From: Martin Schwidefsky <schwidefsky@de.ibm.com>
To: akpm@osdl.org, peter.oberparleiter@de.ibm.com,
linux-kernel@vger.kernel.org
Subject: [patch] s390: kernel stack corruption.
Date: Thu, 15 Sep 2005 16:53:03 +0200 [thread overview]
Message-ID: <20050915145303.GA5959@skybase.boeblingen.de.ibm.com> (raw)
Hi Andrew,
Peter discoverd another rather critical bug in entry.S.
This should go into 2.6.14 if possible.
blue skies,
Martin.
---
[patch] s390: kernel stack corruption.
From: Peter Oberparleiter <peter.oberparleiter@de.ibm.com>
When an asynchronous interruption occurs during the execution
of the 'critical section' within the generic interruption
handling code (entry.S), a faulty check for a userspace PSW may
result in a corrupted kernel stack pointer which subsequently
triggers a stack overflow check.
Signed-off-by: Peter Oberparleiter <peter.oberparleiter@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
diffstat:
arch/s390/kernel/entry.S | 2 +-
arch/s390/kernel/entry64.S | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff -urpN linux-2.6/arch/s390/kernel/entry64.S linux-2.6-patched/arch/s390/kernel/entry64.S
--- linux-2.6/arch/s390/kernel/entry64.S 2005-09-15 15:31:03.000000000 +0200
+++ linux-2.6-patched/arch/s390/kernel/entry64.S 2005-09-15 15:31:26.000000000 +0200
@@ -101,7 +101,7 @@ _TIF_WORK_INT = (_TIF_SIGPENDING | _TIF_
clc \psworg+8(8),BASED(.Lcritical_start)
jl 0f
brasl %r14,cleanup_critical
- tm 0(%r12),0x01 # retest problem state after cleanup
+ tm 1(%r12),0x01 # retest problem state after cleanup
jnz 1f
0: lg %r14,__LC_ASYNC_STACK # are we already on the async. stack ?
slgr %r14,%r15
diff -urpN linux-2.6/arch/s390/kernel/entry.S linux-2.6-patched/arch/s390/kernel/entry.S
--- linux-2.6/arch/s390/kernel/entry.S 2005-09-15 15:31:03.000000000 +0200
+++ linux-2.6-patched/arch/s390/kernel/entry.S 2005-09-15 15:31:26.000000000 +0200
@@ -108,7 +108,7 @@ STACK_SIZE = 1 << STACK_SHIFT
bl BASED(0f)
l %r14,BASED(.Lcleanup_critical)
basr %r14,%r14
- tm 0(%r12),0x01 # retest problem state after cleanup
+ tm 1(%r12),0x01 # retest problem state after cleanup
bnz BASED(1f)
0: l %r14,__LC_ASYNC_STACK # are we already on the async stack ?
slr %r14,%r15
next reply other threads:[~2005-09-15 14:53 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2005-09-15 14:53 Martin Schwidefsky [this message]
2005-09-15 15:11 ` [patch] s390: kernel stack corruption Theodore Ts'o
2005-09-16 8:29 ` Martin Schwidefsky
2005-09-15 19:01 ` Matthias Urlichs
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20050915145303.GA5959@skybase.boeblingen.de.ibm.com \
--to=schwidefsky@de.ibm.com \
--cc=akpm@osdl.org \
--cc=linux-kernel@vger.kernel.org \
--cc=peter.oberparleiter@de.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox