linux-kernel - Re: 2.6.26-rc: SPARC: Sun Ultra 10 can not boot

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20080807.230139.220174417.davem@davemloft.net>
Date:	Thu, 07 Aug 2008 23:01:39 -0700 (PDT)
From:	David Miller <davem@...emloft.net>
To:	a.beregalov@...il.com
Cc:	mikpe@...uu.se, kernel-testers@...r.kernel.org,
	sparclinux@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: 2.6.26-rc: SPARC: Sun Ultra 10 can not boot

From: "Alexander Beregalov" <a.beregalov@...il.com>
Date: Mon, 7 Jul 2008 19:59:04 +0400

> I have turned off LOCKDEP and it boots properly.
> 2.6.26-rc9-00005-g1b40a89
> 
> Mikael's config also does not contain LOCKDEP.

I have finally reproduced the problem locally and figured out the
bug.

Please try this patch:

sparc64: Fix end-of-stack checking in save_stack_trace().

Bug reported by Alexander Beregalov.

Before we dereference the stack frame or try to peek at the
pt_regs magic value, make sure the entire object is within
the kernel stack bounds.

Signed-off-by: David S. Miller <davem@...emloft.net>

diff --git a/arch/sparc64/kernel/stacktrace.c b/arch/sparc64/kernel/stacktrace.c
index c73ce3f..c5576e8 100644
--- a/arch/sparc64/kernel/stacktrace.c
+++ b/arch/sparc64/kernel/stacktrace.c
@@ -25,13 +25,15 @@ void save_stack_trace(struct stack_trace *trace)
 
 		/* Bogus frame pointer? */
 		if (fp < (thread_base + sizeof(struct thread_info)) ||
-		    fp >= (thread_base + THREAD_SIZE))
+		    fp > (thread_base + THREAD_SIZE - sizeof(struct sparc_stackf)))
 			break;
 
 		sf = (struct sparc_stackf *) fp;
 		regs = (struct pt_regs *) (sf + 1);
 
-		if ((regs->magic & ~0x1ff) == PT_REGS_MAGIC) {
+		if (((unsigned long)regs <=
+		     (thread_base + THREAD_SIZE - sizeof(*regs))) &&
+		    (regs->magic & ~0x1ff) == PT_REGS_MAGIC) {
 			if (!(regs->tstate & TSTATE_PRIV))
 				break;
 			pc = regs->tpc;
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/