If a process page-faults trying to write beyond the end of its
stack, we attempt to grow the stack.

However, if the kernel attempts to write beyond the end of a
process's stack, it takes a bad fault. This can occur when the
kernel is trying to set up a signal frame.

Permit the kernel to grow a process's stack. The same general
limits as to how and when the stack can be grown apply: the kernel
code still passes through expand_stack(), so anything that goes
beyond e.g. the rlimit should still be blocked.

Link: https://bugzilla.kernel.org/show_bug.cgi?id=205183
Reported-by: Tom Lane <redacted>
Cc: Daniel Black <redacted>
Signed-off-by: Daniel Axtens <redacted>
---
 arch/powerpc/mm/fault.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/arch/powerpc/mm/fault.c b/arch/powerpc/mm/fault.c
index b5047f9b5dec..00183731ea22 100644
--- a/arch/powerpc/mm/fault.c
+++ b/arch/powerpc/mm/fault.c

@@ -287,7 +287,17 @@ static bool bad_stack_expansion(struct pt_regs *regs, unsigned long address,
 			if (!res)
 				return !store_updates_sp(inst);
 			*must_retry = true;
+		} else if ((flags & FAULT_FLAG_WRITE) &&
+			   !(flags & FAULT_FLAG_USER)) {
+			/*
+			 * the kernel can also attempt to write beyond the end
+			 * of a process's stack - for example setting up a
+			 * signal frame. We assume this is valid, subject to
+			 * the checks in expand_stack() later.
+			 */
+			return false;
 		}
+
 		return true;
 	}
 	return false;

-- 
2.20.1