From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D435A353379; Tue, 26 Aug 2025 14:37:53 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1756219073; cv=none; b=t097UcT/HhiFMY2HtXI6P5m8z0Y7kU3hrN6JXRjBlp0C56sC0fTZ3i+L/DEMamoonQVCer1cvRvD9Qj+mh9Ie99i5TImVSfmsKg/8jNCOr3f/iHAjcklBePeaqUJ9tU8M4L//Fw4RoZQyeFAnhgAxdihKErkvSLIDYcAFr4jz7Q= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1756219073; c=relaxed/simple; bh=UWkJiUUqtk1hRGVOpkvofqNmOGsAGT0U/z8t5WQGZXk=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=n9NssteaduJfLmhKWZDk8F/+s1j77dvhruqfCdjoFuinV8r/f8lX/OE2FVanMxaWnmyPLKaHOPzWVxPzSK8FHGq4yWciyxbRYB4X5DSLCjnIaL4i6mG5iVULGvI6PNfTaVjREHtrvqnZyJqKynnM8KWS3mlpDhsaByVoBtYUfeo= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=isacDJ6Z; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="isacDJ6Z" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 1D3E3C4CEF1; Tue, 26 Aug 2025 14:37:52 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1756219073; bh=UWkJiUUqtk1hRGVOpkvofqNmOGsAGT0U/z8t5WQGZXk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=isacDJ6Z2EpjdrW/fPLE0qtkqBXfHWPBLq344E35+nJgBITHqJBB0uYERxtKxGklT d8pf8i+LTgDT3V0SxtiHCd2LcT0DtaSb8EhWvSLg/ofFyjWVO8C9CuOr2H7uQRv6GS RkeflSUotDIppuBQbACYz3PPOSQ61ib7cB6zxUW0= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, =?UTF-8?q?Thomas=20Wei=C3=9Fschuh?= , David Gow , Huacai Chen , Thomas Bogendoerfer , Sasha Levin Subject: [PATCH 5.4 242/403] MIPS: Dont crash in stack_top() for tasks without ABI or vDSO Date: Tue, 26 Aug 2025 13:09:28 +0200 Message-ID: <20250826110913.512854862@linuxfoundation.org> X-Mailer: git-send-email 2.50.1 In-Reply-To: <20250826110905.607690791@linuxfoundation.org> References: <20250826110905.607690791@linuxfoundation.org> User-Agent: quilt/0.68 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 5.4-stable review patch. If anyone has any objections, please let me know. ------------------ From: Thomas Weißschuh [ Upstream commit e9f4a6b3421e936c3ee9d74710243897d74dbaa2 ] Not all tasks have an ABI associated or vDSO mapped, for example kthreads never do. If such a task ever ends up calling stack_top(), it will derefence the NULL ABI pointer and crash. This can for example happen when using kunit: mips_stack_top+0x28/0xc0 arch_pick_mmap_layout+0x190/0x220 kunit_vm_mmap_init+0xf8/0x138 __kunit_add_resource+0x40/0xa8 kunit_vm_mmap+0x88/0xd8 usercopy_test_init+0xb8/0x240 kunit_try_run_case+0x5c/0x1a8 kunit_generic_run_threadfn_adapter+0x28/0x50 kthread+0x118/0x240 ret_from_kernel_thread+0x14/0x1c Only dereference the ABI point if it is set. The GIC page is also included as it is specific to the vDSO. Also move the randomization adjustment into the same conditional. Signed-off-by: Thomas Weißschuh Reviewed-by: David Gow Reviewed-by: Huacai Chen Signed-off-by: Thomas Bogendoerfer Signed-off-by: Sasha Levin --- arch/mips/kernel/process.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/arch/mips/kernel/process.c b/arch/mips/kernel/process.c index 339870ed92f7..42e95e6edd1d 100644 --- a/arch/mips/kernel/process.c +++ b/arch/mips/kernel/process.c @@ -654,18 +654,20 @@ unsigned long mips_stack_top(void) top -= PAGE_SIZE; /* Space for the VDSO, data page & GIC user page */ - top -= PAGE_ALIGN(current->thread.abi->vdso->size); - top -= PAGE_SIZE; - top -= mips_gic_present() ? PAGE_SIZE : 0; + if (current->thread.abi) { + top -= PAGE_ALIGN(current->thread.abi->vdso->size); + top -= PAGE_SIZE; + top -= mips_gic_present() ? PAGE_SIZE : 0; + + /* Space to randomize the VDSO base */ + if (current->flags & PF_RANDOMIZE) + top -= VDSO_RANDOMIZE_SIZE; + } /* Space for cache colour alignment */ if (cpu_has_dc_aliases) top -= shm_align_mask + 1; - /* Space to randomize the VDSO base */ - if (current->flags & PF_RANDOMIZE) - top -= VDSO_RANDOMIZE_SIZE; - return top; } -- 2.39.5