Messages in this thread | | | Date | Tue, 10 Sep 2013 15:06:38 -0700 | From | Andi Kleen <> | Subject | Re: Out-of-bounds access in get_wchan (arch/x86/kernel/process_64.c) |
| |
> Indeed, get_wchan ensures that fp<stack+THREAD_SIZE, but then dereferences fp+8: > > 434 if (fp < (unsigned long)stack || > 435 fp >= (unsigned long)stack+THREAD_SIZE) > 436 return 0; > 437 ip = *(u64 *)(fp+8); > > It must check that fp+8<stack+THREAD_SIZE. > As far as I see, the bug can lead to garbage return values or in the > worst case to crash.
Thanks for the report.
The change looks good to me. Can you please submit a formal signed off patch to x86@kernel.org ?
-Andi
-- ak@linux.intel.com -- Speaking for myself only
| |