[lkml]   [2018]   [Mar]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    Patch in this message
    Subject[PATCH 4.15 047/146] lib/bug.c: exclude non-BUG/WARN exceptions from report_bug()
    4.15-stable review patch.  If anyone has any objections, please let me know.


    From: Kees Cook <>

    commit 1b4cfe3c0a30dde968fb43c577a8d7e262a145ee upstream.

    Commit b8347c219649 ("x86/debug: Handle warnings before the notifier
    chain, to fix KGDB crash") changed the ordering of fixups, and did not
    take into account the case of x86 processing non-WARN() and non-BUG()
    exceptions. This would lead to output of a false BUG line with no other

    In the case of a refcount exception, it would be immediately followed by
    the refcount WARN(), producing very strange double-"cut here":

    lkdtm: attempting bad refcount_inc() overflow
    ------------[ cut here ]------------
    Kernel BUG at 0000000065f29de5 [verbose debug info unavailable]
    ------------[ cut here ]------------
    refcount_t overflow at lkdtm_REFCOUNT_INC_OVERFLOW+0x6b/0x90 in cat[3065], uid/euid: 0/0
    WARNING: CPU: 0 PID: 3065 at kernel/panic.c:657 refcount_error_report+0x9a/0xa4

    In the prior ordering, exceptions were searched first:

    do_trap_no_signal(struct task_struct *tsk, int trapnr, char *str,
    if (fixup_exception(regs, trapnr))
    return 0;

    - if (fixup_bug(regs, trapnr))
    - return 0;

    As a result, fixup_bugs()'s is_valid_bugaddr() didn't take into account
    needing to search the exception list first, since that had already

    So, instead of searching the exception list twice (once in
    is_valid_bugaddr() and then again in fixup_exception()), just add a
    simple sanity check to report_bug() that will immediately bail out if a
    BUG() (or WARN()) entry is not found.

    Fixes: b8347c219649 ("x86/debug: Handle warnings before the notifier chain, to fix KGDB crash")
    Signed-off-by: Kees Cook <>
    Cc: Ingo Molnar <>
    Cc: Thomas Gleixner <>
    Cc: Peter Zijlstra <>
    Cc: Borislav Petkov <>
    Cc: Richard Weinberger <>
    Cc: <>
    Signed-off-by: Andrew Morton <>
    Signed-off-by: Linus Torvalds <>
    Signed-off-by: Greg Kroah-Hartman <>

    lib/bug.c | 2 ++
    1 file changed, 2 insertions(+)

    --- a/lib/bug.c
    +++ b/lib/bug.c
    @@ -150,6 +150,8 @@ enum bug_trap_type report_bug(unsigned l
    return BUG_TRAP_TYPE_NONE;

    bug = find_bug(bugaddr);
    + if (!bug)
    + return BUG_TRAP_TYPE_NONE;

    file = NULL;
    line = 0;

     \ /
      Last update: 2018-03-13 17:54    [W:14.416 / U:0.008 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site