diff options
| author | Alexander Potapenko <glider@google.com> | 2020-03-04 22:31:41 +1100 |
|---|---|---|
| committer | Stephen Rothwell <sfr@canb.auug.org.au> | 2020-03-07 13:02:45 +1100 |
| commit | d45048e65a591158f11ad919b96e7f13b356abbc (patch) | |
| tree | da14c6549f8309753653602f5365ffe1ad9d14f3 | |
| parent | 9a8cc92790cafdf2a3ccd274740f1e60346f17b8 (diff) | |
| download | net-next-d45048e65a59.tar.gz | |
lib/stackdepot.c: check depot_index before accessing the stack slab
Notice: this object is not reachable from any branch.
Avoid crashes on corrupted stack ids. Despite stack ID corruption may
indicate other bugs in the program, we'd better fail gracefully on such
IDs instead of crashing the kernel.
This patch has been previously mailed as part of KMSAN RFC patch series.
Link: http://lkml.kernel.org/r/20200220141916.55455-1-glider@google.com
Signed-off-by: Alexander Potapenko <glider@google.com>
Cc: Vegard Nossum <vegard.nossum@oracle.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Marco Elver <elver@google.com>
Cc: Andrey Konovalov <andreyknvl@google.com>
Cc: Andrey Ryabinin <aryabinin@virtuozzo.com>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Stephen Rothwell <sfr@canb.auug.org.au>
Notice: this object is not reachable from any branch.
| -rw-r--r-- | lib/stackdepot.c | 17 |
1 files changed, 15 insertions, 2 deletions
diff --git a/lib/stackdepot.c b/lib/stackdepot.c index 81c69c08d1d157..a2f6cb900db807 100644 --- a/lib/stackdepot.c +++ b/lib/stackdepot.c @@ -202,9 +202,22 @@ unsigned int stack_depot_fetch(depot_stack_handle_t handle, unsigned long **entries) { union handle_parts parts = { .handle = handle }; - void *slab = stack_slabs[parts.slabindex]; + void *slab; size_t offset = parts.offset << STACK_ALLOC_ALIGN; - struct stack_record *stack = slab + offset; + struct stack_record *stack; + + if (parts.slabindex > depot_index) { + WARN(1, "slab index %d out of bounds (%d) for stack id %08x\n", + parts.slabindex, depot_index, handle); + *entries = NULL; + return 0; + } + slab = stack_slabs[parts.slabindex]; + stack = slab + offset; + if (!stack) { + *entries = NULL; + return 0; + } *entries = stack->entries; return stack->size; |