lkml.org 
[lkml]   [2013]   [Sep]   [28]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    From
    SubjectRe: Out-of-bounds access in get_wchan (arch/x86/kernel/process_64.c)
    Date
    Kees Cook <kees@outflux.net> writes:

    > Please note that these bounds checks aren't correct to begin with. Since
    > a pointer is being dereferenced, the end boundry must be reduced by
    > sizeof(unsigned long) as well.
    >
    > It looks like process_32.c suffers the same problems, too.

    I can't see the end boundary problem in process_32.c. The end checks
    are properly reduced with the top_esp and top_ebp macros.

    All I can see in process_32.c is that the check

    if (bp < stack_page || bp > top_ebp+stack_page)

    could be replaced by:

    if (bp < stack_page-sizeof(unsigned long) || bp > top_ebp+stack_page)

    but that is a relaxation and not an over/underrun fix.

    Can you elaborate what problem you see in process_32.c?

    Regards,
    Wolfram.


    \
     
     \ /
      Last update: 2013-09-28 22:01    [W:7.823 / U:0.044 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site