Patch "x86/dumpstack: Fix x86_32 kernel_stack_pointer() previous stack access" has been added to the 4.4-stable tree

This is a note to let you know that I've just added the patch titled

x86/dumpstack: Fix x86_32 kernel_stack_pointer() previous stack access

to the 4.4-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
x86-dumpstack-fix-x86_32-kernel_stack_pointer-previous-stack-access.patch
and it can be found in the queue-4.4 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Josh Poimboeuf <[email protected]>
Date: Thu, 18 Aug 2016 10:59:06 -0500
Subject: x86/dumpstack: Fix x86_32 kernel_stack_pointer() previous stack access

From: Josh Poimboeuf <[email protected]>

commit 72b4f6a5e903b071f2a7c4eb1418cbe4eefdc344 upstream.

On x86_32, when an interrupt happens from kernel space, SS and SP aren't pushed and the existing stack is used. So pt_regs is effectively two words shorter, and the previous stack pointer is normally the memory after the shortened pt_regs, aka '&regs->sp'.

But in the rare case where the interrupt hits right after the stack pointer has been changed to point to an empty stack, like for example when call_on_stack() is used, the address immediately after the shortened pt_regs is no longer on the stack. In that case, instead of '&regs->sp', the previous stack pointer should be retrieved from the beginning of the current stack page.

kernel_stack_pointer() wants to do that, but it forgets to dereference the pointer. So instead of returning a pointer to the previous stack, it returns a pointer to the beginning of the current stack.

Note that it's probably outside of kernel_stack_pointer()'s scope to be switching stacks at all. The x86_64 version of this function doesn't do it, and it would be better for the caller to do it if necessary. But that's a patch for another day. This just fixes the original intent.

---
 arch/x86/kernel/ptrace.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

@@ -188,8 +188,8 @@ unsigned long kernel_stack_pointer(struc
 		return sp;
 
 	prev_esp = (u32 *)(context);
-	if (prev_esp)
-		return (unsigned long)prev_esp;
+	if (*prev_esp)
+		return (unsigned long)*prev_esp;
 
 	return (unsigned long)regs;
 }

Patches currently in stable-queue which might be from [email protected] are

queue-4.4/x86-dumpstack-fix-x86_32-kernel_stack_pointer-previous-stack-access.patch