Re: [PATCH] s390/syscalls: Fix out of bounds arguments access

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Thu, 29 Jun 2017 11:38:11 +0200
Jiri Olsa <jolsa@xxxxxxxxxx> wrote:

> Zorro reported following crash while having enabled
> syscall tracing (CONFIG_FTRACE_SYSCALLS):
> 
>   Unable to handle kernel pointer dereference at virtual ...
>   Oops: 0011 [#1] SMP DEBUG_PAGEALLOC
> 
>   SNIP
> 
>   Call Trace:
>   ([<000000000024d79c>] ftrace_syscall_enter+0xec/0x1d8)
>    [<00000000001099c6>] do_syscall_trace_enter+0x236/0x2f8
>    [<0000000000730f1c>] sysc_tracesys+0x1a/0x32
>    [<000003fffcf946a2>] 0x3fffcf946a2
>   INFO: lockdep is turned off.
>   Last Breaking-Event-Address:
>    [<000000000022dd44>] rb_event_data+0x34/0x40
>   ---[ end trace 8c795f86b1b3f7b9 ]---
> 
> The crash happens in syscall_get_arguments function for
> syscalls with zero arguments, that will try to access
> first argument (args[0]) in event entry, but it's not
> allocated.
> 
> Bail out of there are no arguments.
> 
> Reported-by: Zorro Lang <zlang@xxxxxxxxxx>
> Signed-off-by: Jiri Olsa <jolsa@xxxxxxxxxx>
> ---
>  arch/s390/include/asm/syscall.h | 10 +++++++++-
>  1 file changed, 9 insertions(+), 1 deletion(-)

There are callers of syscall_get_arguments with n=0. And it makes
sense to check for this case in the function instead of forcing all
callers to check for it.
 
> diff --git a/arch/s390/include/asm/syscall.h b/arch/s390/include/asm/syscall.h
> index 6ba0bf928909..5f7c11c932fa 100644
> --- a/arch/s390/include/asm/syscall.h
> +++ b/arch/s390/include/asm/syscall.h
> @@ -64,14 +64,22 @@ static inline void syscall_get_arguments(struct task_struct *task,
>  {
>  	unsigned long mask = -1UL;
> 
> +	/*
> +	 * No arguments for this syscall, there's nothing to do.
> +	 */
> +	if (!n)
> +		return;
> +
>  	BUG_ON(i + n > 6);

So yes, for this part of the patch.

>  #ifdef CONFIG_COMPAT
>  	if (test_tsk_thread_flag(task, TIF_31BIT))
>  		mask = 0xffffffff;
>  #endif
> -	while (n-- > 0)
> +	while (n-- > 0) {
>  		if (i + n > 0)
>  			args[n] = regs->gprs[2 + i + n] & mask;
> +	}
> +
>  	if (i == 0)
>  		args[0] = regs->orig_gpr2 & mask;
>  }

But why the unrelated whitespace damage with the additional { } ?

-- 
blue skies,
   Martin.

"Reality continues to ruin my life." - Calvin.

--
To unsubscribe from this list: send the line "unsubscribe linux-s390" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html



[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Kernel Development]     [Kernel Newbies]     [IDE]     [Security]     [Git]     [Netfilter]     [Bugtraq]     [Yosemite Info]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux RAID]     [Linux ATA RAID]     [Samba]     [Linux Media]     [Device Mapper]

  Powered by Linux