+ bug-exclude-non-bug-warn-exceptions-from-report_bug.patch added to -mm tree

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



The patch titled
     Subject: lib/bug.c: exclude non-BUG/WARN exceptions from report_bug()
has been added to the -mm tree.  Its filename is
     bug-exclude-non-bug-warn-exceptions-from-report_bug.patch

This patch should soon appear at
    http://ozlabs.org/~akpm/mmots/broken-out/bug-exclude-non-bug-warn-exceptions-from-report_bug.patch
and later at
    http://ozlabs.org/~akpm/mmotm/broken-out/bug-exclude-non-bug-warn-exceptions-from-report_bug.patch

Before you just go and hit "reply", please:
   a) Consider who else should be cc'ed
   b) Prefer to cc a suitable mailing list as well
   c) Ideally: find the original patch on the mailing list and do a
      reply-to-all to that, adding suitable additional cc's

*** Remember to use Documentation/SubmitChecklist when testing your code ***

The -mm tree is included into linux-next and is updated
there every 3-4 working days

------------------------------------------------------
From: Kees Cook <keescook@xxxxxxxxxxxx>
Subject: lib/bug.c: exclude non-BUG/WARN exceptions from report_bug()

b8347c219649 ("x86/debug: Handle warnings before the notifier chain, to
fix KGDB crash") changed the ordering of fixups, and did not take into
account the case of x86 processing non-WARN() and non-BUG() exceptions. 
This would lead to output of a false BUG line with no other information. 
In the case of a refcount exception, it would be immediately followed by
the refcount WARN(), producing very strange double-"cut here":

lkdtm: attempting bad refcount_inc() overflow
------------[ cut here ]------------
Kernel BUG at 0000000065f29de5 [verbose debug info unavailable]
------------[ cut here ]------------
refcount_t overflow at lkdtm_REFCOUNT_INC_OVERFLOW+0x6b/0x90 in cat[3065], uid/euid: 0/0
WARNING: CPU: 0 PID: 3065 at kernel/panic.c:657 refcount_error_report+0x9a/0xa4
...

In the prior ordering, exceptions were searched first:

 do_trap_no_signal(struct task_struct *tsk, int trapnr, char *str,
 ...
                if (fixup_exception(regs, trapnr))
                        return 0;

-               if (fixup_bug(regs, trapnr))
-                       return 0;
-

As a result, fixup_bugs()'s is_valid_bugaddr() didn't take into account
needing to search the exception list first, since that had already
happened.

So, instead of searching the exception list twice (once in
is_valid_bugaddr() and then again in fixup_exception()), just add a simple
sanity check to report_bug() that will immediately bail out if a BUG() (or
WARN()) entry is not found.

Link: http://lkml.kernel.org/r/20180301225934.GA34350@beast
Fixes: b8347c219649 ("x86/debug: Handle warnings before the notifier chain, to fix KGDB crash")
Signed-off-by: Kees Cook <keescook@xxxxxxxxxxxx>
Cc: Ingo Molnar <mingo@xxxxxxxxxx>
Cc: Thomas Gleixner <tglx@xxxxxxxxxxxxx>
Cc: Peter Zijlstra <peterz@xxxxxxxxxxxxx>
Cc: Borislav Petkov <bp@xxxxxxxxx>
Cc: Richard Weinberger <richard.weinberger@xxxxxxxxx>
Cc: <stable@xxxxxxxxxxxxxxx>
Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
---

 lib/bug.c |    2 ++
 1 file changed, 2 insertions(+)

diff -puN lib/bug.c~bug-exclude-non-bug-warn-exceptions-from-report_bug lib/bug.c
--- a/lib/bug.c~bug-exclude-non-bug-warn-exceptions-from-report_bug
+++ a/lib/bug.c
@@ -150,6 +150,8 @@ enum bug_trap_type report_bug(unsigned l
 		return BUG_TRAP_TYPE_NONE;
 
 	bug = find_bug(bugaddr);
+	if (!bug)
+		return BUG_TRAP_TYPE_NONE;
 
 	file = NULL;
 	line = 0;
_

Patches currently in -mm which might be from keescook@xxxxxxxxxxxx are

bug-use-%pb-in-bug-and-stack-protector-failure.patch
bug-exclude-non-bug-warn-exceptions-from-report_bug.patch
taint-convert-to-indexed-initialization.patch
taint-consolidate-documentation.patch
taint-add-taint-for-randstruct.patch
fork-unconditionally-clear-stack-on-fork.patch
exec-pass-stack-rlimit-into-mm-layout-functions.patch
exec-introduce-finalize_exec-before-start_thread.patch
exec-pin-stack-limit-during-exec.patch

--
To unsubscribe from this list: send the line "unsubscribe mm-commits" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html



[Index of Archives]     [Kernel Archive]     [IETF Annouce]     [DCCP]     [Netdev]     [Networking]     [Security]     [Bugtraq]     [Yosemite]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux RAID]     [Linux SCSI]

  Powered by Linux