* [PATCH] s390/syscalls: Fix out of bounds arguments access
@ 2017-06-29 9:38 Jiri Olsa
0 siblings, 0 replies; 2+ messages in thread
From: Jiri Olsa @ 2017-06-29 9:38 UTC (permalink / raw)
To: linux-s390
Zorro reported following crash while having enabled
syscall tracing (CONFIG_FTRACE_SYSCALLS):
Unable to handle kernel pointer dereference at virtual ...
Oops: 0011 [#1] SMP DEBUG_PAGEALLOC
SNIP
Call Trace:
([<000000000024d79c>] ftrace_syscall_enter+0xec/0x1d8)
[<00000000001099c6>] do_syscall_trace_enter+0x236/0x2f8
[<0000000000730f1c>] sysc_tracesys+0x1a/0x32
[<000003fffcf946a2>] 0x3fffcf946a2
INFO: lockdep is turned off.
Last Breaking-Event-Address:
[<000000000022dd44>] rb_event_data+0x34/0x40
---[ end trace 8c795f86b1b3f7b9 ]---
The crash happens in syscall_get_arguments function for
syscalls with zero arguments, that will try to access
first argument (args[0]) in event entry, but it's not
allocated.
Bail out of there are no arguments.
Reported-by: Zorro Lang <zlang@redhat.com>
Signed-off-by: Jiri Olsa <jolsa@kernel.org>
---
arch/s390/include/asm/syscall.h | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
diff --git a/arch/s390/include/asm/syscall.h b/arch/s390/include/asm/syscall.h
index 6ba0bf928909..5f7c11c932fa 100644
--- a/arch/s390/include/asm/syscall.h
+++ b/arch/s390/include/asm/syscall.h
@@ -64,14 +64,22 @@ static inline void syscall_get_arguments(struct task_struct *task,
{
unsigned long mask = -1UL;
+ /*
+ * No arguments for this syscall, there's nothing to do.
+ */
+ if (!n)
+ return;
+
BUG_ON(i + n > 6);
#ifdef CONFIG_COMPAT
if (test_tsk_thread_flag(task, TIF_31BIT))
mask = 0xffffffff;
#endif
- while (n-- > 0)
+ while (n-- > 0) {
if (i + n > 0)
args[n] = regs->gprs[2 + i + n] & mask;
+ }
+
if (i == 0)
args[0] = regs->orig_gpr2 & mask;
}
--
2.9.4
^ permalink raw reply related [flat|nested] 2+ messages in thread
[parent not found: <20170703152022.GB16010@krava>]
* Re: [PATCH] s390/syscalls: Fix out of bounds arguments access
[not found] <20170703152022.GB16010@krava>
@ 2017-07-04 5:05 ` Martin Schwidefsky
0 siblings, 0 replies; 2+ messages in thread
From: Martin Schwidefsky @ 2017-07-04 5:05 UTC (permalink / raw)
To: linux-s390
On Mon, 3 Jul 2017 17:20:22 +0200
Jiri Olsa <jolsa@redhat.com> wrote:
> On Mon, Jul 03, 2017 at 04:29:37PM +0200, Martin Schwidefsky wrote:
>
> SNIP
>
> > > ---
> > > arch/s390/include/asm/syscall.h | 10 +++++++++-
> > > 1 file changed, 9 insertions(+), 1 deletion(-)
> >
> > There are callers of syscall_get_arguments with n=0. And it makes
> > sense to check for this case in the function instead of forcing all
> > callers to check for it.
> >
> > > diff --git a/arch/s390/include/asm/syscall.h b/arch/s390/include/asm/syscall.h
> > > index 6ba0bf928909..5f7c11c932fa 100644
> > > --- a/arch/s390/include/asm/syscall.h
> > > +++ b/arch/s390/include/asm/syscall.h
> > > @@ -64,14 +64,22 @@ static inline void syscall_get_arguments(struct task_struct *task,
> > > {
> > > unsigned long mask = -1UL;
> > >
> > > + /*
> > > + * No arguments for this syscall, there's nothing to do.
> > > + */
> > > + if (!n)
> > > + return;
> > > +
> > > BUG_ON(i + n > 6);
> >
> > So yes, for this part of the patch.
> >
> > > #ifdef CONFIG_COMPAT
> > > if (test_tsk_thread_flag(task, TIF_31BIT))
> > > mask = 0xffffffff;
> > > #endif
> > > - while (n-- > 0)
> > > + while (n-- > 0) {
> > > if (i + n > 0)
> > > args[n] = regs->gprs[2 + i + n] & mask;
> > > + }
> > > +
> > > if (i == 0)
> > > args[0] = regs->orig_gpr2 & mask;
> > > }
> >
> > But why the unrelated whitespace damage with the additional { } ?
>
> I always get shouted at when I'm not using { } in conditions/loops
> having more than 1 line.. so I tend to add them when I see this
> breakage ;-)
I agree that there should have been { } with the initial patch.
It is just that the cleanup is unrelated to the true bug fix
> feel free to imot that or let me know and I'll send v2
I will strip that part and add a Cc: stable. Thanks.
--
blue skies,
Martin.
"Reality continues to ruin my life." - Calvin.
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2017-07-04 5:05 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2017-06-29 9:38 [PATCH] s390/syscalls: Fix out of bounds arguments access Jiri Olsa
[not found] <20170703152022.GB16010@krava>
2017-07-04 5:05 ` Martin Schwidefsky
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.