Re: [patch] s390: kernel stack corruption.

Theodore Ts'o
2005-09-15T15:12:42Z

On Thu, Sep 15, 2005 at 04:53:03PM +0200, Martin Schwidefsky wrote:
> Hi Andrew,
> Peter discoverd another rather critical bug in entry.S.
> This should go into 2.6.14 if possible.

This might be a good thing for the 2.6.13.x stable series.

Regards,

- Ted

> blue skies,
> Martin.
>
> ---
>
> [patch] s390: kernel stack corruption.
>
> From: Peter Oberparleiter <peter.oberparleiter@de.ibm.com>
>
> When an asynchronous interruption occurs during the execution
> of the 'critical section' within the generic interruption
> handling code (entry.S), a faulty check for a userspace PSW may
> result in a corrupted kernel stack pointer which subsequently
> triggers a stack overflow check.
>
> Signed-off-by: Peter Oberparleiter <peter.oberparleiter@de.ibm.com>
> Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
>
> diffstat:
> arch/s390/kernel/entry.S | 2 +-
> arch/s390/kernel/entry64.S | 2 +-
> 2 files changed, 2 insertions(+), 2 deletions(-)
>
> diff -urpN linux-2.6/arch/s390/kernel/entry64.S linux-2.6-patched/arch/s390/kernel/entry64.S
> --- linux-2.6/arch/s390/kernel/entry64.S 2005-09-15 15:31:03.000000000 +0200
> +++ linux-2.6-patched/arch/s390/kernel/entry64.S 2005-09-15 15:31:26.000000000 +0200
> @@ -101,7 +101,7 @@ _TIF_WORK_INT = (_TIF_SIGPENDING | _TIF_
> clc \psworg+8(8),BASED(.Lcritical_start)
> jl 0f
> brasl %r14,cleanup_critical
> - tm 0(%r12),0x01 # retest problem state after cleanup
> + tm 1(%r12),0x01 # retest problem state after cleanup
> jnz 1f
> 0: lg %r14,__LC_ASYNC_STACK # are we already on the async. stack ?
> slgr %r14,%r15
> diff -urpN linux-2.6/arch/s390/kernel/entry.S linux-2.6-patched/arch/s390/kernel/entry.S
> --- linux-2.6/arch/s390/kernel/entry.S 2005-09-15 15:31:03.000000000 +0200
> +++ linux-2.6-patched/arch/s390/kernel/entry.S 2005-09-15 15:31:26.000000000 +0200
> @@ -108,7 +108,7 @@ STACK_SIZE = 1 << STACK_SHIFT
> bl BASED(0f)
> l %r14,BASED(.Lcleanup_critical)
> basr %r14,%r14
> - tm 0(%r12),0x01 # retest problem state after cleanup
> + tm 1(%r12),0x01 # retest problem state after cleanup
> bnz BASED(1f)
> 0: l %r14,__LC_ASYNC_STACK # are we already on the async stack ?
> slr %r14,%r15
> -
> To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
> Please read the FAQ at http://www.tux.org/lkml/