From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, James Hogan <james.hogan@imgtec.com>,
Markos Chandras <markos.chandras@imgtec.com>,
Leonid Yegoshin <leonid.yegoshin@imgtec.com>,
linux-mips@linux-mips.org, Ralf Baechle <ralf@linux-mips.org>
Subject: [PATCH 4.1 07/84] MIPS: show_stack: Fix stack trace with EVA
Date: Fri, 14 Aug 2015 10:41:35 -0700 [thread overview]
Message-ID: <20150814174210.436830888@linuxfoundation.org> (raw)
In-Reply-To: <20150814174210.214822912@linuxfoundation.org>
4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: James Hogan <james.hogan@imgtec.com>
commit 1e77863a51698c4319587df34171bd823691a66a upstream.
The show_stack() function deals exclusively with kernel contexts, but if
it gets called in user context with EVA enabled, show_stacktrace() will
attempt to access the stack using EVA accesses, which will either read
other user mapped data, or more likely cause an exception which will be
handled by __get_user().
This is easily reproduced using SysRq t to show all task states, which
results in the following stack dump output:
Stack : (Bad stack address)
Fix by setting the current user access mode to kernel around the call to
show_stacktrace(). This causes __get_user() to use normal loads to read
the kernel stack.
Now we get the correct output, like this:
Stack : 00000000 80168960 00000000 004a0000 00000000 00000000 8060016c 1f3abd0c
1f172cd8 8056f09c 7ff1e450 8014fc3c 00000001 806dd0b0 0000001d 00000002
1f17c6a0 1f17c804 1f17c6a0 8066f6e0 00000000 0000000a 00000000 00000000
00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
00000000 00000000 00000000 00000000 00000000 0110e800 1f3abd6c 1f17c6a0
...
Signed-off-by: James Hogan <james.hogan@imgtec.com>
Cc: Markos Chandras <markos.chandras@imgtec.com>
Cc: Leonid Yegoshin <leonid.yegoshin@imgtec.com>
Cc: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/10778/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/mips/kernel/traps.c | 7 +++++++
1 file changed, 7 insertions(+)
--- a/arch/mips/kernel/traps.c
+++ b/arch/mips/kernel/traps.c
@@ -192,6 +192,7 @@ static void show_stacktrace(struct task_
void show_stack(struct task_struct *task, unsigned long *sp)
{
struct pt_regs regs;
+ mm_segment_t old_fs = get_fs();
if (sp) {
regs.regs[29] = (unsigned long)sp;
regs.regs[31] = 0;
@@ -210,7 +211,13 @@ void show_stack(struct task_struct *task
prepare_frametrace(®s);
}
}
+ /*
+ * show_stack() deals exclusively with kernel mode, so be sure to access
+ * the stack in the kernel (not user) address space.
+ */
+ set_fs(KERNEL_DS);
show_stacktrace(task, ®s);
+ set_fs(old_fs);
}
static void show_code(unsigned int __user *pc)
next prev parent reply other threads:[~2015-08-14 17:43 UTC|newest]
Thread overview: 83+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-08-14 17:41 [PATCH 4.1 00/84] 4.1.6-stable review Greg Kroah-Hartman
2015-08-14 17:41 ` [PATCH 4.1 01/84] MIPS: unaligned: Fix build error on big endian R6 kernels Greg Kroah-Hartman
