lkml.org 
[lkml]   [2013]   [Sep]   [27]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
Date
SubjectRe: [PATCH] Out-of-bounds access in get_wchan (arch/x86/kernel/process_64.c)
On Fri, Sep 13, 2013 at 3:03 AM, Wolfram Gloger
<wmglo@dent.med.uni-muenchen.de> wrote:
> "H. Peter Anvin" <hpa@zytor.com> writes:
>
>> Actually, the sanest would be:
>>
>> if (fp < (unsigned long)stack ||
>> fp >= (unsigned long)stack+(THREAD_SIZE-16))
>>
>> ... wouldn't it (since we are accessing an 8-byte datum at offset +8?
>
> Ok, splitting hairs maybe, what about this V2 of the patch?
>
> fp is under userspace control. stack-8 cannot underflow, otherwise we'd
> have much more serious problems in kernel space.
>
> Hence, for dereferencing fp+8:
>
> The case fp == stack-8 is valid.
> As is the case fp == stack+(THREAD_SIZE-16).
> Everything outside is invalid.
>
> About the worst-case implications: Like I said I have not reproduced it
> and cannot really comment on that.


+kees@, linux-kernel@


\
 
 \ /
  Last update: 2013-09-27 22:01    [W:0.040 / U:0.064 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site