": "arch/riscv/include/asm/asm.h" }, "deprecated": false, "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@eff53aea3855f71992c043cebb1c00988c17ee20", "signature_type": "Function", "digest": { "function_hash": "35310103805747887436551938858924979958", "length": 543.0 }, "id": "CVE-2023-52761-af917b88", "target": { "file": "arch/riscv/kernel/traps.c", "function": "handle_bad_stack" }, "deprecated": false, "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@be97d0db5f44c0674480cb79ac6f5b0529b84c76", "signature_type": "Function", "digest": { "function_hash": "37966360692978989644511530183657052669", "length": 22837.0 }, "id": "CVE-2023-52761-afed0cfa", "target": { "file": "arch/riscv/kernel/asm-offsets.c", "function": "asm_offsets" }, "deprecated": false, "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@be97d0db5f44c0674480cb79ac6f5b0529b84c76", "signature_type": "Line", "digest": { "threshold": 0.9, "line_hashes": [ "185451259063489817191189328063900336949", "312035659996713083325217310032019108641", "314154957340002907226240852546945827608" ] }, "id": "CVE-2023-52761-b0537349", "target": { "file": "arch/riscv/kernel/asm-offsets.c" }, "deprecated": false, "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@eff53aea3855f71992c043cebb1c00988c17ee20", "signature_type": "Function", "digest": { "function_hash": "37966360692978989644511530183657052669", "length": 22837.0 }, "id": "CVE-2023-52761-b9373bc1", "target": { "file": "arch/riscv/kernel/asm-offsets.c", "function": "asm_offsets" }, "deprecated": false, "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@be97d0db5f44c0674480cb79ac6f5b0529b84c76", "signature_type": "Line", "digest": { "threshold": 0.9, "line_hashes": [ "166897470689657198782546344298522841828", "338782468228214373610495238733238648250", "283254807977438152092667971280004225809" ] }, "id": "CVE-2023-52761-bd7aa9ae", "target": { "file": "arch/riscv/include/asm/asm.h" }, "deprecated": false, "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@be97d0db5f44c0674480cb79ac6f5b0529b84c76", "signature_type": "Function", "digest": { "function_hash": "184038060703111237884888746817697806847", "length": 115.0 }, "id": "CVE-2023-52761-c060e250", "target": { "file": "arch/riscv/kernel/traps.c", "function": "get_overflow_stack" }, "deprecated": false, "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1493baaf09e3c1899959c8a107cd1207e16d1788", "signature_type": "Line", "digest": { "threshold": 0.9, "line_hashes": [ "188704879629474626118565526774504560889", "310940364098274732898945320455864076559", "34501553458894657477515250002390703487", "71877073036632361925784741929876173628", "270956916067000618957763070029610758797" ] }, "id": "CVE-2023-52761-d26b1fff", "target": { "file": "arch/riscv/include/asm/thread_info.h" }, "deprecated": false, "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@eff53aea3855f71992c043cebb1c00988c17ee20", "signature_type": "Line", "digest": { "threshold": 0.9, "line_hashes": [ "188704879629474626118565526774504560889", "310940364098274732898945320455864076559", "34501553458894657477515250002390703487", "71877073036632361925784741929876173628", "270956916067000618957763070029610758797" ] }, "id": "CVE-2023-52761-d9289d55", "target": { "file": "arch/riscv/include/asm/thread_info.h" }, "deprecated": false, "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1493baaf09e3c1899959c8a107cd1207e16d1788", "signature_type": "Line", "digest": { "threshold": 0.9, "line_hashes": [ "329369366916109119289938835360301115104", "140335383852241630136886944385948311723", "313849596878098560642159191183947738586", "327292730003774712205283013815425302369", "213414850629703947625485838051653851530", "324669679160789758860631481435923136841", "100072596411938864459206498072677073346", "244731171625294332805437759394259933958", "144121286780443319405269429945473915268", "189438437295657685950611903961053416686", "274801965056376310915837951660848685551", "80300010743415969679268657004821860997", "232094737266503657333396784105288871092", "24801319011746805436798484229960811366", "260238797804046030939497573789391804587", "316800230356954604579046282542750356885", "337562747502703261398807580949711124068" ] }, "id": "CVE-2023-52761-ffc83ddd", "target": { "file": "arch/riscv/kernel/traps.c" }, "deprecated": false, "signature_version": "v1" } ] }