2015-08-14 17:41 ` [PATCH 4.1 02/84] MIPS: Replace add and sub instructions in relocate_kernel.S with addiu Greg Kroah-Hartman
2015-08-14 17:41 ` [PATCH 4.1 03/84] MIPS: Malta: Dont reinitialise RTC Greg Kroah-Hartman
2015-08-14 17:41 ` [PATCH 4.1 04/84] MIPS: Fix sched_getaffinity with MT FPAFF enabled Greg Kroah-Hartman
2015-08-14 17:41 ` [PATCH 4.1 05/84] MIPS: Export get_c0_perfcount_int() Greg Kroah-Hartman
2015-08-14 17:41 ` [PATCH 4.1 06/84] MIPS: do_mcheck: Fix kernel code dump with EVA Greg Kroah-Hartman
2015-08-14 17:41 ` Greg Kroah-Hartman [this message]
2015-08-14 17:41 ` [PATCH 4.1 09/84] MIPS: Flush RPS on kernel entry " Greg Kroah-Hartman
2015-08-14 17:41 ` [PATCH 4.1 10/84] MIPS: Make set_pte() SMP safe Greg Kroah-Hartman
2015-08-14 17:41 ` [PATCH 4.1 11/84] fsnotify: fix oops in fsnotify_clear_marks_by_group_flags() Greg Kroah-Hartman
2015-08-14 17:41 ` [PATCH 4.1 12/84] drm/i915: Declare the swizzling unknown for L-shaped configurations Greg Kroah-Hartman
2015-08-14 17:41 ` [PATCH 4.1 14/84] drm/radeon: rework audio detect (v4) Greg Kroah-Hartman
2015-08-14 17:41 ` [PATCH 4.1 15/84] drm/radeon/combios: add some validation of lvds values Greg Kroah-Hartman
2015-08-14 17:41 ` [PATCH 4.1 16/84] drm/dp-mst: Remove debug WARN_ON Greg Kroah-Hartman
2015-08-14 17:41 ` [PATCH 4.1 17/84] ipr: Fix locking for unit attention handling Greg Kroah-Hartman
2015-08-14 17:41 ` [PATCH 4.1 18/84] ipr: Fix incorrect trace indexing Greg Kroah-Hartman
2015-08-14 17:41 ` [PATCH 4.1 19/84] ipr: Fix invalid array indexing for HRRQ Greg Kroah-Hartman
2015-08-14 17:41 ` [PATCH 4.1 20/84] Bluetooth: Fix NULL pointer dereference in smp_conn_security Greg Kroah-Hartman
2015-08-14 17:41 ` [PATCH 4.1 21/84] dmaengine: pl330: Fix overflow when reporting residue in memcpy Greg Kroah-Hartman
2015-08-14 17:41 ` [PATCH 4.1 22/84] dmaengine: pl330: Really fix choppy sound because of wrong residue calculation Greg Kroah-Hartman
2015-08-14 17:41 ` [PATCH 4.1 24/84] drivers/usb: Delete XHCI command timer if necessary Greg Kroah-Hartman
2015-08-14 17:41 ` [PATCH 4.1 25/84] USB: sierra: add 1199:68AB device ID Greg Kroah-Hartman
2015-08-14 17:41 ` [PATCH 4.1 26/84] usb: udc: core: add device_del() call to error pathway Greg Kroah-Hartman
2015-08-14 17:41 ` [PATCH 4.1 27/84] usb: chipidea: ehci_init_driver is intended to call one time Greg Kroah-Hartman
2015-08-14 17:41 ` [PATCH 4.1 28/84] phy: twl4030-usb: make runtime pm more reliable Greg Kroah-Hartman
2015-08-14 17:41 ` [PATCH 4.1 29/84] md: use kzalloc() when bitmap is disabled Greg Kroah-Hartman
2015-08-14 17:41 ` [PATCH 4.1 30/84] ath10k: fix qca61x4 hw2.1 support Greg Kroah-Hartman
2015-08-14 17:41 ` [PATCH 4.1 31/84] x86/asm/entry/64: Remove pointless jump to irq_return Greg Kroah-Hartman
2015-08-14 17:42 ` [PATCH 4.1 32/84] x86/nmi: Enable nested do_nmi() handling for 64-bit kernels Greg Kroah-Hartman
2015-08-14 17:42 ` [PATCH 4.1 33/84] x86/nmi/64: Remove asm code that saves CR2 Greg Kroah-Hartman
