From: tip-bot for Ashish Kalra <tipbot@zytor.com>
To: linux-tip-commits@vger.kernel.org
Cc: ashish@bluestacks.com, stable@vger.kernel.org,
peterz@infradead.org, jpoimboe@redhat.com,
linux-kernel@vger.kernel.org, brgerst@gmail.com,
tglx@linutronix.de, bp@alien8.de, luto@kernel.org, hpa@zytor.com,
dvlasenk@redhat.com, mingo@kernel.org,
torvalds@linux-foundation.org
Subject: [tip:x86/boot] x86/boot: Fix BSS corruption/overwrite bug in early x86 kernel startup
Date: Thu, 20 Apr 2017 04:16:18 -0700 [thread overview]
Message-ID: <tip-d594aa0277e541bb997aef0bc0a55172d8138340@git.kernel.org> (raw)
In-Reply-To: <20170419152015.10011-1-ashishkalra@Ashishs-MacBook-Pro.local>
Commit-ID: d594aa0277e541bb997aef0bc0a55172d8138340
Gitweb: http://git.kernel.org/tip/d594aa0277e541bb997aef0bc0a55172d8138340
Author: Ashish Kalra <ashish@bluestacks.com>
AuthorDate: Wed, 19 Apr 2017 20:50:15 +0530
Committer: Ingo Molnar <mingo@kernel.org>
CommitDate: Thu, 20 Apr 2017 10:05:23 +0200
x86/boot: Fix BSS corruption/overwrite bug in early x86 kernel startup
The minimum size for a new stack (512 bytes) setup for arch/x86/boot components
when the bootloader does not setup/provide a stack for the early boot components
is not "enough".
The setup code executing as part of early kernel startup code, uses the stack
beyond 512 bytes and accidentally overwrites and corrupts part of the BSS
section. This is exposed mostly in the early video setup code, where
it was corrupting BSS variables like force_x, force_y, which in-turn affected
kernel parameters such as screen_info (screen_info.orig_video_cols) and
later caused an exception/panic in console_init().
Most recent boot loaders setup the stack for early boot components, so this
stack overwriting into BSS section issue has not been exposed.
Signed-off-by: Ashish Kalra <ashish@bluestacks.com>
Cc: <stable@vger.kernel.org>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Brian Gerst <brgerst@gmail.com>
Cc: Denys Vlasenko <dvlasenk@redhat.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Josh Poimboeuf <jpoimboe@redhat.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Link: http://lkml.kernel.org/r/20170419152015.10011-1-ashishkalra@Ashishs-MacBook-Pro.local
Signed-off-by: Ingo Molnar <mingo@kernel.org>
---
arch/x86/boot/boot.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/x86/boot/boot.h b/arch/x86/boot/boot.h
index 9b42b6d..ef5a9cc 100644
--- a/arch/x86/boot/boot.h
+++ b/arch/x86/boot/boot.h
@@ -16,7 +16,7 @@
#ifndef BOOT_BOOT_H
#define BOOT_BOOT_H
-#define STACK_SIZE 512 /* Minimum number of bytes for stack */
+#define STACK_SIZE 1024 /* Minimum number of bytes for stack */
#ifndef __ASSEMBLY__
prev parent reply other threads:[~2017-04-20 11:23 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-04-19 15:20 [PATCH] Fix BSS corruption/overwrite issue in early x86 kernel startup Ashish Kalra
2017-04-20 11:16 ` tip-bot for Ashish Kalra [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=tip-d594aa0277e541bb997aef0bc0a55172d8138340@git.kernel.org \
--to=tipbot@zytor.com \
--cc=ashish@bluestacks.com \
--cc=bp@alien8.de \
--cc=brgerst@gmail.com \
--cc=dvlasenk@redhat.com \
--cc=hpa@zytor.com \
--cc=jpoimboe@redhat.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-tip-commits@vger.kernel.org \
--cc=luto@kernel.org \
--cc=mingo@kernel.org \
--cc=peterz@infradead.org \
--cc=stable@vger.kernel.org \
--cc=tglx@linutronix.de \
--cc=torvalds@linux-foundation.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).