⬢ DragonFlyBSD Kernel Audit
DF-1078 / fix.diff
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
diff --git a/sys/platform/vkernel64/x86_64/db_trace.c b/sys/platform/vkernel64/x86_64/db_trace.c
--- a/sys/platform/vkernel64/x86_64/db_trace.c
+++ b/sys/platform/vkernel64/x86_64/db_trace.c
@@ -277,18 +277,29 @@
 		{
 			rip = tf->tf_rip;
 			rbp = tf->tf_rbp;
-			db_printf(
-	    "--- trap %016lx, rip = %016lx, rsp = %016lx, rbp = %016lx ---\n",
-			    tf->tf_trapno, rip, rsp, rbp);
+			/*
+			 * When invoked from print_backtrace() (panic / INVARIANTS
+			 * warning) db_active == 0 and db_putchar routes via kprintf
+			 * to msgbuf + host stdout, which unprivileged guest
+			 * processes can read via /dev/klog / dmesg.  Suppress raw
+			 * rsp / rbp there; print rip symbolically.
+			 */
+			db_printf("--- trap %ld, rip = ", tf->tf_trapno);
+			db_printsym(rip, DB_STGY_PROC);
+			if (db_active)
+				db_printf(", rsp = %016lx, rbp = %016lx", rsp, rbp);
+			db_printf(" ---\n");
 		}
 		break;
 	case SYSCALL:
 		{
 			rip = tf->tf_rip;
 			rbp = tf->tf_rbp;
-			db_printf(
-	"--- syscall %016lx, rip = %016lx, rsp = %016lx, rbp = %016lx ---\n",
-			    tf->tf_rax, rip, rsp, rbp);
+			db_printf("--- syscall %ld, rip = ", tf->tf_rax);
+			db_printsym(rip, DB_STGY_PROC);
+			if (db_active)
+				db_printf(", rsp = %016lx, rbp = %016lx", rsp, rbp);
+			db_printf(" ---\n");
 		}
 		break;
 	case INTERRUPT:
@@ -296,9 +307,11 @@
 		{
 			rip = tf->tf_rip;
 			rbp = tf->tf_rbp;
-			db_printf(
-	    "--- interrupt, rip = %016lx, rsp = %016lx, rbp = %016lx ---\n",
-			    rip, rsp, rbp);
+			db_printf("--- interrupt, rip = ");
+			db_printsym(rip, DB_STGY_PROC);
+			if (db_active)
+				db_printf(", rsp = %016lx, rbp = %016lx", rsp, rbp);
+			db_printf(" ---\n");
 		}
 		break;
 	default:
@@ -342,14 +355,17 @@
 			) {
 				break;
 			}
-			db_printf("%p does not look like a stack frame, skipping\n", (char *)&frame->f_frame + i);
+			if (db_active)
+				db_printf("%p does not look like a stack frame, skipping\n",
+				    (char *)&frame->f_frame + i);
 		}
 		if (i == 4096) {
 			db_printf("Unable to find anything that looks like a stack frame\n");
 			return;
 		}
 		frame = (void *)((char *)frame + i);
-		db_printf("Trace beginning at frame %p\n", frame);
+		if (db_active)
+			db_printf("Trace beginning at frame %p\n", frame);
 		callpc = (db_addr_t)db_get_value((long)&frame->f_retaddr, 8, FALSE);
 	}
 
@@ -427,6 +443,14 @@
 
 		db_print_stack_entry(name, narg, argnp, argp, callpc);
 
+		/*
+		 * Stop at the system call boundary so we don't keep walking
+		 * into junk / user-space frames and emit unresolved raw
+		 * addresses via db_printsym.  Port from pc64 db_trace.c:434.
+		 */
+		if (name && strcmp(name, "Xfast_syscall") == 0)
+			break;
+
 		if (actframe != frame) {
 			/* `frame' belongs to caller. */
 			callpc = (db_addr_t)