Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

x86/dumpstack: Prevent KASAN false positive warnings in __show_regs()

When triggering a stack dump via sysrq (echo t > /proc/sysrq-trigger),
KASAN may report false-positive out-of-bounds access:

BUG: KASAN: out-of-bounds in __show_regs+0x4b/0x340
Call Trace:
dump_stack_lvl
print_address_description.constprop.0
print_report
__show_regs
show_trace_log_lvl
sched_show_task
show_state_filter
sysrq_handle_showstate
__handle_sysrq
write_sysrq_trigger
proc_reg_write
vfs_write
ksys_write
do_syscall_64
entry_SYSCALL_64_after_hwframe

The issue occurs as follows:

Task A (walk other tasks' stacks) Task B (running)
1. echo t > /proc/sysrq-trigger
show_trace_log_lvl
regs = unwind_get_entry_regs()
show_regs_if_on_stack(regs)
2. The stack value pointed by
`regs` keeps changing, and
so are the tags in its
KASAN shadow region.
__show_regs(regs)
regs->ax, regs->bx, ...
3. hit KASAN redzones, OOB

When task A walks task B's stack without suspending it, the continuous changes
in task B's stack (and corresponding KASAN shadow tags) may cause task A to
hit KASAN redzones when accessing obsolete values on the stack, resulting in
false positive reports.

Simply stopping the task before unwinding is not a viable fix, as it would
alter the state intended to inspect. This is especially true for diagnosing
misbehaving tasks (e.g., in a hard lockup), where stopping might fail or hide
the root cause by changing the call stack.

Therefore, fix this by disabling KASAN checks during asynchronous stack
unwinding, which is identified when the unwinding task does not match the
current task (task != current).

[ bp: Align arguments on function's opening brace. ]

Fixes: 3b3fa11bc700 ("x86/dumpstack: Print any pt_regs found on the stack")
Signed-off-by: Tengda Wu <wutengda@huaweicloud.com>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Reviewed-by: Andrey Ryabinin <ryabinin.a.a@gmail.com>
Acked-by: Josh Poimboeuf <jpoimboe@kernel.org>
Link: https://patch.msgid.link/all/20251023090632.269121-1-wutengda@huaweicloud.com

authored by

Tengda Wu and committed by
Borislav Petkov (AMD)
ced37e9c ad74016b

+21 -2
+21 -2
arch/x86/kernel/dumpstack.c
··· 181 181 * in false positive reports. Disable instrumentation to avoid those. 182 182 */ 183 183 __no_kmsan_checks 184 - static void show_trace_log_lvl(struct task_struct *task, struct pt_regs *regs, 185 - unsigned long *stack, const char *log_lvl) 184 + static void __show_trace_log_lvl(struct task_struct *task, struct pt_regs *regs, 185 + unsigned long *stack, const char *log_lvl) 186 186 { 187 187 struct unwind_state state; 188 188 struct stack_info stack_info = {0}; ··· 301 301 if (stack_name) 302 302 printk("%s </%s>\n", log_lvl, stack_name); 303 303 } 304 + } 305 + 306 + static void show_trace_log_lvl(struct task_struct *task, struct pt_regs *regs, 307 + unsigned long *stack, const char *log_lvl) 308 + { 309 + /* 310 + * Disable KASAN to avoid false positives during walking another 311 + * task's stacks, as values on these stacks may change concurrently 312 + * with task execution. 313 + */ 314 + bool disable_kasan = task && task != current; 315 + 316 + if (disable_kasan) 317 + kasan_disable_current(); 318 + 319 + __show_trace_log_lvl(task, regs, stack, log_lvl); 320 + 321 + if (disable_kasan) 322 + kasan_enable_current(); 304 323 } 305 324 306 325 void show_stack(struct task_struct *task, unsigned long *sp,