2015-08-14 17:42 ` [PATCH 4.1 34/84] x86/nmi/64: Switch stacks on userspace NMI entry Greg Kroah-Hartman
2015-08-14 17:42 ` [PATCH 4.1 35/84] x86/nmi/64: Improve nested NMI comments Greg Kroah-Hartman
2015-08-14 17:42 ` [PATCH 4.1 36/84] x86/nmi/64: Reorder nested NMI checks Greg Kroah-Hartman
2015-08-14 17:42 ` [PATCH 4.1 37/84] x86/nmi/64: Use DF to avoid userspace RSP confusing nested NMI detection Greg Kroah-Hartman
2015-08-14 17:42 ` [PATCH 4.1 38/84] dmaengine: at_xdmac: fix transfer data width in at_xdmac_prep_slave_sg() Greg Kroah-Hartman
2015-08-14 17:42 ` [PATCH 4.1 39/84] crypto: nx - Fixing NX data alignment with nx_sg list Greg Kroah-Hartman
2015-08-14 17:42 ` [PATCH 4.1 40/84] crypto: nx - Fixing SHA update bug Greg Kroah-Hartman
2015-08-14 17:42 ` [PATCH 4.1 41/84] crypto: nx - Fix reentrancy bugs Greg Kroah-Hartman
2015-08-14 17:42 ` [PATCH 4.1 42/84] [PATCH] sparc64: Fix userspace FPU register corruptions Greg Kroah-Hartman
2015-08-14 17:42 ` [PATCH 4.1 43/84] clk: keystone: add support for post divider register for main pll Greg Kroah-Hartman
2015-08-14 17:42 ` [PATCH 4.1 44/84] ARM: dts: keystone: fix dt bindings to use post div register for mainpll Greg Kroah-Hartman
2015-08-14 17:42 ` [PATCH 4.1 45/84] ASoC: Intel: Get correct usage_count value to load firmware Greg Kroah-Hartman
2015-08-14 17:42 ` [PATCH 4.1 46/84] ASoC: ssm4567: Keep TDM_BCLKS in ssm4567_set_dai_fmt Greg Kroah-Hartman
2015-08-14 17:42 ` [PATCH 4.1 47/84] ASoC: pcm1681: Fix setting de-emphasis sampling rate selection Greg Kroah-Hartman
2015-08-14 17:42 ` [PATCH 4.1 48/84] ASoC: dapm: Lock during userspace access Greg Kroah-Hartman
2015-08-14 17:42 ` [PATCH 4.1 49/84] ASoC: dapm: Dont add prefix to widget stream name Greg Kroah-Hartman
2015-08-14 17:42 ` [PATCH 4.1 50/84] x86/xen: Probe target addresses in set_aliased_prot() before the hypercall Greg Kroah-Hartman
2015-08-14 17:42 ` [PATCH 4.1 52/84] hwrng: core - correct error check of kthread_run call Greg Kroah-Hartman
2015-08-14 17:42 ` [PATCH 4.1 53/84] crypto: qat - Fix invalid synchronization between register/unregister sym algs Greg Kroah-Hartman
2015-08-14 17:42 ` [PATCH 4.1 54/84] crypto: ixp4xx - Remove bogus BUG_ON on scattered dst buffer Greg Kroah-Hartman
2015-08-14 17:42 ` [PATCH 4.1 55/84] rbd: fix copyup completion race Greg Kroah-Hartman
2015-08-14 17:42 ` [PATCH 4.1 56/84] ARM: dts: i.MX35: Fix can support Greg Kroah-Hartman
2015-08-14 17:42 ` [PATCH 4.1 57/84] ARM: OMAP2+: hwmod: Fix _wait_target_ready() for hwmods without sysc Greg Kroah-Hartman
2015-08-14 17:42 ` [PATCH 4.1 58/84] ALSA: hda - fix cs4210_spdif_automute() Greg Kroah-Hartman
2015-08-14 17:42 ` [PATCH 4.1 59/84] ALSA: hda - one Dell machine needs the headphone white noise fixup Greg Kroah-Hartman
2015-08-14 17:42 ` [PATCH 4.1 60/84] ALSA: fireworks/firewire-lib: add support for recent firmware quirk Greg Kroah-Hartman
2015-08-14 17:42 ` [PATCH 4.1 61/84] hwmon: (nct7904) Export I2C module alias information Greg Kroah-Hartman
