Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 7a3f5134 authored by Helge Deller's avatar Helge Deller Committed by Kyle McMartin
Browse files

parisc: fix kernel crash when unwinding a userspace process 

Any user on existing parisc 32- and 64bit-kernels can easily crash
the kernel and as such enforce a DSO.
A simple testcase is available here:
        http://gsyprf10.external.hp.com/~deller/crash.tgz

The problem is introduced by the fact, that the handle_interruption()
crash handler calls the show_regs() function, which in turn tries to
unwind the stack by calling parisc_show_stack().  Since the stack contains
userspace addresses, a try to unwind the stack is dangerous and useless
and leads to the crash.

The fix is trivial: For userspace processes
a) avoid to unwind the stack, and
b) avoid to resolve userspace addresses to kernel symbol names.

While touching this code, I converted print_symbol() to %pS
printk formats and made parisc_show_stack() static.

An initial patch for this was written by Kyle McMartin back in August:
http://marc.info/?l=linux-parisc&m=121805168830283&w=2



Compile and run-tested with a 64bit parisc kernel.

Signed-off-by: default avatarHelge Deller <deller@gmx.de>
Cc: Grant Grundler <grundler@parisc-linux.org>
Cc: Matthew Wilcox <matthew@wil.cx>
Cc: <stable@kernel.org>		[2.6.25.x, 2.6.26.x, 2.6.27.x, earlier...]
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarKyle McMartin <kyle@mcmartin.ca>
parent 9860d1b0

arch/parisc/kernel/traps.c

+21 −22
Original line number Original line Diff line number Diff line
@@ -24,7 +24,6 @@ 
#include <linux/init.h>

#include <linux/init.h>

#include <linux/interrupt.h>

#include <linux/interrupt.h>

#include <linux/console.h>

#include <linux/console.h>

#include <linux/kallsyms.h>

#include <linux/bug.h>

#include <linux/bug.h>





#include <asm/assembly.h>

#include <asm/assembly.h>
@@ -51,7 +50,7 @@ 
DEFINE_SPINLOCK(pa_dbit_lock);

DEFINE_SPINLOCK(pa_dbit_lock);

#endif

#endif





void parisc_show_stack(struct task_struct *t, unsigned long *sp,

static void parisc_show_stack(struct task_struct *task, unsigned long *sp,

	struct pt_regs *regs);

	struct pt_regs *regs);





static int printbinary(char *buf, unsigned long x, int nbits)

static int printbinary(char *buf, unsigned long x, int nbits)
@@ -121,18 +120,19 @@ static void print_fr(char *level, struct pt_regs *regs) 




void show_regs(struct pt_regs *regs)

void show_regs(struct pt_regs *regs)

{

{

	int i;

	int i, user;

	char *level;

	char *level;

	unsigned long cr30, cr31;

	unsigned long cr30, cr31;





	level = user_mode(regs) ? KERN_DEBUG : KERN_CRIT;

	user = user_mode(regs);

	level = user ? KERN_DEBUG : KERN_CRIT;





	print_gr(level, regs);

	print_gr(level, regs);





	for (i = 0; i < 8; i += 4)

	for (i = 0; i < 8; i += 4)

		PRINTREGS(level, regs->sr, "sr", RFMT, i);

		PRINTREGS(level, regs->sr, "sr", RFMT, i);





	if (user_mode(regs))

	if (user)

		print_fr(level, regs);

		print_fr(level, regs);





	cr30 = mfctl(30);

	cr30 = mfctl(30);
@@ -145,15 +145,19 @@ void show_regs(struct pt_regs *regs) 
	printk("%s CPU: %8d   CR30: " RFMT " CR31: " RFMT "\n",

	printk("%s CPU: %8d   CR30: " RFMT " CR31: " RFMT "\n",

	       level, current_thread_info()->cpu, cr30, cr31);

	       level, current_thread_info()->cpu, cr30, cr31);

	printk("%s ORIG_R28: " RFMT "\n", level, regs->orig_r28);

	printk("%s ORIG_R28: " RFMT "\n", level, regs->orig_r28);

	printk(level);



	print_symbol(" IAOQ[0]: %s\n", regs->iaoq[0]);

	if (user) {

	printk(level);

		printk("%s IAOQ[0]: " RFMT "\n", level, regs->iaoq[0]);

	print_symbol(" IAOQ[1]: %s\n", regs->iaoq[1]);

		printk("%s IAOQ[1]: " RFMT "\n", level, regs->iaoq[1]);

	printk(level);

		printk("%s RP(r2): " RFMT "\n", level, regs->gr[2]);

	print_symbol(" RP(r2): %s\n", regs->gr[2]);

	} else {

		printk("%s IAOQ[0]: %pS\n", level, (void *) regs->iaoq[0]);

		printk("%s IAOQ[1]: %pS\n", level, (void *) regs->iaoq[1]);

		printk("%s RP(r2): %pS\n", level, (void *) regs->gr[2]);





		parisc_show_stack(current, NULL, regs);

		parisc_show_stack(current, NULL, regs);

	}

	}

}









void dump_stack(void)

void dump_stack(void)
@@ -173,20 +177,15 @@ static void do_show_stack(struct unwind_frame_info *info) 
			break;

			break;





		if (__kernel_text_address(info->ip)) {

		if (__kernel_text_address(info->ip)) {

			printk("%s [<" RFMT ">] ", (i&0x3)==1 ? KERN_CRIT : "", info->ip);

			printk(KERN_CRIT " [<" RFMT ">] %pS\n",

#ifdef CONFIG_KALLSYMS

				info->ip, (void *) info->ip);

			print_symbol("%s\n", info->ip);

#else

			if ((i & 0x03) == 0)

				printk("\n");

#endif

			i++;

			i++;

		}

		}

	}

	}

	printk("\n");

	printk(KERN_CRIT "\n");

}

}





void parisc_show_stack(struct task_struct *task, unsigned long *sp,

static void parisc_show_stack(struct task_struct *task, unsigned long *sp,

	struct pt_regs *regs)

	struct pt_regs *regs)

{

{

	struct unwind_frame_info info;

	struct unwind_frame_info info;