Re: [PATCH] arch/x86: fix out-of-bounds in get_wchan()

From	Borislav Petkov <bp@alien8.de>
Newsgroups	linux.kernel
Subject	Re: [PATCH] arch/x86: fix out-of-bounds in get_wchan()
Date	2015-09-28 12:30 +0200
Message-ID	<qdDR0-2VP-15@gated-at.bofh.it> (permalink)
References	<qdCBz-1h1-9@gated-at.bofh.it> <qdD4C-1Mi-23@gated-at.bofh.it> <qdDei-1XB-29@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

On Mon, Sep 28, 2015 at 11:49:18AM +0200, Dmitry Vyukov wrote:
> Original code did:
> 
>      if (p->thread.sp < stack || p->thread.sp >= stack+THREAD_SIZE)
>            return 0;
>      fp = *(u64 *)(p->thread.sp);
> 
> p->thread.sp can change concurrently.
> So we could check that p->thread.sp is within stack bounds, but then
> dereference another value (which is already outside of bounds).

Right, we do deref it. I realized that after hitting "Send" :\

Which begs another, probably also stupid, question:

What guarantees the task won't disappear after we've checked p?

I.e., after this:

        if (!p || p == current || p->state == TASK_RUNNING)
                return 0;

Thanks.

-- 
Regards/Gruss,
    Boris.

ECO tip #101: Trim your mails when you reply.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Thread

[PATCH] arch/x86: fix out-of-bounds in get_wchan() Dmitry Vyukov <dvyukov@google.com> - 2015-09-28 11:10 +0200
  Re: [PATCH] arch/x86: fix out-of-bounds in get_wchan() Borislav Petkov <bp@alien8.de> - 2015-09-28 11:40 +0200
    Re: [PATCH] arch/x86: fix out-of-bounds in get_wchan() Dmitry Vyukov <dvyukov@google.com> - 2015-09-28 11:50 +0200
      Re: [PATCH] arch/x86: fix out-of-bounds in get_wchan() Borislav Petkov <bp@alien8.de> - 2015-09-28 12:30 +0200
        Re: [PATCH] arch/x86: fix out-of-bounds in get_wchan() Dmitry Vyukov <dvyukov@google.com> - 2015-09-28 12:40 +0200
          Re: [PATCH] arch/x86: fix out-of-bounds in get_wchan() Borislav Petkov <bp@alien8.de> - 2015-09-28 13:00 +0200
    Re: [PATCH] arch/x86: fix out-of-bounds in get_wchan() Dmitry Vyukov <dvyukov@google.com> - 2015-09-28 12:00 +0200
      Re: [PATCH] arch/x86: fix out-of-bounds in get_wchan() Borislav Petkov <bp@alien8.de> - 2015-09-28 12:40 +0200
  Re: [PATCH] arch/x86: fix out-of-bounds in get_wchan() Andrey Ryabinin <ryabinin.a.a@gmail.com> - 2015-09-28 17:50 +0200
    Re: [PATCH] arch/x86: fix out-of-bounds in get_wchan() Dmitry Vyukov <dvyukov@google.com> - 2015-09-28 18:10 +0200
      Re: [PATCH] arch/x86: fix out-of-bounds in get_wchan() Thomas Gleixner <tglx@linutronix.de> - 2015-09-28 18:40 +0200
        Re: [PATCH] arch/x86: fix out-of-bounds in get_wchan() Andy Lutomirski <luto@amacapital.net> - 2015-09-29 20:20 +0200
          Re: [PATCH] arch/x86: fix out-of-bounds in get_wchan() Andy Lutomirski <luto@amacapital.net> - 2015-09-29 20:40 +0200
            Re: [PATCH] arch/x86: fix out-of-bounds in get_wchan() Borislav Petkov <bp@alien8.de> - 2015-09-29 20:50 +0200
          [PATCH] fs/proc: Don't expose absolute kernel addresses via wchan Ingo Molnar <mingo@kernel.org> - 2015-09-30 09:20 +0200
            Re: [PATCH] fs/proc: Don't expose absolute kernel addresses via  wchan Thomas Gleixner <tglx@linutronix.de> - 2015-09-30 09:40 +0200
              [PATCH v2] fs/proc: Don't expose absolute kernel addresses via wchan Ingo Molnar <mingo@kernel.org> - 2015-09-30 16:00 +0200
                Re: [PATCH v2] fs/proc: Don't expose absolute kernel addresses via  wchan Thomas Gleixner <tglx@linutronix.de> - 2015-09-30 22:40 +0200
                Re: [PATCH v2] fs/proc: Don't expose absolute kernel addresses via wchan Kees Cook <keescook@chromium.org> - 2015-09-30 23:30 +0200
                Re: [PATCH v2] fs/proc: Don't expose absolute kernel addresses via  wchan Thomas Gleixner <tglx@linutronix.de> - 2015-09-30 23:40 +0200
                [PATCH v3] fs/proc, core/debug: Don't expose absolute kernel  addresses via wchan Ingo Molnar <mingo@kernel.org> - 2015-10-01 10:00 +0200
                Re: [PATCH v3] fs/proc, core/debug: Don't expose absolute kernel  addresses via wchan Andrey Ryabinin <ryabinin.a.a@gmail.com> - 2015-10-01 11:00 +0200
                Re: [PATCH v3] fs/proc, core/debug: Don't expose absolute kernel  addresses via wchan Ingo Molnar <mingo@kernel.org> - 2015-10-01 11:30 +0200
                Re: [PATCH v3] fs/proc, core/debug: Don't expose absolute kernel  addresses via wchan Andrey Ryabinin <ryabinin.a.a@gmail.com> - 2015-10-01 12:20 +0200
                Re: [PATCH v3] fs/proc, core/debug: Don't expose absolute kernel  addresses via wchan Ingo Molnar <mingo@kernel.org> - 2015-10-01 12:40 +0200
                Re: [PATCH v3] fs/proc, core/debug: Don't expose absolute kernel  addresses via wchan Andrey Ryabinin <ryabinin.a.a@gmail.com> - 2015-10-01 12:50 +0200
                [PATCH v5] fs/proc, core/debug: Don't expose absolute kernel  addresses via wchan Ingo Molnar <mingo@kernel.org> - 2015-10-01 13:00 +0200
                [PATCH v4] fs/proc, core/debug: Don't expose absolute kernel  addresses via wchan Ingo Molnar <mingo@kernel.org> - 2015-10-01 11:40 +0200
                [tip:core/debug] fs/proc, core/debug: Don'  t expose absolute kernel addresses via wchan tip-bot for Ingo Molnar <tipbot@zytor.com> - 2015-10-01 15:00 +0200
          Re: [PATCH] arch/x86: fix out-of-bounds in get_wchan() Thomas Gleixner <tglx@linutronix.de> - 2015-09-30 10:10 +0200

csiph-web