Commit 84667d48 authored by Jason Wessel's avatar Jason Wessel

kgdb: Read buffer overflow

Roel Kluin reported an error found with Parfait.  Where we want to
ensure that that kgdb_info[-1] never gets accessed.

Also check to ensure any negative tid does not exceed the size of the
shadow CPU array, else report critical debug context because it is an
internal kgdb failure.
Reported-by: default avatarRoel Kluin <roel.kluin@gmail.com>
Signed-off-by: default avatarJason Wessel <jason.wessel@windriver.com>
parent a5d09d68
...@@ -541,12 +541,17 @@ static struct task_struct *getthread(struct pt_regs *regs, int tid) ...@@ -541,12 +541,17 @@ static struct task_struct *getthread(struct pt_regs *regs, int tid)
*/ */
if (tid == 0 || tid == -1) if (tid == 0 || tid == -1)
tid = -atomic_read(&kgdb_active) - 2; tid = -atomic_read(&kgdb_active) - 2;
if (tid < 0) { if (tid < -1 && tid > -NR_CPUS - 2) {
if (kgdb_info[-tid - 2].task) if (kgdb_info[-tid - 2].task)
return kgdb_info[-tid - 2].task; return kgdb_info[-tid - 2].task;
else else
return idle_task(-tid - 2); return idle_task(-tid - 2);
} }
if (tid <= 0) {
printk(KERN_ERR "KGDB: Internal thread select error\n");
dump_stack();
return NULL;
}
/* /*
* find_task_by_pid_ns() does not take the tasklist lock anymore * find_task_by_pid_ns() does not take the tasklist lock anymore
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment