All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH 1/3] stackdepot: check depot_index before accessing the stack slab
@ 2020-02-20 14:19 glider
  2020-02-20 14:19 ` [PATCH 2/3] stackdepot: build with -fno-builtin glider
  2020-02-20 14:19 ` [PATCH 3/3] kasan: stackdepot: move filter_irq_stacks() to stackdepot.c glider
  0 siblings, 2 replies; 10+ messages in thread
From: glider @ 2020-02-20 14:19 UTC (permalink / raw)
  To: dvyukov, andreyknvl, aryabinin, akpm
  Cc: sergey.senozhatsky, arnd, linux-mm, vegard.nossum, elver,
	Alexander Potapenko

Avoid crashes on corrupted stack ids.
Despite stack ID corruption may indicate other bugs in the program, we'd
better fail gracefully on such IDs instead of crashing the kernel.

This patch has been previously mailed as part of KMSAN RFC patch series.

Signed-off-by: Alexander Potapenko <glider@google.com>
To: Alexander Potapenko <glider@google.com>
Cc: Vegard Nossum <vegard.nossum@oracle.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Marco Elver <elver@google.com>
Cc: Andrey Konovalov <andreyknvl@google.com>
Cc: linux-mm@kvack.org
---
 lib/stackdepot.c | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

diff --git a/lib/stackdepot.c b/lib/stackdepot.c
index 81c69c08d1d15..a2f6cb900db80 100644
--- a/lib/stackdepot.c
+++ b/lib/stackdepot.c
@@ -202,9 +202,22 @@ unsigned int stack_depot_fetch(depot_stack_handle_t handle,
 			       unsigned long **entries)
 {
 	union handle_parts parts = { .handle = handle };
-	void *slab = stack_slabs[parts.slabindex];
+	void *slab;
 	size_t offset = parts.offset << STACK_ALLOC_ALIGN;
-	struct stack_record *stack = slab + offset;
+	struct stack_record *stack;
+
+	if (parts.slabindex > depot_index) {
+		WARN(1, "slab index %d out of bounds (%d) for stack id %08x\n",
+			parts.slabindex, depot_index, handle);
+		*entries = NULL;
+		return 0;
+	}
+	slab = stack_slabs[parts.slabindex];
+	stack = slab + offset;
+	if (!stack) {
+		*entries = NULL;
+		return 0;
+	}
 
 	*entries = stack->entries;
 	return stack->size;
-- 
2.25.0.265.gbab2e86ba0-goog



^ permalink raw reply related	[flat|nested] 10+ messages in thread
end of thread, other threads:[~2020-03-07 13:38 UTC | newest]

Thread overview: 10+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2020-02-20 14:19 [PATCH 1/3] stackdepot: check depot_index before accessing the stack slab glider
2020-02-20 14:19 ` [PATCH 2/3] stackdepot: build with -fno-builtin glider
2020-02-20 14:19 ` [PATCH 3/3] kasan: stackdepot: move filter_irq_stacks() to stackdepot.c glider
2020-02-25 20:24   ` kbuild test robot
2020-02-25 20:24     ` kbuild test robot
2020-02-26  9:53     ` Alexander Potapenko
2020-02-26  9:53       ` Alexander Potapenko
2020-02-27  3:16       ` Greentime Hu
2020-03-07 13:37         ` Alexander Potapenko
2020-03-07 13:37           ` Alexander Potapenko

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.