• Josh Poimboeuf's avatar
    x86/dumpstack: Fix x86_32 kernel_stack_pointer() previous stack access · 63f9190b
    Josh Poimboeuf authored
    commit 72b4f6a5 upstream.
    
    On x86_32, when an interrupt happens from kernel space, SS and SP aren't
    pushed and the existing stack is used.  So pt_regs is effectively two
    words shorter, and the previous stack pointer is normally the memory
    after the shortened pt_regs, aka '&regs->sp'.
    
    But in the rare case where the interrupt hits right after the stack
    pointer has been changed to point to an empty stack, like for example
    when call_on_stack() is used, the address immediately after the
    shortened pt_regs is no longer on the stack.  In that case, instead of
    '&regs->sp', the previous stack pointer should be retrieved from the
    beginning of the current stack page.
    
    kernel_stack_pointer() wants to do that, but it forgets to dereference
    the pointer.  So instead of returning a pointer to the previous stack,
    it returns a pointer to the beginning of the current stack.
    
    Note that it's probably outside of kernel_stack_pointer()'s scope to be
    switching stacks at all.  The x86_64 version of this function doesn't do
    it, and it would be better for the caller to do it if necessary.  But
    that's a patch for another day.  This just fixes the original intent.
    Signed-off-by: default avatarJosh Poimboeuf <jpoimboe@redhat.com>
    Cc: Andy Lutomirski <luto@amacapital.net>
    Cc: Andy Lutomirski <luto@kernel.org>
    Cc: Borislav Petkov <bp@alien8.de>
    Cc: Brian Gerst <brgerst@gmail.com>
    Cc: Byungchul Park <byungchul.park@lge.com>
    Cc: Denys Vlasenko <dvlasenk@redhat.com>
    Cc: Frederic Weisbecker <fweisbec@gmail.com>
    Cc: H. Peter Anvin <hpa@zytor.com>
    Cc: Kees Cook <keescook@chromium.org>
    Cc: Linus Torvalds <torvalds@linux-foundation.org>
    Cc: Nilay Vaish <nilayvaish@gmail.com>
    Cc: Peter Zijlstra <peterz@infradead.org>
    Cc: Steven Rostedt <rostedt@goodmis.org>
    Cc: Thomas Gleixner <tglx@linutronix.de>
    Fixes: 0788aa6a ("x86: Prepare removal of previous_esp from i386 thread_info structure")
    Link: http://lkml.kernel.org/r/472453d6e9f6a2d4ab16aaed4935f43117111566.1471535549.git.jpoimboe@redhat.comSigned-off-by: default avatarIngo Molnar <mingo@kernel.org>
    Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
    63f9190b
ptrace.c 36 KB