From: Akinobu Mita <akinobu.mita@gmail.com>
To: linux-kernel@vger.kernel.org
Cc: Thomas Gleixner <tglx@linutronix.de>,
Ingo Molnar <mingo@redhat.com>, "H. Peter Anvin" <hpa@zytor.com>
Subject: [PATCH 0/4] x86: fix free_thread_info() with uninitalized thread_info
Date: Sat, 27 Dec 2008 14:16:08 +0900 [thread overview]
Message-ID: <20081227051606.GA3295@localhost.localdomain> (raw)
This patch series fixes a problem described below. The actual fix is only
made by the patch 3/4. The rest of patches help it make simple and there
is no actual behavioral change.
x86 arch specific free_thread_info() accesses thread_info->task to call
free_thread_xstate(). But the thread_info may not be initialized yet.
So invalid pointer derefence may happen in free_thread_xstate().
It happens in the following scenario in dup_task_struct()
1. call alloc_task_struct() to allocate empty task_struct
2. call alloc_thread_info() to allocate empty thread_info
3. call arch_dup_task_struct()
x86 arch specific arch_dup_task_struct() copies task_struct from source
task_struct. it also allocates empty xstate and copy from source if
source task_struct has ->thread.xstate.
If the xstate allocation failed, arch_dup_task_struct() returns error.
4. call free_thread_info() to deallocate thread_info
x86 arch specific free_thread_info() calls free_thread_xstate() with
thread_info->task. But the thread_info is not initialized yet.
next reply other threads:[~2008-12-27 5:16 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2008-12-27 5:16 Akinobu Mita [this message]
2008-12-27 5:17 ` [PATCH 1/4] convert task_struct allocator macros to inline functions Akinobu Mita
2008-12-27 5:18 ` [PATCH 2/4] x86: arch specific task_struct allocator Akinobu Mita
2008-12-27 5:19 ` [PATCH 3/4] x86: call free_thread_xstate() in free_task_struct() Akinobu Mita
2008-12-27 5:19 ` [PATCH 4/4] x86: use generic thread_info allocator Akinobu Mita
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20081227051606.GA3295@localhost.localdomain \
--to=akinobu.mita@gmail.com \
--cc=hpa@zytor.com \
--cc=linux-kernel@vger.kernel.org \
--cc=mingo@redhat.com \
--cc=tglx@linutronix.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.