lisa/android_kernel_xiaomi_sm8350
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

lib/stackdepot.c: fix global out-of-bounds in stack_slabs

Browse Source 
commit 305e519ce48e935702c32241f07d393c3c8fed3e upstream.

Walter Wu has reported a potential case in which init_stack_slab() is
called after stack_slabs[STACK_ALLOC_MAX_SLABS - 1] has already been
initialized.  In that case init_stack_slab() will overwrite
stack_slabs[STACK_ALLOC_MAX_SLABS], which may result in a memory
corruption.

Link: http://lkml.kernel.org/r/20200218102950.260263-1-glider@google.com
Fixes: cd11016e5f ("mm, kasan: stackdepot implementation. Enable stackdepot for SLAB")
Signed-off-by: Alexander Potapenko <glider@google.com>
Reported-by: Walter Wu <walter-zh.wu@mediatek.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Matthias Brugger <matthias.bgg@gmail.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Josh Poimboeuf <jpoimboe@redhat.com>
Cc: Kate Stewart <kstewart@linuxfoundation.org>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Alexander Potapenko 2020-02-20 20:04:30 -08:00 committed by Greg Kroah-Hartman
parent ef32399bf7
commit 9bb971b335
1 changed files with 6 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
lib/stackdepot.c
View File

@ -83,15 +83,19 @@ static bool init_stack_slab(void **prealloc)
return true; return true;
if (stack_slabs[depot_index] == NULL) { if (stack_slabs[depot_index] == NULL) {
stack_slabs[depot_index] = *prealloc; stack_slabs[depot_index] = *prealloc;
*prealloc = NULL;
} else { } else {
stack_slabs[depot_index + 1] = *prealloc; /* If this is the last depot slab, do not touch the next one. */
if (depot_index + 1 < STACK_ALLOC_MAX_SLABS) {
stack_slabs[depot_index + 1] = *prealloc;
*prealloc = NULL;
}
/* /*
* This smp_store_release pairs with smp_load_acquire() from * This smp_store_release pairs with smp_load_acquire() from
* |next_slab_inited| above and in stack_depot_save(). * |next_slab_inited| above and in stack_depot_save().
*/ */
smp_store_release(&next_slab_inited, 1); smp_store_release(&next_slab_inited, 1);
} }
*prealloc = NULL;
return true; return true;
} }