summaryrefslogtreecommitdiff
path: root/arch/arm/kernel
diff options
context:
space:
mode:
authorCatalin Marinas <catalin.marinas@arm.com>2009-06-19 16:42:11 +0100
committerRussell King <rmk+kernel@arm.linux.org.uk>2009-06-19 16:44:22 +0100
commitc894ed6956f126d60d888e8efc5fb3a595ba89ae (patch)
tree9c84511dee1084d9ee15a5e667289017e182010d /arch/arm/kernel
parent7436127ce9042f95a10bb5423f726fd63a61934d (diff)
[ARM] 5558/1: Add extra checks to ARM unwinder to avoid tracing corrupt stacks
There are situations where the unwinder goes beyond stack boundaries and unwinds random data. This patch moves the stack boundaries check after the unwind_exec_insn() call and adds an extra check for possible infinite loops (like "mov pc, lr" with pc == lr). The patch also fixes a bug in the unwind instructions interpreter. The 0xb0 instruction can only set PC to LR if this wasn't already set by a previous instruction (this is used on exceptions taken while in kernel mode where svc_entry is annotated with ".save {r0 - pc}"). Tested-by: Tony Lindgren <tony@atomide.com> Signed-off-by: Catalin Marinas <catalin.marinas@arm.com> Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Diffstat (limited to 'arch/arm/kernel')
-rw-r--r--arch/arm/kernel/unwind.c19
1 files changed, 9 insertions, 10 deletions
diff --git a/arch/arm/kernel/unwind.c b/arch/arm/kernel/unwind.c
index 1dedc2c7ff49..dd56e11f339a 100644
--- a/arch/arm/kernel/unwind.c
+++ b/arch/arm/kernel/unwind.c
@@ -212,7 +212,8 @@ static int unwind_exec_insn(struct unwind_ctrl_block *ctrl)
ctrl->vrs[14] = *vsp++;
ctrl->vrs[SP] = (unsigned long)vsp;
} else if (insn == 0xb0) {
- ctrl->vrs[PC] = ctrl->vrs[LR];
+ if (ctrl->vrs[PC] == 0)
+ ctrl->vrs[PC] = ctrl->vrs[LR];
/* no further processing */
ctrl->entries = 0;
} else if (insn == 0xb1) {
@@ -309,18 +310,20 @@ int unwind_frame(struct stackframe *frame)
}
while (ctrl.entries > 0) {
- int urc;
-
- if (ctrl.vrs[SP] < low || ctrl.vrs[SP] >= high)
- return -URC_FAILURE;
- urc = unwind_exec_insn(&ctrl);
+ int urc = unwind_exec_insn(&ctrl);
if (urc < 0)
return urc;
+ if (ctrl.vrs[SP] < low || ctrl.vrs[SP] >= high)
+ return -URC_FAILURE;
}
if (ctrl.vrs[PC] == 0)
ctrl.vrs[PC] = ctrl.vrs[LR];
+ /* check for infinite loop */
+ if (frame->pc == ctrl.vrs[PC])
+ return -URC_FAILURE;
+
frame->fp = ctrl.vrs[FP];
frame->sp = ctrl.vrs[SP];
frame->lr = ctrl.vrs[LR];
@@ -332,7 +335,6 @@ int unwind_frame(struct stackframe *frame)
void unwind_backtrace(struct pt_regs *regs, struct task_struct *tsk)
{
struct stackframe frame;
- unsigned long high, low;
register unsigned long current_sp asm ("sp");
pr_debug("%s(regs = %p tsk = %p)\n", __func__, regs, tsk);
@@ -362,9 +364,6 @@ void unwind_backtrace(struct pt_regs *regs, struct task_struct *tsk)
frame.pc = thread_saved_pc(tsk);
}
- low = frame.sp & ~(THREAD_SIZE - 1);
- high = low + THREAD_SIZE;
-
while (1) {
int urc;
unsigned long where = frame.pc;