Skip to contentSkip to conversation

FAILED: patch "[PATCH] lib/stackdepot.c: fix global out-of-bounds in stack_slabs" failed to apply to 4.19-stable tree

PATCH [email protected] 3 participants 3 messages Feb 26, 2020 – Feb 27, 2020

Subsystems (2)
Stable branch Library code
lore
Share & tools
lore

[email protected]

author maintainer
#0 lore raw

The patch below does not apply to the 4.19-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.

thanks,

greg k-h

------------------ original commit in Linus's tree ------------------

From 305e519ce48e935702c32241f07d393c3c8fed3e Mon Sep 17 00:00:00 2001
From: Alexander Potapenko <[email protected]>
Date: Thu, 20 Feb 2020 20:04:30 -0800
Subject: [PATCH] lib/stackdepot.c: fix global out-of-bounds in stack_slabs

Walter Wu has reported a potential case in which init_stack_slab() is called after stack_slabs[STACK_ALLOC_MAX_SLABS - 1] has already been initialized. In that case init_stack_slab() will overwrite stack_slabs[STACK_ALLOC_MAX_SLABS], which may result in a memory corruption.

Link http://lkml.kernel.org/r/[email protected] open here
Fixes cd11016e5f521 ("mm, kasan: stackdepot implementation. Enable stackdepot for SLAB")
Signed-off-by Alexander Potapenko <[email protected]>
Reported-by Walter Wu <[email protected]>
Cc Dmitry Vyukov <[email protected]>
Cc Matthias Brugger <[email protected]>
Cc Thomas Gleixner <[email protected]>
Cc Josh Poimboeuf <[email protected]>
Cc Kate Stewart <[email protected]>
Cc Greg Kroah-Hartman <[email protected]>
Cc <[email protected]>
Signed-off-by Andrew Morton <[email protected]>
Signed-off-by Linus Torvalds <[email protected]>
lib/stackdepot.c +6 -2
index ed717dd08ff3..81c69c08d1d1 100644
@@ -83,15 +83,19 @@ static bool init_stack_slab(void **prealloc)
 		return true;
 	if (stack_slabs[depot_index] == NULL) {
 		stack_slabs[depot_index] = *prealloc;
+		*prealloc = NULL;
 	} else {
-		stack_slabs[depot_index + 1] = *prealloc;
+		/* If this is the last depot slab, do not touch the next one. */
+		if (depot_index + 1 < STACK_ALLOC_MAX_SLABS) {
+			stack_slabs[depot_index + 1] = *prealloc;
+			*prealloc = NULL;
+		}
 		/*
 		 * This smp_store_release pairs with smp_load_acquire() from
 		 * |next_slab_inited| above and in stack_depot_save().
 		 */
 		smp_store_release(&next_slab_inited, 1);
 	}
-	*prealloc = NULL;
 	return true;
 }
maintainer
#1 lore raw
Quoted 23 lines · On Wed, Feb 26, 2020 at 11:49:42AM +0100, [email protected] wrote:

The patch below does not apply to the 4.19-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.

thanks,

greg k-h

------------------ original commit in Linus's tree ------------------

From 305e519ce48e935702c32241f07d393c3c8fed3e Mon Sep 17 00:00:00 2001
From: Alexander Potapenko <[email protected]>
Date: Thu, 20 Feb 2020 20:04:30 -0800
Subject: [PATCH] lib/stackdepot.c: fix global out-of-bounds in stack_slabs

Walter Wu has reported a potential case in which init_stack_slab() is called after stack_slabs[STACK_ALLOC_MAX_SLABS - 1] has already been initialized. In that case init_stack_slab() will overwrite stack_slabs[STACK_ALLOC_MAX_SLABS], which may result in a memory corruption.

Quoted 13 lines
Link http://lkml.kernel.org/r/[email protected] open here
Fixes cd11016e5f521 ("mm, kasan: stackdepot implementation. Enable stackdepot for SLAB")
Signed-off-by Alexander Potapenko <[email protected]>
Reported-by Walter Wu <[email protected]>
Cc Dmitry Vyukov <[email protected]>
Cc Matthias Brugger <[email protected]>
Cc Thomas Gleixner <[email protected]>
Cc Josh Poimboeuf <[email protected]>
Cc Kate Stewart <[email protected]>
Cc Greg Kroah-Hartman <[email protected]>
Cc <[email protected]>
Signed-off-by Andrew Morton <[email protected]>
Signed-off-by Linus Torvalds <[email protected]>

I've grabbed ee050dc83bc3 ("lib/stackdepot: Fix outdated comments") as a dependency and queued for 4.19-4.9.

Technically the comment change is wrong as the commit it addresses is older, but no one should be coding against the stable tree, and doing it by changing 305e519ce48e would cause merge conflicts in the future.

Signature · 2 lines
Thanks,
Sasha
#2 lore raw
Quoted 39 lines · Sasha Levin
Quoted 23 lines · On Wed, Feb 26, 2020 at 11:49:42AM +0100, [email protected] wrote:

The patch below does not apply to the 4.19-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.

thanks,

greg k-h

------------------ original commit in Linus's tree ------------------

From 305e519ce48e935702c32241f07d393c3c8fed3e Mon Sep 17 00:00:00 2001
From: Alexander Potapenko <[email protected]>
Date: Thu, 20 Feb 2020 20:04:30 -0800
Subject: [PATCH] lib/stackdepot.c: fix global out-of-bounds in stack_slabs

Walter Wu has reported a potential case in which init_stack_slab() is called after stack_slabs[STACK_ALLOC_MAX_SLABS - 1] has already been initialized. In that case init_stack_slab() will overwrite stack_slabs[STACK_ALLOC_MAX_SLABS], which may result in a memory corruption.

Quoted 13 lines
Link http://lkml.kernel.org/r/[email protected] open here
Fixes cd11016e5f521 ("mm, kasan: stackdepot implementation. Enable stackdepot for SLAB")
Signed-off-by Alexander Potapenko <[email protected]>
Reported-by Walter Wu <[email protected]>
Cc Dmitry Vyukov <[email protected]>
Cc Matthias Brugger <[email protected]>
Cc Thomas Gleixner <[email protected]>
Cc Josh Poimboeuf <[email protected]>
Cc Kate Stewart <[email protected]>
Cc Greg Kroah-Hartman <[email protected]>
Cc <[email protected]>
Signed-off-by Andrew Morton <[email protected]>
Signed-off-by Linus Torvalds <[email protected]>
Quoted 2 lines

I've grabbed ee050dc83bc3 ("lib/stackdepot: Fix outdated comments") as a dependency and queued for 4.19-4.9.

Thanks a lot!