From: Jann Horn Date: Wed, 1 Jun 2016 09:55:07 +0000 (+0200) Subject: sched: panic on corrupted stack end X-Git-Tag: v4.1.12-92~47^2 X-Git-Url: https://www.infradead.org/git/?a=commitdiff_plain;h=ab28a641ff295a9875349b57913bb0e76fab4557;p=users%2Fjedix%2Flinux-maple.git sched: panic on corrupted stack end Orabug: 24971905 CVE: CVE-2016-1583 Until now, hitting this BUG_ON caused a recursive oops (because oops handling involves do_exit(), which calls into the scheduler, which in turn raises an oops), which caused stuff below the stack to be overwritten until a panic happened (e.g. via an oops in interrupt context, caused by the overwritten CPU index in the thread_info). Just panic directly. Signed-off-by: Jann Horn Signed-off-by: Linus Torvalds (cherry picked from commit 29d6455178a09e1dc340380c582b13356227e8df) Signed-off-by: Brian Maly Conflicts: kernel/sched/core.c --- diff --git a/kernel/sched/core.c b/kernel/sched/core.c index 02e1ce1f0039..7bc35a8f0a69 100644 --- a/kernel/sched/core.c +++ b/kernel/sched/core.c @@ -2634,7 +2634,8 @@ static noinline void __schedule_bug(struct task_struct *prev) static inline void schedule_debug(struct task_struct *prev) { #ifdef CONFIG_SCHED_STACK_END_CHECK - BUG_ON(unlikely(task_stack_end_corrupted(prev))); + if (task_stack_end_corrupted(prev)) + panic("corrupted stack end detected inside scheduler\n"); #endif /* * Test if we are atomic. Since do_exit() needs to call into