p71924506
/
linux_old1
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

s390/process: avoid potential reading of freed stack 

With THREAD_INFO_IN_TASK (which is selected on s390) task's stack usage
is refcounted and should always be protected by get/put when touching
other task's stack to avoid race conditions with task's destruction code.

Fixes: d5c352cdd0 ("s390: move thread_info into task_struct")
Cc: stable@vger.kernel.org # v4.10+
Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
This commit is contained in:
Vasily Gorbik 2019-08-13 20:11:08 +02:00
parent f45f7b5bda
commit 8769f610fe
1 changed files with 16 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
arch/s390/kernel/process.c
View File

@ -184,20 +184,30 @@ unsigned long get_wchan(struct task_struct *p)
if (!p || p == current || p->state == TASK_RUNNING || !task_stack_page(p)) if (!p || p == current || p->state == TASK_RUNNING || !task_stack_page(p))
return 0; return 0;
if (!try_get_task_stack(p))
return 0;
low = task_stack_page(p); low = task_stack_page(p);
high = (struct stack_frame *) task_pt_regs(p); high = (struct stack_frame *) task_pt_regs(p);
sf = (struct stack_frame *) p->thread.ksp; sf = (struct stack_frame *) p->thread.ksp;
if (sf <= low || sf > high) if (sf <= low || sf > high) {
return 0; return_address = 0;
goto out;
}
for (count = 0; count < 16; count++) { for (count = 0; count < 16; count++) {
sf = (struct stack_frame *) sf->back_chain; sf = (struct stack_frame *) sf->back_chain;
if (sf <= low || sf > high) if (sf <= low || sf > high) {
return 0; return_address = 0;
goto out;
}
return_address = sf->gprs[8]; return_address = sf->gprs[8];
if (!in_sched_functions(return_address)) if (!in_sched_functions(return_address))
return return_address; goto out;
} }
return 0; out:
put_task_stack(p);
return return_address;
} }
unsigned long arch_align_stack(unsigned long sp) unsigned long arch_align_stack(unsigned long sp)