linux-kernel - Re: [PATCH] scs: Fix a wrong parameter in __scs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <aQNj3hLLqq8gUx1j@willie-the-truck>
Date: Thu, 30 Oct 2025 13:10:54 +0000
From: Will Deacon <will@...nel.org>
To: Andrew Morton <akpm@...ux-foundation.org>
Cc: Zhichi Lin <zhichi.lin@...o.com>, elver@...gle.com,
	andreyknvl@...il.com, samitolvanen@...gle.com, yee.lee@...iatek.com,
	keescook@...omium.org, linux-kernel@...r.kernel.org,
	xiejiyuan@...o.com
Subject: Re: [PATCH] scs: Fix a wrong parameter in __scs_magic

On Sat, Oct 11, 2025 at 10:11:17AM -0700, Andrew Morton wrote:
> On Sat, 11 Oct 2025 16:22:22 +0800 Zhichi Lin <zhichi.lin@...o.com> wrote:
> 
> > __scs_magic() needs a 'void *' variable, but a 'struct task_struct *'
> > is given. 'task_scs(tsk)' is the starting address of the task's shadow
> > call stack, and '__scs_magic(task_scs(tsk))' is the end address of the
> > task's shadow call stack.
> > Here should be '__scs_magic(task_scs(tsk))'.
> 
> What are the userspace-visible runtime effects of this bug?  Please
> always describe this when fixing something.
> 
> > Fixes: 5bbaf9d1fcb9 ("scs: Add support for stack usage debugging")
> 
> This might need backporting into -stable kernels, that depends on the
> answer to the above question.
> 
> > --- a/kernel/scs.c
> > +++ b/kernel/scs.c
> > @@ -135,7 +135,7 @@ static void scs_check_usage(struct task_struct *tsk)
> >  	if (!IS_ENABLED(CONFIG_DEBUG_STACK_USAGE))
> >  		return;
> >  
> > -	for (p = task_scs(tsk); p < __scs_magic(tsk); ++p) {
> > +	for (p = task_scs(tsk); p < __scs_magic(task_scs(tsk)); ++p) {
> >  		if (!READ_ONCE_NOCHECK(*p))
> >  			break;
> >  		used += sizeof(*p);
> 
> Thanks, I'll grab the patch for now, maybe Will would prefer to take it?

Apologies for the slow reply, I was away for a couple of weeks.

It looks like you've already put this in -next (thank you!), so please
go ahead and send it to Linus as a fix.

Acked-by: Will Deacon <will@...nel.org>

Cheers,

Will