x86: fix free_thread_info() with uninitalized thread_info
Get series with b4
b4 am [email protected]Versions newest first
- v1 Latest4 patches 0 repliesNew
Patches in v1 No applies recorded yet
| # | Subject and files | Size | Replies | Applied |
|---|---|---|---|---|
| 1/4 | convert task_struct allocator macros to inline functionskernel/ | +12 | 0 replies | |
| 2/4 | x86: arch specific task_struct allocatorarch/ arch/ | +22 | 0 replies | |
| 3/4 | x86: call free_thread_xstate() in free_task_struct()arch/ | +1 | 0 replies | |
| 4/4 | x86: use generic thread_info allocatorarch/ arch/ arch/ +1 more | +5 | 0 replies |
Reviews trailers per patch
No Reviewed-by, Acked-by or Tested-by trailers for v1 yet.
Cover letter [PATCH 0/4] x86: fix free_thread_info() with uninitalized thread_info
This patch series fixes a problem described below. The actual fix is only made by the patch 3/4. The rest of patches help it make simple and there is no actual behavioral change.
x86 arch specific free_thread_info() accesses thread_info->task to call free_thread_xstate(). But the thread_info may not be initialized yet. So invalid pointer derefence may happen in free_thread_xstate().
It happens in the following scenario in dup_task_struct()
1. call alloc_task_struct() to allocate empty task_struct
2. call alloc_thread_info() to allocate empty thread_info
3. call arch_dup_task_struct()
x86 arch specific arch_dup_task_struct() copies task_struct from source task_struct. it also allocates empty xstate and copy from source if source task_struct has ->thread.xstate.
If the xstate allocation failed, arch_dup_task_struct() returns error.
4. call free_thread_info() to deallocate thread_info
x86 arch specific free_thread_info() calls free_thread_xstate() with thread_info->task. But the thread_info is not initialized yet.