FAILED: patch "[PATCH] lib/stackdepot.c: fix global out-of-bounds in stack_slabs" failed to apply to 4.19-stable tree

FAILED: patch "[PATCH] lib/stackdepot.c: fix global out-of-bounds in stack_slabs" failed to apply to 4.19-stable tree

[gregkh]

The patch below does not apply to the 4.19-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable@vger.kernel.org>.

thanks,

greg k-h

------------------ original commit in Linus's tree ------------------

From 305e519ce48e935702c32241f07d393c3c8fed3e Mon Sep 17 00:00:00 2001
From: Alexander Potapenko <glider@google.com>
Date: Thu, 20 Feb 2020 20:04:30 -0800
Subject: [PATCH] lib/stackdepot.c: fix global out-of-bounds in stack_slabs

Walter Wu has reported a potential case in which init_stack_slab() is
called after stack_slabs[STACK_ALLOC_MAX_SLABS - 1] has already been
initialized.  In that case init_stack_slab() will overwrite
stack_slabs[STACK_ALLOC_MAX_SLABS], which may result in a memory
corruption.

Link: http://lkml.kernel.org/r/20200218102950.260263-1-glider@google.com
Fixes: cd11016e5f521 ("mm, kasan: stackdepot implementation. Enable stackdepot for SLAB")
Signed-off-by: Alexander Potapenko <glider@google.com>
Reported-by: Walter Wu <walter-zh.wu@mediatek.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Matthias Brugger <matthias.bgg@gmail.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Josh Poimboeuf <jpoimboe@redhat.com>
Cc: Kate Stewart <kstewart@linuxfoundation.org>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

diff --git a/lib/stackdepot.c b/lib/stackdepot.c
index ed717dd08ff3..81c69c08d1d1 100644
--- a/lib/stackdepot.c
+++ b/lib/stackdepot.c
@@ -83,15 +83,19 @@ static bool init_stack_slab(void **prealloc)
 		return true;
 	if (stack_slabs[depot_index] == NULL) {
 		stack_slabs[depot_index] = *prealloc;
+		*prealloc = NULL;
 	} else {
-		stack_slabs[depot_index + 1] = *prealloc;
+		/* If this is the last depot slab, do not touch the next one. */
+		if (depot_index + 1 < STACK_ALLOC_MAX_SLABS) {
+			stack_slabs[depot_index + 1] = *prealloc;
+			*prealloc = NULL;
+		}
 		/*
 		 * This smp_store_release pairs with smp_load_acquire() from
 		 * |next_slab_inited| above and in stack_depot_save().
 		 */
 		smp_store_release(&next_slab_inited, 1);
 	}
-	*prealloc = NULL;
 	return true;
 }
 

Re: FAILED: patch "[PATCH] lib/stackdepot.c: fix global out-of-bounds in stack_slabs" failed to apply to 4.19-stable tree

[Sasha Levin]

On Wed, Feb 26, 2020 at 11:49:42AM +0100, gregkh@linuxfoundation.org wrote:
>
>The patch below does not apply to the 4.19-stable tree.
>If someone wants it applied there, or to any other stable or longterm
>tree, then please email the backport, including the original git commit
>id to <stable@vger.kernel.org>.
>
>thanks,
>
>greg k-h
>
>------------------ original commit in Linus's tree ------------------
>
>From 305e519ce48e935702c32241f07d393c3c8fed3e Mon Sep 17 00:00:00 2001
>From: Alexander Potapenko <glider@google.com>
>Date: Thu, 20 Feb 2020 20:04:30 -0800
>Subject: [PATCH] lib/stackdepot.c: fix global out-of-bounds in stack_slabs
>
>Walter Wu has reported a potential case in which init_stack_slab() is
>called after stack_slabs[STACK_ALLOC_MAX_SLABS - 1] has already been
>initialized.  In that case init_stack_slab() will overwrite
>stack_slabs[STACK_ALLOC_MAX_SLABS], which may result in a memory
>corruption.
>
>Link: http://lkml.kernel.org/r/20200218102950.260263-1-glider@google.com
>Fixes: cd11016e5f521 ("mm, kasan: stackdepot implementation. Enable stackdepot for SLAB")
>Signed-off-by: Alexander Potapenko <glider@google.com>
>Reported-by: Walter Wu <walter-zh.wu@mediatek.com>
>Cc: Dmitry Vyukov <dvyukov@google.com>
>Cc: Matthias Brugger <matthias.bgg@gmail.com>
>Cc: Thomas Gleixner <tglx@linutronix.de>
>Cc: Josh Poimboeuf <jpoimboe@redhat.com>
>Cc: Kate Stewart <kstewart@linuxfoundation.org>
>Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
>Cc: <stable@vger.kernel.org>
>Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
>Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

I've grabbed ee050dc83bc3 ("lib/stackdepot: Fix outdated comments") as a
dependency and queued for 4.19-4.9.

Technically the comment change is wrong as the commit it addresses is
older, but no one should be coding against the stable tree, and doing it
by changing 305e519ce48e would cause merge conflicts in the future.

-- 
Thanks,
Sasha

Re: FAILED: patch "[PATCH] lib/stackdepot.c: fix global out-of-bounds in stack_slabs" failed to apply to 4.19-stable tree

[Alexander Potapenko]

On Thu, Feb 27, 2020 at 3:47 AM Sasha Levin <sashal@kernel.org> wrote:
>
> On Wed, Feb 26, 2020 at 11:49:42AM +0100, gregkh@linuxfoundation.org wrote:
> >
> >The patch below does not apply to the 4.19-stable tree.
> >If someone wants it applied there, or to any other stable or longterm
> >tree, then please email the backport, including the original git commit
> >id to <stable@vger.kernel.org>.
> >
> >thanks,
> >
> >greg k-h
> >
> >------------------ original commit in Linus's tree ------------------
> >
> >From 305e519ce48e935702c32241f07d393c3c8fed3e Mon Sep 17 00:00:00 2001
> >From: Alexander Potapenko <glider@google.com>
> >Date: Thu, 20 Feb 2020 20:04:30 -0800
> >Subject: [PATCH] lib/stackdepot.c: fix global out-of-bounds in stack_slabs
> >
> >Walter Wu has reported a potential case in which init_stack_slab() is
> >called after stack_slabs[STACK_ALLOC_MAX_SLABS - 1] has already been
> >initialized.  In that case init_stack_slab() will overwrite
> >stack_slabs[STACK_ALLOC_MAX_SLABS], which may result in a memory
> >corruption.
> >
> >Link: http://lkml.kernel.org/r/20200218102950.260263-1-glider@google.com
> >Fixes: cd11016e5f521 ("mm, kasan: stackdepot implementation. Enable stackdepot for SLAB")
> >Signed-off-by: Alexander Potapenko <glider@google.com>
> >Reported-by: Walter Wu <walter-zh.wu@mediatek.com>
> >Cc: Dmitry Vyukov <dvyukov@google.com>
> >Cc: Matthias Brugger <matthias.bgg@gmail.com>
> >Cc: Thomas Gleixner <tglx@linutronix.de>
> >Cc: Josh Poimboeuf <jpoimboe@redhat.com>
> >Cc: Kate Stewart <kstewart@linuxfoundation.org>
> >Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> >Cc: <stable@vger.kernel.org>
> >Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
> >Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
>
> I've grabbed ee050dc83bc3 ("lib/stackdepot: Fix outdated comments") as a
> dependency and queued for 4.19-4.9.

Thanks a lot!