This is a note to let you know that I've just added the patch titled
lib/stackdepot: off by one in depot_fetch_stack()
to the 6.8-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
lib-stackdepot-off-by-one-in-depot_fetch_stack.patch
and it can be found in the queue-6.8 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
commit c636e21dfe98b513dbade2b1c231a0a2c3a4127d
Author: Dan Carpenter <dan.carpenter@xxxxxxxxxx>
Date: Fri Feb 23 17:20:13 2024 +0300
lib/stackdepot: off by one in depot_fetch_stack()
[ Upstream commit dc24559472a682eb124e869cb110e7a2fd857322 ]
The stack_pools[] array has DEPOT_MAX_POOLS. The "pools_num" tracks the
number of pools which are initialized. See depot_init_pool() for more
details.
If pool_index == pools_num_cached, this will read one element beyond what
we want. If not all the pools are initialized, then the pool will be
NULL, triggering a WARN(), and if they are all initialized it will read
one element beyond the end of the array.
Link: https://lkml.kernel.org/r/361ac881-60b7-471f-91e5-5bf8fe8042b2@moroto.mountain
Fixes: b29d31885814 ("lib/stackdepot: store free stack records in a freelist")
Signed-off-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx>
Cc: Alexander Potapenko <glider@xxxxxxxxxx>
Cc: Andrey Konovalov <andreyknvl@xxxxxxxxx>
Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>
diff --git a/lib/stackdepot.c b/lib/stackdepot.c
index c043a4186bc59..c1ec2b4b6dabf 100644
--- a/lib/stackdepot.c
+++ b/lib/stackdepot.c
@@ -490,7 +490,7 @@ static struct stack_record *depot_fetch_stack(depot_stack_handle_t handle)
lockdep_assert_not_held(&pool_lock);
- if (pool_index > pools_num_cached) {
+ if (pool_index >= pools_num_cached) {
WARN(1, "pool index %d out of bounds (%d) for stack id %08x\n",
pool_index, pools_num_cached, handle);
return NULL;
