On Fri, 2018-10-05 at 13:21:23 UTC, Michael Ellerman wrote:
> Recently we implemented show_user_instructions() which dumps the code
> around the NIP when a user space process dies with an unhandled
> signal. This was modelled on the x86 code, and we even went so far as
> to implement the exact same bug, namely that if the user process
> crashed with its NIP pointing into the kernel we will dump kernel text
> to dmesg. eg:
>
> bad-bctr[2996]: segfault (11) at c000000000010000 nip c000000000010000 lr
> 12d0b0894 code 1
> bad-bctr[2996]: code: fbe10068 7cbe2b78 7c7f1b78 fb610048 38a10028 38810020
> fb810050 7f8802a6
> bad-bctr[2996]: code: 3860001c f8010080 48242371 60000000 <7c7b1b79>
> 4082002c e8010080 eb610048
>
> This was discovered on x86 by Jann Horn and fixed in commit
> 342db04ae712 ("x86/dumpstack: Don't dump kernel memory based on usermode
> RIP").
>
> Fix it by checking the adjusted NIP value (pc) and number of
> instructions against USER_DS, and bail if we fail the check, eg:
>
> bad-bctr[2969]: segfault (11) at c000000000010000 nip c000000000010000 lr
> 107930894 code 1
> bad-bctr[2969]: Bad NIP, not dumping instructions.
>
> Fixes: 88b0fe175735 ("powerpc: Add show_user_instructions()")
> Signed-off-by: Michael Ellerman <m...@ellerman.id.au>
> Reviewed-by: Christophe Leroy <christophe.le...@c-s.fr>
> Reviewed-by: Murilo Opsfelder Araujo <muri...@linux.ibm.com>
Applied to powerpc fixes.
https://git.kernel.org/powerpc/c/a932ed3b718147c6537da290b7a91e
cheers
