[kernel] r12556 - in dists/sid/linux-2.6/debian: . patches/bugfix/parisc patches/series
Dann Frazier
dannf at alioth.debian.org
Sat Jan 10 01:01:24 UTC 2009
Author: dannf
Date: Sat Jan 10 01:01:23 2009
New Revision: 12556
Log:
[hppa] Fix system crash while unwinding a userspace process
(CVE-2008-5395)
Added:
dists/sid/linux-2.6/debian/patches/bugfix/parisc/userspace-unwind-crash.patch
Modified:
dists/sid/linux-2.6/debian/changelog
dists/sid/linux-2.6/debian/patches/series/13
Modified: dists/sid/linux-2.6/debian/changelog
==============================================================================
--- dists/sid/linux-2.6/debian/changelog (original)
+++ dists/sid/linux-2.6/debian/changelog Sat Jan 10 01:01:23 2009
@@ -7,6 +7,8 @@
* Fix buffer underflow in the ib700wdt watchdog driver (CVE-2008-5702)
* [sparc] Enable CONFIG_FB_XVR500, CONFIG_FB_XVR2500 (Closes: #508108)
* [ia64] Add RTC class driver for EFI
+ * [hppa] Fix system crash while unwinding a userspace process
+ (CVE-2008-5395)
[ Bastian Blank ]
* Fix multicast in atl1e driver. (closes: #509097)
@@ -35,7 +37,7 @@
- Add missing calls to plat_unmap_dma_mem.
- Only write c0_framemask on CPUs which have this register.
- -- dann frazier <dannf at debian.org> Fri, 09 Jan 2009 16:14:42 -0700
+ -- dann frazier <dannf at debian.org> Fri, 09 Jan 2009 17:59:23 -0700
linux-2.6 (2.6.26-12) unstable; urgency=high
Added: dists/sid/linux-2.6/debian/patches/bugfix/parisc/userspace-unwind-crash.patch
==============================================================================
--- (empty file)
+++ dists/sid/linux-2.6/debian/patches/bugfix/parisc/userspace-unwind-crash.patch Sat Jan 10 01:01:23 2009
@@ -0,0 +1,132 @@
+commit 7a3f5134a8f5bd7fa38b5645eef05e8a4eb62951
+Author: Helge Deller <deller at gmx.de>
+Date: Wed Nov 26 12:46:22 2008 -0800
+
+ parisc: fix kernel crash when unwinding a userspace process
+
+ Any user on existing parisc 32- and 64bit-kernels can easily crash
+ the kernel and as such enforce a DSO.
+ A simple testcase is available here:
+ http://gsyprf10.external.hp.com/~deller/crash.tgz
+
+ The problem is introduced by the fact, that the handle_interruption()
+ crash handler calls the show_regs() function, which in turn tries to
+ unwind the stack by calling parisc_show_stack(). Since the stack contains
+ userspace addresses, a try to unwind the stack is dangerous and useless
+ and leads to the crash.
+
+ The fix is trivial: For userspace processes
+ a) avoid to unwind the stack, and
+ b) avoid to resolve userspace addresses to kernel symbol names.
+
+ While touching this code, I converted print_symbol() to %pS
+ printk formats and made parisc_show_stack() static.
+
+ An initial patch for this was written by Kyle McMartin back in August:
+ http://marc.info/?l=linux-parisc&m=121805168830283&w=2
+
+ Compile and run-tested with a 64bit parisc kernel.
+
+ Signed-off-by: Helge Deller <deller at gmx.de>
+ Cc: Grant Grundler <grundler at parisc-linux.org>
+ Cc: Matthew Wilcox <matthew at wil.cx>
+ Cc: <stable at kernel.org> [2.6.25.x, 2.6.26.x, 2.6.27.x, earlier...]
+ Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
+ Signed-off-by: Kyle McMartin <kyle at mcmartin.ca>
+
+diff --git a/arch/parisc/kernel/traps.c b/arch/parisc/kernel/traps.c
+index 675f1d0..4c771cd 100644
+--- a/arch/parisc/kernel/traps.c
++++ b/arch/parisc/kernel/traps.c
+@@ -24,7 +24,6 @@
+ #include <linux/init.h>
+ #include <linux/interrupt.h>
+ #include <linux/console.h>
+-#include <linux/kallsyms.h>
+ #include <linux/bug.h>
+
+ #include <asm/assembly.h>
+@@ -51,7 +50,7 @@
+ DEFINE_SPINLOCK(pa_dbit_lock);
+ #endif
+
+-void parisc_show_stack(struct task_struct *t, unsigned long *sp,
++static void parisc_show_stack(struct task_struct *task, unsigned long *sp,
+ struct pt_regs *regs);
+
+ static int printbinary(char *buf, unsigned long x, int nbits)
+@@ -121,18 +120,19 @@ static void print_fr(char *level, struct pt_regs *regs)
+
+ void show_regs(struct pt_regs *regs)
+ {
+- int i;
++ int i, user;
+ char *level;
+ unsigned long cr30, cr31;
+
+- level = user_mode(regs) ? KERN_DEBUG : KERN_CRIT;
++ user = user_mode(regs);
++ level = user ? KERN_DEBUG : KERN_CRIT;
+
+ print_gr(level, regs);
+
+ for (i = 0; i < 8; i += 4)
+ PRINTREGS(level, regs->sr, "sr", RFMT, i);
+
+- if (user_mode(regs))
++ if (user)
+ print_fr(level, regs);
+
+ cr30 = mfctl(30);
+@@ -145,14 +145,18 @@ void show_regs(struct pt_regs *regs)
+ printk("%s CPU: %8d CR30: " RFMT " CR31: " RFMT "\n",
+ level, current_thread_info()->cpu, cr30, cr31);
+ printk("%s ORIG_R28: " RFMT "\n", level, regs->orig_r28);
+- printk(level);
+- print_symbol(" IAOQ[0]: %s\n", regs->iaoq[0]);
+- printk(level);
+- print_symbol(" IAOQ[1]: %s\n", regs->iaoq[1]);
+- printk(level);
+- print_symbol(" RP(r2): %s\n", regs->gr[2]);
+-
+- parisc_show_stack(current, NULL, regs);
++
++ if (user) {
++ printk("%s IAOQ[0]: " RFMT "\n", level, regs->iaoq[0]);
++ printk("%s IAOQ[1]: " RFMT "\n", level, regs->iaoq[1]);
++ printk("%s RP(r2): " RFMT "\n", level, regs->gr[2]);
++ } else {
++ printk("%s IAOQ[0]: %pS\n", level, (void *) regs->iaoq[0]);
++ printk("%s IAOQ[1]: %pS\n", level, (void *) regs->iaoq[1]);
++ printk("%s RP(r2): %pS\n", level, (void *) regs->gr[2]);
++
++ parisc_show_stack(current, NULL, regs);
++ }
+ }
+
+
+@@ -173,20 +177,15 @@ static void do_show_stack(struct unwind_frame_info *info)
+ break;
+
+ if (__kernel_text_address(info->ip)) {
+- printk("%s [<" RFMT ">] ", (i&0x3)==1 ? KERN_CRIT : "", info->ip);
+-#ifdef CONFIG_KALLSYMS
+- print_symbol("%s\n", info->ip);
+-#else
+- if ((i & 0x03) == 0)
+- printk("\n");
+-#endif
++ printk(KERN_CRIT " [<" RFMT ">] %pS\n",
++ info->ip, (void *) info->ip);
+ i++;
+ }
+ }
+- printk("\n");
++ printk(KERN_CRIT "\n");
+ }
+
+-void parisc_show_stack(struct task_struct *task, unsigned long *sp,
++static void parisc_show_stack(struct task_struct *task, unsigned long *sp,
+ struct pt_regs *regs)
+ {
+ struct unwind_frame_info info;
Modified: dists/sid/linux-2.6/debian/patches/series/13
==============================================================================
--- dists/sid/linux-2.6/debian/patches/series/13 (original)
+++ dists/sid/linux-2.6/debian/patches/series/13 Sat Jan 10 01:01:23 2009
@@ -19,3 +19,4 @@
+ bugfix/mips/add-missing-plat_unmap_dma_mem.patch
+ bugfix/mips/write-c0_framemask-only-when-supported.patch
+ bugfix/ia64/add-efi-rtc-class-driver.patch
++ bugfix/parisc/userspace-unwind-crash.patch
More information about the Kernel-svn-changes
mailing list