sched: panic on corrupted stack end

Orabug: 24971905
CVE: CVE-2016-1583

Until now, hitting this BUG_ON caused a recursive oops (because oops
handling involves do_exit(), which calls into the scheduler, which in
turn raises an oops), which caused stuff below the stack to be
overwritten until a panic happened (e.g.  via an oops in interrupt
context, caused by the overwritten CPU index in the thread_info).

Just panic directly.

Signed-off-by: Jann Horn <jannh@google.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
(cherry picked from commit 29d6455178a09e1dc340380c582b13356227e8df)
Signed-off-by: Brian Maly <brian.maly@oracle.com>
Conflicts:
	kernel/sched/core.c

diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index 02e1ce1f0039d51b1fa4dbf15bfe7784ea9857a8..7bc35a8f0a69d571155b60fcac4504d1c9988ab4 100644 (file)
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -2634,7 +2634,8 @@ static noinline void __schedule_bug(struct task_struct *prev)
 static inline void schedule_debug(struct task_struct *prev)
 {
 #ifdef CONFIG_SCHED_STACK_END_CHECK
-       BUG_ON(unlikely(task_stack_end_corrupted(prev)));
+       if (task_stack_end_corrupted(prev))
+               panic("corrupted stack end detected inside scheduler\n");
 #endif
        /*
         * Test if we are atomic. Since do_exit() needs to call into