Messages in this thread | | | From | Dmitry Vyukov <> | Date | Wed, 11 Sep 2013 22:16:32 +0400 | Subject | Re: Out-of-bounds access in get_wchan (arch/x86/kernel/process_64.c) |
| |
On Wed, Sep 11, 2013 at 2:06 AM, Andi Kleen <ak@linux.intel.com> wrote: >> Indeed, get_wchan ensures that fp<stack+THREAD_SIZE, but then dereferences fp+8: >> >> 434 if (fp < (unsigned long)stack || >> 435 fp >= (unsigned long)stack+THREAD_SIZE) >> 436 return 0; >> 437 ip = *(u64 *)(fp+8); >> >> It must check that fp+8<stack+THREAD_SIZE. >> As far as I see, the bug can lead to garbage return values or in the >> worst case to crash. > > Thanks for the report. > > The change looks good to me. Can you please submit a formal signed off patch > to x86@kernel.org ?
Hi Andi,
Wolfram has a patch for it. Wolfram, please send your patch to x86@kernel.org.
| |