linux-kernel - [PATCH 1/1] sched/headers: fix thread_info.<first> is overwritten by STACK_END

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <e7952089a66db4e5d59d2af230a324155bb018a0.1542955914.git.dongsheng.wang@hxt-semitech.com>
Date:   Fri, 23 Nov 2018 15:54:48 +0800
From:   Wang Dongsheng <dongsheng.wang@...-semitech.com>
To:     <dhowells@...hat.com>, <tglx@...utronix.de>
CC:     <mingo@...nel.org>, <akpm@...ux-foundation.org>,
        <yamada.masahiro@...ionext.com>, <keescook@...omium.org>,
        <tony.luck@...el.com>, <will.deacon@....com>, <palmer@...ive.com>,
        <yu.zheng@...-semitech.com>, <linux-kernel@...r.kernel.org>,
        Wang Dongsheng <dongsheng.wang@...-semitech.com>,
        Shunyong Yang <shunyong.yang@...-semitech.com>
Subject: [PATCH 1/1] sched/headers: fix thread_info.<first> is overwritten by STACK_END_MAGIC

When select ARCH_TASK_STRUCT_ON_STACK the first of thread_info variable
is overwritten by STACK_END_MAGIC. In fact, the ARCH_TASK_STRUCT_ON_STACK
is not a real task on stack, it's only init_task on init_stack.

Commit 0500871f21b2 ("Construct init thread stack in the linker script
rather than by union") added this macro and put task_strcut into
thread_union. This brings us the following possibilities:
    TASK_ON_STACK    THREAD_INFO_IN_TASK    STACK
                                            ----- <-- thread_info & stack
        N                    N             |     |     --- <-- task
                                           |     |    |   |
                                            -----      ---

                                            ----- <-- stack
        N                    Y             |     |     --- <-- task(Including thread_info)
                                           |     |    |   |
                                            -----      ---

                                            ----- <-- stack & task & thread_info
        Y                    N             |     |
                                           |     |
                                            -----

                                            ----- <-- stack & task(Including thread_info)
        Y                    Y             |     |
                                           |     |
                                            -----
The kernel has handled the first two cases correctly.

For the third case:
TASK_ON_STACK: Y. THREAD_INFO_IN_TASK: N. this case
should never happen, because the task and thread_info will overlap. So
when TASK_ON_STACK is selected, THREAD_INFO_IN_TASK must be selected too.

For the fourth case:
When task on stack, the end of stack should add a sizeof(task_struct) offset.

This patch handled with the third and fourth case.

Fixes: 0500871f21b2 ("Construct init thread stack in the linker ...")

Signed-off-by: Wang Dongsheng <dongsheng.wang@...-semitech.com>
Signed-off-by: Shunyong Yang <shunyong.yang@...-semitech.com>
---
 arch/Kconfig                     | 1 +
 include/linux/sched/task_stack.h | 5 ++++-
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/arch/Kconfig b/arch/Kconfig
index e1e540ffa979..0a2c73e73195 100644
--- a/arch/Kconfig
+++ b/arch/Kconfig
@@ -251,6 +251,7 @@ config ARCH_HAS_SET_MEMORY
 # Select if arch init_task must go in the __init_task_data section
 config ARCH_TASK_STRUCT_ON_STACK
        bool
+	depends on THREAD_INFO_IN_TASK || IA64
 
 # Select if arch has its private alloc_task_struct() function
 config ARCH_TASK_STRUCT_ALLOCATOR
diff --git a/include/linux/sched/task_stack.h b/include/linux/sched/task_stack.h
index 6a841929073f..624c48defb9e 100644
--- a/include/linux/sched/task_stack.h
+++ b/include/linux/sched/task_stack.h
@@ -7,6 +7,7 @@
  */
 
 #include <linux/sched.h>
+#include <linux/sched/task.h>
 #include <linux/magic.h>
 
 #ifdef CONFIG_THREAD_INFO_IN_TASK
@@ -25,7 +26,9 @@ static inline void *task_stack_page(const struct task_struct *task)
 
 static inline unsigned long *end_of_stack(const struct task_struct *task)
 {
-	return task->stack;
+	if (!IS_ENABLED(CONFIG_ARCH_TASK_STRUCT_ON_STACK) || task != &init_task)
+		return task->stack;
+	return (unsigned long *)(task + 1);
 }
 
 #elif !defined(__HAVE_THREAD_FUNCTIONS)
-- 
2.19.1