diff options
author | Helge Deller <deller@gmx.de> | 2008-11-26 20:46:22 (GMT) |
---|---|---|
committer | Kyle McMartin <kyle@hera.kernel.org> | 2008-11-26 22:22:39 (GMT) |
commit | 7a3f5134a8f5bd7fa38b5645eef05e8a4eb62951 (patch) | |
tree | 565fb518a0eb19f0514e77ff0124be3642f281f2 /arch/parisc/kernel/traps.c | |
parent | 9860d1b08b082ffb54c4b7827c48c2728e12ba21 (diff) | |
download | linux-7a3f5134a8f5bd7fa38b5645eef05e8a4eb62951.tar.xz |
parisc: fix kernel crash when unwinding a userspace process
Any user on existing parisc 32- and 64bit-kernels can easily crash
the kernel and as such enforce a DSO.
A simple testcase is available here:
http://gsyprf10.external.hp.com/~deller/crash.tgz
The problem is introduced by the fact, that the handle_interruption()
crash handler calls the show_regs() function, which in turn tries to
unwind the stack by calling parisc_show_stack(). Since the stack contains
userspace addresses, a try to unwind the stack is dangerous and useless
and leads to the crash.
The fix is trivial: For userspace processes
a) avoid to unwind the stack, and
b) avoid to resolve userspace addresses to kernel symbol names.
While touching this code, I converted print_symbol() to %pS
printk formats and made parisc_show_stack() static.
An initial patch for this was written by Kyle McMartin back in August:
http://marc.info/?l=linux-parisc&m=121805168830283&w=2
Compile and run-tested with a 64bit parisc kernel.
Signed-off-by: Helge Deller <deller@gmx.de>
Cc: Grant Grundler <grundler@parisc-linux.org>
Cc: Matthew Wilcox <matthew@wil.cx>
Cc: <stable@kernel.org> [2.6.25.x, 2.6.26.x, 2.6.27.x, earlier...]
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Kyle McMartin <kyle@mcmartin.ca>
Diffstat (limited to 'arch/parisc/kernel/traps.c')
-rw-r--r-- | arch/parisc/kernel/traps.c | 43 |
1 files changed, 21 insertions, 22 deletions
diff --git a/arch/parisc/kernel/traps.c b/arch/parisc/kernel/traps.c index 675f1d0..4c771cd 100644 --- a/arch/parisc/kernel/traps.c +++ b/arch/parisc/kernel/traps.c @@ -24,7 +24,6 @@ #include <linux/init.h> #include <linux/interrupt.h> #include <linux/console.h> -#include <linux/kallsyms.h> #include <linux/bug.h> #include <asm/assembly.h> @@ -51,7 +50,7 @@ DEFINE_SPINLOCK(pa_dbit_lock); #endif -void parisc_show_stack(struct task_struct *t, unsigned long *sp, +static void parisc_show_stack(struct task_struct *task, unsigned long *sp, struct pt_regs *regs); static int printbinary(char *buf, unsigned long x, int nbits) @@ -121,18 +120,19 @@ static void print_fr(char *level, struct pt_regs *regs) void show_regs(struct pt_regs *regs) { - int i; + int i, user; char *level; unsigned long cr30, cr31; - level = user_mode(regs) ? KERN_DEBUG : KERN_CRIT; + user = user_mode(regs); + level = user ? KERN_DEBUG : KERN_CRIT; print_gr(level, regs); for (i = 0; i < 8; i += 4) PRINTREGS(level, regs->sr, "sr", RFMT, i); - if (user_mode(regs)) + if (user) print_fr(level, regs); cr30 = mfctl(30); @@ -145,14 +145,18 @@ void show_regs(struct pt_regs *regs) printk("%s CPU: %8d CR30: " RFMT " CR31: " RFMT "\n", level, current_thread_info()->cpu, cr30, cr31); printk("%s ORIG_R28: " RFMT "\n", level, regs->orig_r28); - printk(level); - print_symbol(" IAOQ[0]: %s\n", regs->iaoq[0]); - printk(level); - print_symbol(" IAOQ[1]: %s\n", regs->iaoq[1]); - printk(level); - print_symbol(" RP(r2): %s\n", regs->gr[2]); - - parisc_show_stack(current, NULL, regs); + + if (user) { + printk("%s IAOQ[0]: " RFMT "\n", level, regs->iaoq[0]); + printk("%s IAOQ[1]: " RFMT "\n", level, regs->iaoq[1]); + printk("%s RP(r2): " RFMT "\n", level, regs->gr[2]); + } else { + printk("%s IAOQ[0]: %pS\n", level, (void *) regs->iaoq[0]); + printk("%s IAOQ[1]: %pS\n", level, (void *) regs->iaoq[1]); + printk("%s RP(r2): %pS\n", level, (void *) regs->gr[2]); + + parisc_show_stack(current, NULL, regs); + } } @@ -173,20 +177,15 @@ static void do_show_stack(struct unwind_frame_info *info) break; if (__kernel_text_address(info->ip)) { - printk("%s [<" RFMT ">] ", (i&0x3)==1 ? KERN_CRIT : "", info->ip); -#ifdef CONFIG_KALLSYMS - print_symbol("%s\n", info->ip); -#else - if ((i & 0x03) == 0) - printk("\n"); -#endif + printk(KERN_CRIT " [<" RFMT ">] %pS\n", + info->ip, (void *) info->ip); i++; } } - printk("\n"); + printk(KERN_CRIT "\n"); } -void parisc_show_stack(struct task_struct *task, unsigned long *sp, +static void parisc_show_stack(struct task_struct *task, unsigned long *sp, struct pt_regs *regs) { struct unwind_frame_info info; |