If a process page-faults trying to write beyond the end of its stack, we attempt to grow the stack.
However, if the kernel attempts to write beyond the end of a process's stack, it takes a bad fault. This can occur when the kernel is trying to set up a signal frame. Permit the kernel to grow a process's stack. The same general limits as to how and when the stack can be grown apply: the kernel code still passes through expand_stack(), so anything that goes beyond e.g. the rlimit should still be blocked. Link: https://bugzilla.kernel.org/show_bug.cgi?id=205183 Reported-by: Tom Lane <[email protected]> Cc: Daniel Black <[email protected]> Signed-off-by: Daniel Axtens <[email protected]> --- arch/powerpc/mm/fault.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/arch/powerpc/mm/fault.c b/arch/powerpc/mm/fault.c index b5047f9b5dec..00183731ea22 100644 --- a/arch/powerpc/mm/fault.c +++ b/arch/powerpc/mm/fault.c @@ -287,7 +287,17 @@ static bool bad_stack_expansion(struct pt_regs *regs, unsigned long address, if (!res) return !store_updates_sp(inst); *must_retry = true; + } else if ((flags & FAULT_FLAG_WRITE) && + !(flags & FAULT_FLAG_USER)) { + /* + * the kernel can also attempt to write beyond the end + * of a process's stack - for example setting up a + * signal frame. We assume this is valid, subject to + * the checks in expand_stack() later. + */ + return false; } + return true; } return false; -- 2.20.1
