s390/process: avoid potential reading of freed stack (8769f610) · Commits · 戴 / test

With THREAD_INFO_IN_TASK (which is selected on s390) task's stack usage is refcounted and should always be protected by get/put when touching other task's stack to avoid race conditions with task's destruction code. Fixes: ("s390: move thread_info into task_struct") Cc: stable@vger.kernel.org # v4.10+ Acked-by:

Ilya Leoshkevich <iii@linux.ibm.com> Signed-off-by:

Vasily Gorbik <gor@linux.ibm.com>

arch/s390/kernel/process.c

+16 −6

Original line number	Diff line number	Diff line
		@@ -184,20 +184,30 @@ unsigned long get_wchan(struct task_struct *p)

		if (!p \|\| p == current \|\| p->state == TASK_RUNNING \|\| !task_stack_page(p))
		return 0;

		if (!try_get_task_stack(p))
		return 0;

		low = task_stack_page(p);
		high = (struct stack_frame *) task_pt_regs(p);
		sf = (struct stack_frame *) p->thread.ksp;
		if (sf <= low \|\| sf > high)
		return 0;
		if (sf <= low \|\| sf > high) {
		return_address = 0;
		goto out;
		}
		for (count = 0; count < 16; count++) {
		sf = (struct stack_frame *) sf->back_chain;
		if (sf <= low \|\| sf > high)
		return 0;
		if (sf <= low \|\| sf > high) {
		return_address = 0;
		goto out;
		}
		return_address = sf->gprs[8];
		if (!in_sched_functions(return_address))
		return return_address;
		goto out;
		}
		return 0;
		out:
		put_task_stack(p);
		return return_address;
		}

		unsigned long arch_align_stack(unsigned long sp)

Admin message