All of lore.kernel.org
 help / color / mirror / Atom feed
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	stable@vger.kernel.org, Helge Deller <deller@gmx.de>,
	John David Anglin <dave.anglin@bell.net>
Subject: [ 07/11] parisc: fix interruption handler to respect pagefault_disable()
Date: Fri, 18 Oct 2013 12:53:36 -0700	[thread overview]
Message-ID: <20131018195049.569779370@linuxfoundation.org> (raw)
In-Reply-To: <20131018195049.069623827@linuxfoundation.org>

3.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Helge Deller <deller@gmx.de>

commit 59b33f148cc08fb33cbe823fca1e34f7f023765e upstream.

Running an "echo t > /proc/sysrq-trigger" crashes the parisc kernel.  The
problem is, that in print_worker_info() we try to read the workqueue info via
the probe_kernel_read() functions which use pagefault_disable() to avoid
crashes like this:
    probe_kernel_read(&pwq, &worker->current_pwq, sizeof(pwq));
    probe_kernel_read(&wq, &pwq->wq, sizeof(wq));
    probe_kernel_read(name, wq->name, sizeof(name) - 1);

The problem here is, that the first probe_kernel_read(&pwq) might return zero
in pwq and as such the following probe_kernel_reads() try to access contents of
the page zero which is read protected and generate a kernel segfault.

With this patch we fix the interruption handler to call parisc_terminate()
directly only if pagefault_disable() was not called (in which case
preempt_count()==0).  Otherwise we hand over to the pagefault handler which
will try to look up the faulting address in the fixup tables.

Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: John David Anglin  <dave.anglin@bell.net>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/parisc/kernel/traps.c |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

--- a/arch/parisc/kernel/traps.c
+++ b/arch/parisc/kernel/traps.c
@@ -810,14 +810,14 @@ void notrace handle_interruption(int cod
 	else {
 
 	    /*
-	     * The kernel should never fault on its own address space.
+	     * The kernel should never fault on its own address space,
+	     * unless pagefault_disable() was called before.
 	     */
 
-	    if (fault_space == 0) 
+	    if (fault_space == 0 && !in_atomic())
 	    {
 		pdc_chassis_send_status(PDC_CHASSIS_DIRECT_PANIC);
 		parisc_terminate("Kernel Fault", regs, code, fault_address);
-	
 	    }
 	}
 



  parent reply	other threads:[~2013-10-18 19:53 UTC|newest]

Thread overview: 17+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2013-10-18 19:53 [ 00/11] 3.4.67-stable review Greg Kroah-Hartman
2013-10-18 19:53 ` [ 01/11] ALSA: snd-usb-usx2y: remove bogus frame checks Greg Kroah-Hartman
2013-10-18 19:53 ` [ 02/11] ALSA: hda - Add fixup for ASUS N56VZ Greg Kroah-Hartman
2013-10-18 19:53 ` [ 03/11] random: run random_int_secret_init() run after all late_initcalls Greg Kroah-Hartman
2013-10-18 19:53 ` [ 04/11] vfs: allow O_PATH file descriptors for fstatfs() Greg Kroah-Hartman
2013-10-18 19:53 ` [ 05/11] ext4: fix memory leak in xattr Greg Kroah-Hartman
2013-10-21 16:37   ` Dave Jones
2013-10-18 19:53 ` [ 06/11] KVM: PPC: Book3S HV: Fix typo in saving DSCR Greg Kroah-Hartman
2013-10-18 19:53 ` Greg Kroah-Hartman [this message]
2013-10-18 19:53 ` [ 08/11] watchdog: ts72xx_wdt: locking bug in ioctl Greg Kroah-Hartman
2013-10-18 19:53 ` [ 09/11] drm/radeon: fix hw contexts for SUMO2 asics Greg Kroah-Hartman
2013-10-18 19:53 ` [ 10/11] mm/mmap: check for RLIMIT_AS before unmapping Greg Kroah-Hartman
2013-10-18 19:53 ` [ 11/11] mm: do not grow the stack vma just because of an overrun on preceding vma Greg Kroah-Hartman
2013-10-18 20:49 ` [ 00/11] 3.4.67-stable review Guenter Roeck
2013-10-18 21:25   ` Greg Kroah-Hartman
2013-10-19  3:41 ` Shuah Khan
2013-10-19  4:49   ` Greg Kroah-Hartman

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20131018195049.569779370@linuxfoundation.org \
    --to=gregkh@linuxfoundation.org \
    --cc=dave.anglin@bell.net \
    --cc=deller@gmx.de \
    --cc=linux-kernel@vger.kernel.org \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.