2005-09-15 14:53:05

by Martin Schwidefsky

Subject: [patch] s390: kernel stack corruption.

Hi Andrew,
Peter discoverd another rather critical bug in entry.S.
This should go into 2.6.14 if possible.

blue skies,
Martin.

---

[patch] s390: kernel stack corruption.

From: Peter Oberparleiter <[email protected]>

When an asynchronous interruption occurs during the execution
of the 'critical section' within the generic interruption
handling code (entry.S), a faulty check for a userspace PSW may
result in a corrupted kernel stack pointer which subsequently
triggers a stack overflow check.

Signed-off-by: Peter Oberparleiter <[email protected]>
Signed-off-by: Martin Schwidefsky <[email protected]>

diffstat:
arch/s390/kernel/entry.S | 2 +-
arch/s390/kernel/entry64.S | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)

diff -urpN linux-2.6/arch/s390/kernel/entry64.S linux-2.6-patched/arch/s390/kernel/entry64.S
--- linux-2.6/arch/s390/kernel/entry64.S 2005-09-15 15:31:03.000000000 +0200
+++ linux-2.6-patched/arch/s390/kernel/entry64.S 2005-09-15 15:31:26.000000000 +0200
@@ -101,7 +101,7 @@ _TIF_WORK_INT = (_TIF_SIGPENDING | _TIF_
clc \psworg+8(8),BASED(.Lcritical_start)
jl 0f
brasl %r14,cleanup_critical
- tm 0(%r12),0x01 # retest problem state after cleanup
+ tm 1(%r12),0x01 # retest problem state after cleanup
jnz 1f
0: lg %r14,__LC_ASYNC_STACK # are we already on the async. stack ?
slgr %r14,%r15
diff -urpN linux-2.6/arch/s390/kernel/entry.S linux-2.6-patched/arch/s390/kernel/entry.S
--- linux-2.6/arch/s390/kernel/entry.S 2005-09-15 15:31:03.000000000 +0200
+++ linux-2.6-patched/arch/s390/kernel/entry.S 2005-09-15 15:31:26.000000000 +0200
@@ -108,7 +108,7 @@ STACK_SIZE = 1 << STACK_SHIFT
bl BASED(0f)
l %r14,BASED(.Lcleanup_critical)
basr %r14,%r14
- tm 0(%r12),0x01 # retest problem state after cleanup
+ tm 1(%r12),0x01 # retest problem state after cleanup
bnz BASED(1f)
0: l %r14,__LC_ASYNC_STACK # are we already on the async stack ?
slr %r14,%r15

2005-09-15 15:12:42

by Theodore Ts'o

Subject: Re: [patch] s390: kernel stack corruption.

On Thu, Sep 15, 2005 at 04:53:03PM +0200, Martin Schwidefsky wrote:
> Hi Andrew,
> Peter discoverd another rather critical bug in entry.S.
> This should go into 2.6.14 if possible.

This might be a good thing for the 2.6.13.x stable series.

Regards,

- Ted

> blue skies,
> Martin.
>
> ---
>
> [patch] s390: kernel stack corruption.
>
> From: Peter Oberparleiter <[email protected]>
>
> When an asynchronous interruption occurs during the execution
> of the 'critical section' within the generic interruption
> handling code (entry.S), a faulty check for a userspace PSW may
> result in a corrupted kernel stack pointer which subsequently
> triggers a stack overflow check.
>
> Signed-off-by: Peter Oberparleiter <[email protected]>
> Signed-off-by: Martin Schwidefsky <[email protected]>
>
> diffstat:
> arch/s390/kernel/entry.S | 2 +-
> arch/s390/kernel/entry64.S | 2 +-
> 2 files changed, 2 insertions(+), 2 deletions(-)
>
> diff -urpN linux-2.6/arch/s390/kernel/entry64.S linux-2.6-patched/arch/s390/kernel/entry64.S
> --- linux-2.6/arch/s390/kernel/entry64.S 2005-09-15 15:31:03.000000000 +0200
> +++ linux-2.6-patched/arch/s390/kernel/entry64.S 2005-09-15 15:31:26.000000000 +0200
> @@ -101,7 +101,7 @@ _TIF_WORK_INT = (_TIF_SIGPENDING | _TIF_
> clc \psworg+8(8),BASED(.Lcritical_start)
> jl 0f
> brasl %r14,cleanup_critical
> - tm 0(%r12),0x01 # retest problem state after cleanup
> + tm 1(%r12),0x01 # retest problem state after cleanup
> jnz 1f
> 0: lg %r14,__LC_ASYNC_STACK # are we already on the async. stack ?
> slgr %r14,%r15
> diff -urpN linux-2.6/arch/s390/kernel/entry.S linux-2.6-patched/arch/s390/kernel/entry.S
> --- linux-2.6/arch/s390/kernel/entry.S 2005-09-15 15:31:03.000000000 +0200
> +++ linux-2.6-patched/arch/s390/kernel/entry.S 2005-09-15 15:31:26.000000000 +0200
> @@ -108,7 +108,7 @@ STACK_SIZE = 1 << STACK_SHIFT
> bl BASED(0f)
> l %r14,BASED(.Lcleanup_critical)
> basr %r14,%r14
> - tm 0(%r12),0x01 # retest problem state after cleanup
> + tm 1(%r12),0x01 # retest problem state after cleanup
> bnz BASED(1f)
> 0: l %r14,__LC_ASYNC_STACK # are we already on the async stack ?
> slr %r14,%r15
> -
> To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
> the body of a message to [email protected]
> More majordomo info at http://vger.kernel.org/majordomo-info.html
> Please read the FAQ at http://www.tux.org/lkml/

2005-09-15 19:05:42

by Matthias Urlichs

Subject: Re: [patch] s390: kernel stack corruption.

Hi, Martin Schwidefsky wrote:

> [ mailing list comment ]
> ---
> [ comment for the git commit ]
> [ diffstat ]
> [ patch ]

The two comments should be swapped when submitting patches.

--
Matthias Urlichs | {M:U} IT Design @ m-u-it.de | [email protected]
Disclaimer: The quote was selected randomly. Really. | http://smurf.noris.de
- -
I love dogs, but I hate Chihuahuas. A Chihuahua isn't a dog. It's a rat
with a thyroid problem.

2005-09-16 08:29:09

by Martin Schwidefsky

Subject: Re: [patch] s390: kernel stack corruption.

On Thu, 2005-09-15 at 11:11 -0400, Theodore Ts'o wrote:
> On Thu, Sep 15, 2005 at 04:53:03PM +0200, Martin Schwidefsky wrote:
> > Hi Andrew,
> > Peter discoverd another rather critical bug in entry.S.
> > This should go into 2.6.14 if possible.
>
> This might be a good thing for the 2.6.13.x stable series.

Yes, that would be good.

--
blue skies,
Martin

Martin Schwidefsky
Linux for zSeries Development & Services
IBM Deutschland Entwicklung GmbH