lkml.org 
[lkml]   [2019]   [Oct]   [10]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.19 001/114] s390/process: avoid potential reading of freed stack
    Date
    From: Vasily Gorbik <gor@linux.ibm.com>

    commit 8769f610fe6d473e5e8e221709c3ac402037da6c upstream.

    With THREAD_INFO_IN_TASK (which is selected on s390) task's stack usage
    is refcounted and should always be protected by get/put when touching
    other task's stack to avoid race conditions with task's destruction code.

    Fixes: d5c352cdd022 ("s390: move thread_info into task_struct")
    Cc: stable@vger.kernel.org # v4.10+
    Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
    Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    arch/s390/kernel/process.c | 22 ++++++++++++++++------
    1 file changed, 16 insertions(+), 6 deletions(-)

    --- a/arch/s390/kernel/process.c
    +++ b/arch/s390/kernel/process.c
    @@ -183,20 +183,30 @@ unsigned long get_wchan(struct task_stru

    if (!p || p == current || p->state == TASK_RUNNING || !task_stack_page(p))
    return 0;
    +
    + if (!try_get_task_stack(p))
    + return 0;
    +
    low = task_stack_page(p);
    high = (struct stack_frame *) task_pt_regs(p);
    sf = (struct stack_frame *) p->thread.ksp;
    - if (sf <= low || sf > high)
    - return 0;
    + if (sf <= low || sf > high) {
    + return_address = 0;
    + goto out;
    + }
    for (count = 0; count < 16; count++) {
    sf = (struct stack_frame *) sf->back_chain;
    - if (sf <= low || sf > high)
    - return 0;
    + if (sf <= low || sf > high) {
    + return_address = 0;
    + goto out;
    + }
    return_address = sf->gprs[8];
    if (!in_sched_functions(return_address))
    - return return_address;
    + goto out;
    }
    - return 0;
    +out:
    + put_task_stack(p);
    + return return_address;
    }

    unsigned long arch_align_stack(unsigned long sp)

    \
     
     \ /
      Last update: 2019-10-10 10:59    [W:3.011 / U:0.252 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site