From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Helge Deller <deller@gmx.de>,
John David Anglin <dave.anglin@bell.net>
Subject: [ 12/50] parisc: fix interruption handler to respect pagefault_disable()
Date: Wed, 16 Oct 2013 10:44:58 -0700 [thread overview]
Message-ID: <20131016174359.849208968@linuxfoundation.org> (raw)
In-Reply-To: <20131016174358.335646140@linuxfoundation.org>
3.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Helge Deller <deller@gmx.de>
commit 59b33f148cc08fb33cbe823fca1e34f7f023765e upstream.
Running an "echo t > /proc/sysrq-trigger" crashes the parisc kernel. The
problem is, that in print_worker_info() we try to read the workqueue info via
the probe_kernel_read() functions which use pagefault_disable() to avoid
crashes like this:
probe_kernel_read(&pwq, &worker->current_pwq, sizeof(pwq));
probe_kernel_read(&wq, &pwq->wq, sizeof(wq));
probe_kernel_read(name, wq->name, sizeof(name) - 1);
The problem here is, that the first probe_kernel_read(&pwq) might return zero
in pwq and as such the following probe_kernel_reads() try to access contents of
the page zero which is read protected and generate a kernel segfault.
With this patch we fix the interruption handler to call parisc_terminate()
directly only if pagefault_disable() was not called (in which case
preempt_count()==0). Otherwise we hand over to the pagefault handler which
will try to look up the faulting address in the fixup tables.
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: John David Anglin <dave.anglin@bell.net>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/parisc/kernel/traps.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/arch/parisc/kernel/traps.c
+++ b/arch/parisc/kernel/traps.c
@@ -805,14 +805,14 @@ void notrace handle_interruption(int cod
else {
/*
- * The kernel should never fault on its own address space.
+ * The kernel should never fault on its own address space,
+ * unless pagefault_disable() was called before.
*/
- if (fault_space == 0)
+ if (fault_space == 0 && !in_atomic())
{
pdc_chassis_send_status(PDC_CHASSIS_DIRECT_PANIC);
parisc_terminate("Kernel Fault", regs, code, fault_address);
-
}
}
next prev parent reply other threads:[~2013-10-16 17:44 UTC|newest]
Thread overview: 55+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-10-16 17:44 [ 00/50] 3.11.6-stable review Greg Kroah-Hartman
2013-10-16 17:44 ` [ 01/50] ALSA: snd-usb-usx2y: remove bogus frame checks Greg Kroah-Hartman
2013-10-16 17:44 ` [ 02/50] ALSA: hda - hdmi: Fix channel map switch not taking effect Greg Kroah-Hartman
2013-10-16 17:44 ` [ 03/50] ALSA: hda - Add fixup for ASUS N56VZ Greg Kroah-Hartman
2013-10-16 17:44 ` [ 04/50] ALSA: hda - Fix microphone for Sony VAIO Pro 13 (Haswell model) Greg Kroah-Hartman
2013-10-16 17:44 ` [ 05/50] random: run random_int_secret_init() run after all late_initcalls Greg Kroah-Hartman
2013-10-16 17:44 ` [ 06/50] vfs: allow O_PATH file descriptors for fstatfs() Greg Kroah-Hartman
2013-10-16 17:44 ` [ 07/50] i2c: omap: Clear ARDY bit twice Greg Kroah-Hartman
2013-10-16 17:44 ` [ 08/50] hwmon: (applesmc) Always read until end of data Greg Kroah-Hartman
2013-10-16 17:44 ` [ 09/50] Btrfs: use right root when checking for hash collision Greg Kroah-Hartman
2013-10-16 17:44 ` [ 10/50] ext4: fix memory leak in xattr Greg Kroah-Hartman
2013-10-16 17:44 ` [ 11/50] KVM: PPC: Book3S HV: Fix typo in saving DSCR Greg Kroah-Hartman
2013-10-16 17:44 ` Greg Kroah-Hartman [this message]
2013-10-16 17:44 ` [ 13/50] ARC: Fix __udelay calculation Greg Kroah-Hartman
2013-10-16 17:45 ` [ 14/50] ARC: Handle zero-overhead-loop in unaligned access handler Greg Kroah-Hartman