2015-08-14 17:42 ` [PATCH 4.1 63/84] ipc: modify message queue accounting to not take kernel data structures into account Greg Kroah-Hartman
2015-08-14 17:42 ` [PATCH 4.1 64/84] ocfs2: fix BUG in ocfs2_downconvert_thread_do_work() Greg Kroah-Hartman
2015-08-14 17:42 ` [PATCH 4.1 65/84] ocfs2: fix shift left overflow Greg Kroah-Hartman
2015-08-14 17:42 ` [PATCH 4.1 66/84] nfsd: Drop BUG_ON and ignore SECLABEL on absent filesystem Greg Kroah-Hartman
2015-08-14 17:42 ` [PATCH 4.1 67/84] PCI: Restore PCI_MSIX_FLAGS_BIRMASK definition Greg Kroah-Hartman
2015-08-14 17:42 ` [PATCH 4.1 68/84] md/raid1: extend spinlock to protect raid1_end_read_request against inconsistencies Greg Kroah-Hartman
2015-08-14 17:42 ` [PATCH 4.1 69/84] dm: fix dm_merge_bvec regression on 32 bit systems Greg Kroah-Hartman
2015-08-14 17:42 ` [PATCH 4.1 70/84] staging: vt6655: vnt_bss_info_changed check conf->beacon_rate is not NULL Greg Kroah-Hartman
2015-08-14 17:42 ` [PATCH 4.1 71/84] staging: lustre: Include unaligned.h instead of access_ok.h Greg Kroah-Hartman
2015-08-14 17:42 ` [PATCH 4.1 72/84] usb: gadget: f_uac2: fix calculation of uac2->p_interval Greg Kroah-Hartman
2015-08-14 17:42 ` [PATCH 4.1 73/84] USB: qcserial/option: make AT URCs work for Sierra Wireless MC7305/MC7355 Greg Kroah-Hartman
2015-08-14 17:42 ` [PATCH 4.1 75/84] mtd: nand: Fix NAND_USE_BOUNCE_BUFFER flag conflict Greg Kroah-Hartman
2015-08-14 17:42 ` [PATCH 4.1 76/84] Input: alps - only Dell laptops have separate button bits for v2 dualpoint sticks Greg Kroah-Hartman
2015-08-14 17:42 ` [PATCH 4.1 77/84] thermal: exynos: Disable the regulator on probe failure Greg Kroah-Hartman
2015-08-14 17:42 ` [PATCH 4.1 78/84] mm, vmscan: Do not wait for page writeback for GFP_NOFS allocations Greg Kroah-Hartman
2015-08-14 17:42 ` [PATCH 4.1 79/84] signalfd: fix information leak in signalfd_copyinfo Greg Kroah-Hartman
2015-08-14 17:42 ` [PATCH 4.1 80/84] signal: fix information leak in copy_siginfo_to_user Greg Kroah-Hartman
2015-08-14 17:42 ` [PATCH 4.1 81/84] signal: fix information leak in copy_siginfo_from_user32 Greg Kroah-Hartman
2015-08-14 17:42 ` [PATCH 4.1 82/84] kvm: x86: fix kvm_apic_has_events to check for NULL pointer Greg Kroah-Hartman
2015-08-14 17:42 ` [PATCH 4.1 83/84] nfsd: refactor nfs4_preprocess_stateid_op Greg Kroah-Hartman
2015-08-14 17:42 ` [PATCH 4.1 84/84] nfsd: do nfs4_check_fh in nfs4_check_file instead of nfs4_check_olstateid Greg Kroah-Hartman
2015-08-15 0:10 ` [PATCH 4.1 00/84] 4.1.6-stable review Shuah Khan
2015-08-15 0:46 ` Greg Kroah-Hartman
2015-08-15 15:21 ` Guenter Roeck
2015-08-15 16:40 ` Greg Kroah-Hartman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20150814174210.436830888@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=james.hogan@imgtec.com \
--cc=leonid.yegoshin@imgtec.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mips@linux-mips.org \
--cc=markos.chandras@imgtec.com \
--cc=ralf@linux-mips.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).