[patch] s390: kernel stack corruption.

[patch] s390: kernel stack corruption.

[Martin Schwidefsky]

Hi Andrew,
Peter discoverd another rather critical bug in entry.S.
This should go into 2.6.14 if possible.

blue skies,
  Martin.

---

[patch] s390: kernel stack corruption.

From: Peter Oberparleiter <peter.oberparleiter@de.ibm.com>

When an asynchronous interruption occurs during the execution
of the 'critical section' within the generic interruption
handling code (entry.S), a faulty check for a userspace PSW may
result in a corrupted kernel stack pointer which subsequently
triggers a stack overflow check.

Signed-off-by: Peter Oberparleiter <peter.oberparleiter@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>

diffstat:
 arch/s390/kernel/entry.S   |    2 +-
 arch/s390/kernel/entry64.S |    2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff -urpN linux-2.6/arch/s390/kernel/entry64.S linux-2.6-patched/arch/s390/kernel/entry64.S
--- linux-2.6/arch/s390/kernel/entry64.S	2005-09-15 15:31:03.000000000 +0200
+++ linux-2.6-patched/arch/s390/kernel/entry64.S	2005-09-15 15:31:26.000000000 +0200
@@ -101,7 +101,7 @@ _TIF_WORK_INT = (_TIF_SIGPENDING | _TIF_
 	clc	\psworg+8(8),BASED(.Lcritical_start)
 	jl	0f
 	brasl	%r14,cleanup_critical
-	tm	0(%r12),0x01		# retest problem state after cleanup
+	tm	1(%r12),0x01		# retest problem state after cleanup
 	jnz	1f
 0:	lg	%r14,__LC_ASYNC_STACK	# are we already on the async. stack ?
 	slgr	%r14,%r15
diff -urpN linux-2.6/arch/s390/kernel/entry.S linux-2.6-patched/arch/s390/kernel/entry.S
--- linux-2.6/arch/s390/kernel/entry.S	2005-09-15 15:31:03.000000000 +0200
+++ linux-2.6-patched/arch/s390/kernel/entry.S	2005-09-15 15:31:26.000000000 +0200
@@ -108,7 +108,7 @@ STACK_SIZE  = 1 << STACK_SHIFT
 	bl	BASED(0f)
 	l	%r14,BASED(.Lcleanup_critical)
 	basr	%r14,%r14
-	tm	0(%r12),0x01		# retest problem state after cleanup
+	tm	1(%r12),0x01		# retest problem state after cleanup
 	bnz	BASED(1f)
 0:	l	%r14,__LC_ASYNC_STACK	# are we already on the async stack ?
 	slr	%r14,%r15

Re: [patch] s390: kernel stack corruption.

[Theodore Ts'o]

On Thu, Sep 15, 2005 at 04:53:03PM +0200, Martin Schwidefsky wrote:
> Hi Andrew,
> Peter discoverd another rather critical bug in entry.S.
> This should go into 2.6.14 if possible.

This might be a good thing for the 2.6.13.x stable series.

Regards,

					- Ted

> blue skies,
>   Martin.
> 
> ---
> 
> [patch] s390: kernel stack corruption.
> 
> From: Peter Oberparleiter <peter.oberparleiter@de.ibm.com>
> 
> When an asynchronous interruption occurs during the execution
> of the 'critical section' within the generic interruption
> handling code (entry.S), a faulty check for a userspace PSW may
> result in a corrupted kernel stack pointer which subsequently
> triggers a stack overflow check.
> 
> Signed-off-by: Peter Oberparleiter <peter.oberparleiter@de.ibm.com>
> Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
> 
> diffstat:
>  arch/s390/kernel/entry.S   |    2 +-
>  arch/s390/kernel/entry64.S |    2 +-
>  2 files changed, 2 insertions(+), 2 deletions(-)
> 
> diff -urpN linux-2.6/arch/s390/kernel/entry64.S linux-2.6-patched/arch/s390/kernel/entry64.S
> --- linux-2.6/arch/s390/kernel/entry64.S	2005-09-15 15:31:03.000000000 +0200
> +++ linux-2.6-patched/arch/s390/kernel/entry64.S	2005-09-15 15:31:26.000000000 +0200
> @@ -101,7 +101,7 @@ _TIF_WORK_INT = (_TIF_SIGPENDING | _TIF_
>  	clc	\psworg+8(8),BASED(.Lcritical_start)
>  	jl	0f
>  	brasl	%r14,cleanup_critical
> -	tm	0(%r12),0x01		# retest problem state after cleanup
> +	tm	1(%r12),0x01		# retest problem state after cleanup
>  	jnz	1f
>  0:	lg	%r14,__LC_ASYNC_STACK	# are we already on the async. stack ?
>  	slgr	%r14,%r15
> diff -urpN linux-2.6/arch/s390/kernel/entry.S linux-2.6-patched/arch/s390/kernel/entry.S
> --- linux-2.6/arch/s390/kernel/entry.S	2005-09-15 15:31:03.000000000 +0200
> +++ linux-2.6-patched/arch/s390/kernel/entry.S	2005-09-15 15:31:26.000000000 +0200
> @@ -108,7 +108,7 @@ STACK_SIZE  = 1 << STACK_SHIFT
>  	bl	BASED(0f)
>  	l	%r14,BASED(.Lcleanup_critical)
>  	basr	%r14,%r14
> -	tm	0(%r12),0x01		# retest problem state after cleanup
> +	tm	1(%r12),0x01		# retest problem state after cleanup
>  	bnz	BASED(1f)
>  0:	l	%r14,__LC_ASYNC_STACK	# are we already on the async stack ?
>  	slr	%r14,%r15
> -
> To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
> Please read the FAQ at  http://www.tux.org/lkml/

Re: [patch] s390: kernel stack corruption.

[Matthias Urlichs]

Hi, Martin Schwidefsky wrote:

> [ mailing list comment ]
> ---
> [ comment for the git commit ]
> [ diffstat ]
> [ patch ]

The two comments should be swapped when submitting patches.

-- 
Matthias Urlichs   |   {M:U} IT Design @ m-u-it.de   |  smurf@smurf.noris.de
Disclaimer: The quote was selected randomly. Really. | http://smurf.noris.de
 - -
I love dogs, but I hate Chihuahuas.  A Chihuahua isn't a dog.  It's a rat
with a thyroid problem.

Re: [patch] s390: kernel stack corruption.

[Martin Schwidefsky]

On Thu, 2005-09-15 at 11:11 -0400, Theodore Ts'o wrote:
> On Thu, Sep 15, 2005 at 04:53:03PM +0200, Martin Schwidefsky wrote:
> > Hi Andrew,
> > Peter discoverd another rather critical bug in entry.S.
> > This should go into 2.6.14 if possible.
> 
> This might be a good thing for the 2.6.13.x stable series.

Yes, that would be good. 

-- 
blue skies,
   Martin

Martin Schwidefsky
Linux for zSeries Development & Services
IBM Deutschland Entwicklung GmbH