On Wed, Dec 11, 2019 at 12:43:37PM +1100, Daniel Axtens wrote:
> If a process page-faults trying to write beyond the end of its
> stack, we attempt to grow the stack.
>
> However, if the kernel attempts to write beyond the end of a
> process's stack, it takes a bad fault. This can occur when the
> kernel is trying to set up a signal frame.
>
> Permit the kernel to grow a process's stack. The same general
> limits as to how and when the stack can be grown apply: the kernel
> code still passes through expand_stack(), so anything that goes
> beyond e.g. the rlimit should still be blocked.
>
> Link: https://bugzilla.kernel.org/show_bug.cgi?id=205183
Fixes: 14cf11af6cf6 ("powerpc: Merge enough to start building in
arch/powerpc.")
> Reported-by: Tom Lane <t...@sss.pgh.pa.us>
> Cc: Daniel Black <dan...@linux.ibm.com>
> Signed-off-by: Daniel Axtens <d...@axtens.net>
> ---
> arch/powerpc/mm/fault.c | 10 ++++++++++
> 1 file changed, 10 insertions(+)
>
> diff --git a/arch/powerpc/mm/fault.c b/arch/powerpc/mm/fault.c
> index b5047f9b5dec..00183731ea22 100644
> --- a/arch/powerpc/mm/fault.c
> +++ b/arch/powerpc/mm/fault.c
> @@ -287,7 +287,17 @@ static bool bad_stack_expansion(struct pt_regs *regs,
> unsigned long address,
> if (!res)
> return !store_updates_sp(inst);
> *must_retry = true;
> + } else if ((flags & FAULT_FLAG_WRITE) &&
> + !(flags & FAULT_FLAG_USER)) {
> + /*
> + * the kernel can also attempt to write beyond the end
> + * of a process's stack - for example setting up a
> + * signal frame. We assume this is valid, subject to
> + * the checks in expand_stack() later.
> + */
> + return false;
> }
> +
> return true;
> }
> return false;
> --
> 2.20.1
>
