[PATCH 3.16 069/134] x86/boot: Fix BSS corruption/overwrite bug in early x86 kernel startup

Path	csiph.com!eternal-september.org!feeder.eternal-september.org!aioe.org!news.servidellagleba.it!bofh.it!news.nic.it!robomod
From	Ben Hutchings <ben@decadent.org.uk>
Newsgroups	linux.kernel
Subject	[PATCH 3.16 069/134] x86/boot: Fix BSS corruption/overwrite bug in early x86 kernel startup
Date	Fri, 18 Aug 2017 15:40:04 +0200
Message-ID	<ufPFi-4ln-51@gated-at.bofh.it> (permalink)
References	<ufPlT-4d0-3@gated-at.bofh.it>
Content-Type	text/plain; charset="UTF-8"
Content-Disposition	inline
Content-Transfer-Encoding	8bit
MIME-Version	1.0
X-Mailer	LinuxStableQueue (scripts by bwh)
X-Sa-Exim-Connect-IP	82.70.136.246
X-Sa-Exim-Mail-From	ben@decadent.org.uk
X-Sa-Exim-Scanned	No (on shadbolt.decadent.org.uk); SAEximRunCond expanded to false
Sender	robomod@news.nic.it
List-ID	<linux-kernel.vger.kernel.org>
X-Mailing-List	linux-kernel@vger.kernel.org
Approved	robomod@news.nic.it
Lines	50
Organization	linux.* mail to news gateway
X-Original-Cc	akpm@linux-foundation.org, "Ingo Molnar" <mingo@kernel.org>, "Peter Zijlstra" <peterz@infradead.org>, "H. Peter Anvin" <hpa@zytor.com>, "Denys Vlasenko" <dvlasenk@redhat.com>, "Andy Lutomirski" <luto@kernel.org>, "Brian Gerst" <brgerst@gmail.com>, "Thomas Gleixner" <tglx@linutronix.de>, "Josh Poimboeuf" <jpoimboe@redhat.com>, "Borislav Petkov" <bp@alien8.de>, "Ashish Kalra" <ashish@bluestacks.com>, "Linus Torvalds" <torvalds@linux-foundation.org>
X-Original-Date	Fri, 18 Aug 2017 14:13:20 +0100
X-Original-Message-ID	<lsq.1503062000.457467508@decadent.org.uk>
X-Original-References	<lsq.1503061998.818387115@decadent.org.uk>
X-Original-Sender	linux-kernel-owner@vger.kernel.org
Xref	csiph.com linux.kernel:1715004

Show key headers only | View raw

3.16.47-rc1 review patch.  If anyone has any objections, please let me know.

------------------

From: Ashish Kalra <ashish@bluestacks.com>

commit d594aa0277e541bb997aef0bc0a55172d8138340 upstream.

The minimum size for a new stack (512 bytes) setup for arch/x86/boot components
when the bootloader does not setup/provide a stack for the early boot components
is not "enough".

The setup code executing as part of early kernel startup code, uses the stack
beyond 512 bytes and accidentally overwrites and corrupts part of the BSS
section. This is exposed mostly in the early video setup code, where
it was corrupting BSS variables like force_x, force_y, which in-turn affected
kernel parameters such as screen_info (screen_info.orig_video_cols) and
later caused an exception/panic in console_init().

Most recent boot loaders setup the stack for early boot components, so this
stack overwriting into BSS section issue has not been exposed.

Signed-off-by: Ashish Kalra <ashish@bluestacks.com>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Brian Gerst <brgerst@gmail.com>
Cc: Denys Vlasenko <dvlasenk@redhat.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Josh Poimboeuf <jpoimboe@redhat.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Link: http://lkml.kernel.org/r/20170419152015.10011-1-ashishkalra@Ashishs-MacBook-Pro.local
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
 arch/x86/boot/boot.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/arch/x86/boot/boot.h
+++ b/arch/x86/boot/boot.h
@@ -16,7 +16,7 @@
 #ifndef BOOT_BOOT_H
 #define BOOT_BOOT_H
 
-#define STACK_SIZE	512	/* Minimum number of bytes for stack */
+#define STACK_SIZE	1024	/* Minimum number of bytes for stack */
 
 #ifndef __ASSEMBLY__

Back to linux.kernel | Previous | Next | Find similar | Unroll thread

Thread

[PATCH 3.16 069/134] x86/boot: Fix BSS corruption/overwrite bug  in early x86 kernel startup Ben Hutchings <ben@decadent.org.uk> - 2017-08-18 15:40 +0200

csiph-web