Messages in this thread | | | Date | Mon, 28 Sep 2015 12:23:14 +0200 | From | Borislav Petkov <> | Subject | Re: [PATCH] arch/x86: fix out-of-bounds in get_wchan() |
| |
On Mon, Sep 28, 2015 at 11:49:18AM +0200, Dmitry Vyukov wrote: > Original code did: > > if (p->thread.sp < stack || p->thread.sp >= stack+THREAD_SIZE) > return 0; > fp = *(u64 *)(p->thread.sp); > > p->thread.sp can change concurrently. > So we could check that p->thread.sp is within stack bounds, but then > dereference another value (which is already outside of bounds).
Right, we do deref it. I realized that after hitting "Send" :\
Which begs another, probably also stupid, question:
What guarantees the task won't disappear after we've checked p?
I.e., after this:
if (!p || p == current || p->state == TASK_RUNNING) return 0;
Thanks.
-- Regards/Gruss, Boris.
ECO tip #101: Trim your mails when you reply.
| |