Messages in this thread | | | From | Dmitry Vyukov <> | Date | Fri, 27 Sep 2013 12:34:30 -0700 | Subject | Re: [PATCH] Out-of-bounds access in get_wchan (arch/x86/kernel/process_64.c) |
| |
On Fri, Sep 13, 2013 at 3:03 AM, Wolfram Gloger <wmglo@dent.med.uni-muenchen.de> wrote: > "H. Peter Anvin" <hpa@zytor.com> writes: > >> Actually, the sanest would be: >> >> if (fp < (unsigned long)stack || >> fp >= (unsigned long)stack+(THREAD_SIZE-16)) >> >> ... wouldn't it (since we are accessing an 8-byte datum at offset +8? > > Ok, splitting hairs maybe, what about this V2 of the patch? > > fp is under userspace control. stack-8 cannot underflow, otherwise we'd > have much more serious problems in kernel space. > > Hence, for dereferencing fp+8: > > The case fp == stack-8 is valid. > As is the case fp == stack+(THREAD_SIZE-16). > Everything outside is invalid. > > About the worst-case implications: Like I said I have not reproduced it > and cannot really comment on that.
+kees@, linux-kernel@
| |