linux-kernel - Re: [PATCH] x86, 32-bit: Fix invalid stack address while in softirq

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1346944482.1680.28.camel@gandalf.local.home>
Date:	Thu, 06 Sep 2012 11:14:42 -0400
From:	Steven Rostedt <rostedt@...dmis.org>
To:	Robert Richter <robert.richter@....com>
Cc:	wyang1 <Wei.Yang@...driver.com>, Ingo Molnar <mingo@...nel.org>,
	Peter Zijlstra <peterz@...radead.org>,
	Linus Torvalds <torvalds@...ux-foundation.org>,
	linux-kernel@...r.kernel.org, oprofile-list@...ts.sourceforge.net
Subject: Re: [PATCH] x86, 32-bit: Fix invalid stack address while in softirq

On Thu, 2012-09-06 at 17:02 +0200, Robert Richter wrote:

> > > --- a/arch/x86/oprofile/backtrace.c
> > > +++ b/arch/x86/oprofile/backtrace.c
> > > @@ -113,7 +113,7 @@ x86_backtrace(struct pt_regs * const regs, unsigned int depth)
> > >  
> > >  	if (!user_mode_vm(regs)) {
> > >  		unsigned long stack = kernel_stack_pointer(regs);
> > > -		if (depth)
> > > +		if (depth & stack)
> > 
> > Can other users of kernel_stack_pointer() be nailed by a return of NULL?
> 
> It would be save here too, but dump_trace() falls back to the current
> stack in case there is no stack address given which we don't want with
> oprofile.
> 
> I was looking at all users of kernel_stack_pointer() and could not
> find any direct pointer dereference of the sp. The only potential
> problems I found could arise here:
> 
>  arch/x86/kernel/kprobes.c:resume_execution()
>  arch/x86/kernel/time.c:profile_pc()
> 
> It is not quite clear if we really need code here that checks the
> pointer. Since a NULL pointer access has the same effect as if the
> stack address would be wrong which would be the case without the
> patch, I rather tend not to change the code here.

Then a comment should be in the oprofile code too. Something to the
effect that oprofile is special and can cause kernel_stack_pointer() to
return NULL in some cases, thus we need to check for it.

-- Steve


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/