2013-10-16 17:45 ` [ 15/50] ARC: Fix 32-bit wrap around in access_ok() Greg Kroah-Hartman
2013-10-16 17:45 ` [ 16/50] ARC: Workaround spinlock livelock in SMP SystemC simulation Greg Kroah-Hartman
2013-10-16 17:45 ` [ 17/50] ARC: Fix signal frame management for SA_SIGINFO Greg Kroah-Hartman
2013-10-16 17:45 ` [ 18/50] ARC: Ignore ptrace SETREGSET request for synthetic register "stop_pc" Greg Kroah-Hartman
2013-10-16 17:45 ` [ 19/50] watchdog: ts72xx_wdt: locking bug in ioctl Greg Kroah-Hartman
2013-10-16 17:45 ` [ 20/50] watchdog: kempld_wdt: Fix bit mask definition Greg Kroah-Hartman
2013-10-16 17:45 ` [ 21/50] MIPS: stack protector: Fix per-task canary switch Greg Kroah-Hartman
2013-10-16 17:45 ` [ 22/50] drm/radeon/dpm/btc: off by one in btc_set_mc_special_registers() Greg Kroah-Hartman
2013-10-16 17:45 ` [ 23/50] compiler/gcc4: Add quirk for asm goto miscompilation bug Greg Kroah-Hartman
2013-10-16 17:45 ` [ 24/50] ALSA: hda - Fix mono speakers and headset mic on Dell Vostro 5470 Greg Kroah-Hartman
2013-10-16 17:45 ` [ 25/50] drm/i915/hsw: Disable L3 caching of atomic memory operations Greg Kroah-Hartman
2013-10-16 17:45 ` [ 26/50] drm/i915: Only apply DPMS to the encoder if enabled Greg Kroah-Hartman
2013-10-16 17:45 ` [ 27/50] drm/i915: fix rps.vlv_work initialization Greg Kroah-Hartman
2013-10-16 17:45 ` [ 28/50] drm/radeon/dpm: off by one in si_set_mc_special_registers() Greg Kroah-Hartman
2013-10-16 17:45 ` [ 29/50] drm/radeon: forever loop on error in radeon_do_test_moves() Greg Kroah-Hartman
2013-10-16 17:45 ` [ 30/50] drm/radeon: fix typo in CP DMA register headers Greg Kroah-Hartman
2013-10-16 17:45 ` [ 31/50] drm/radeon: fix hw contexts for SUMO2 asics Greg Kroah-Hartman
2013-10-16 17:45 ` [ 32/50] ipc,shm: introduce lockless functions to obtain the ipc object Greg Kroah-Hartman
2013-10-16 17:45 ` [ 33/50] ipc,shm: shorten critical region in shmctl_down Greg Kroah-Hartman
2013-10-16 17:45 ` [ 34/50] ipc: drop ipcctl_pre_down Greg Kroah-Hartman
2013-10-16 17:45 ` [ 35/50] ipc,shm: introduce shmctl_nolock Greg Kroah-Hartman
2013-10-16 17:45 ` [ 36/50] ipc,shm: make shmctl_nolock lockless Greg Kroah-Hartman
2013-10-16 17:45 ` [ 37/50] ipc,shm: shorten critical region for shmctl Greg Kroah-Hartman
2013-10-16 17:45 ` [ 38/50] ipc,shm: cleanup do_shmat pasta Greg Kroah-Hartman
2013-10-16 17:45 ` [ 39/50] ipc,shm: shorten critical region for shmat Greg Kroah-Hartman
2013-10-16 17:45 ` [ 40/50] ipc: rename ids->rw_mutex Greg Kroah-Hartman
2013-10-16 17:45 ` [ 41/50] ipc,msg: drop msg_unlock Greg Kroah-Hartman
2013-10-16 17:45 ` [ 42/50] ipc: document general ipc locking scheme Greg Kroah-Hartman
2013-10-16 17:45 ` [ 43/50] ipc, shm: guard against non-existant vma in shmdt(2) Greg Kroah-Hartman
2013-10-16 17:45 ` [ 44/50] ipc: drop ipc_lock_by_ptr Greg Kroah-Hartman
2013-10-16 17:45 ` [ 45/50] ipc, shm: drop shm_lock_check Greg Kroah-Hartman
2013-10-16 17:45 ` [ 46/50] ipc: drop ipc_lock_check Greg Kroah-Hartman
2013-10-16 17:45 ` [ 47/50] ipc/sem.c: optimize sem_lock() Greg Kroah-Hartman
2013-10-16 17:45 ` [ 48/50] ipc/sem.c: synchronize the proc interface Greg Kroah-Hartman
2013-10-16 17:45 ` [ 49/50] ipc/sem.c: update sem_otime for all operations Greg Kroah-Hartman
2013-10-16 17:45 ` [ 50/50] x86: avoid remapping data in parse_setup_data() Greg Kroah-Hartman
2013-10-16 22:14 ` [ 00/50] 3.11.6-stable review Guenter Roeck
2013-10-17 1:07 ` Greg Kroah-Hartman
2013-10-17 16:52 ` Shuah Khan
2013-10-17 17:08 ` Greg Kroah-Hartman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20131016174359.849208968@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=dave.anglin@bell.net \
--cc=deller@gmx.de \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).