diff options
| author | Marc Zyngier <marc.zyngier@arm.com> | 2016-07-20 17:46:58 +0100 |
|---|---|---|
| committer | Catalin Marinas <catalin.marinas@arm.com> | 2016-07-20 17:54:35 +0100 |
| commit | ab4c1325d4bf111a590a1f773e3d93bde7f40201 (patch) | |
| tree | 85817cdc289aba4b54ee3cc4f6659d3b158356c0 /arch | |
| parent | 44bd887ce10eb8061f6a137f8a73f823957edd82 (diff) | |
arm64: kprobes: Fix overflow when saving stack
The MIN_STACK_SIZE macro tries evaluate how much stack space needs
to be saved in the jprobes_stack array, sized at 128 bytes.
When using the IRQ stack, said macro can happily return up to
IRQ_STACK_SIZE, which is 16kB. Mayhem follows.
This patch fixes things by getting rid of the crazy macro and
limiting the copy to be at most the size of the jprobes_stack
array, no matter which stack we're on.
Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Diffstat (limited to 'arch')
| -rw-r--r-- | arch/arm64/kernel/probes/kprobes.c | 22 |
1 files changed, 14 insertions, 8 deletions
diff --git a/arch/arm64/kernel/probes/kprobes.c b/arch/arm64/kernel/probes/kprobes.c index c89811d1e294..09f8ae98da5a 100644 --- a/arch/arm64/kernel/probes/kprobes.c +++ b/arch/arm64/kernel/probes/kprobes.c @@ -34,12 +34,6 @@ #include "decode-insn.h" -#define MIN_STACK_SIZE(addr) (on_irq_stack(addr, raw_smp_processor_id()) ? \ - min((unsigned long)IRQ_STACK_SIZE, \ - IRQ_STACK_PTR(raw_smp_processor_id()) - (addr)) : \ - min((unsigned long)MAX_STACK_SIZE, \ - (unsigned long)current_thread_info() + THREAD_START_SP - (addr))) - void jprobe_return_break(void); DEFINE_PER_CPU(struct kprobe *, current_kprobe) = NULL; @@ -48,6 +42,18 @@ DEFINE_PER_CPU(struct kprobe_ctlblk, kprobe_ctlblk); static void __kprobes post_kprobe_handler(struct kprobe_ctlblk *, struct pt_regs *); +static inline unsigned long min_stack_size(unsigned long addr) +{ + unsigned long size; + + if (on_irq_stack(addr, raw_smp_processor_id())) + size = IRQ_STACK_PTR(raw_smp_processor_id()) - addr; + else + size = (unsigned long)current_thread_info() + THREAD_START_SP - addr; + + return min(size, FIELD_SIZEOF(struct kprobe_ctlblk, jprobes_stack)); +} + static void __kprobes arch_prepare_ss_slot(struct kprobe *p) { /* prepare insn slot */ @@ -495,7 +501,7 @@ int __kprobes setjmp_pre_handler(struct kprobe *p, struct pt_regs *regs) * the argument area. */ memcpy(kcb->jprobes_stack, (void *)stack_ptr, - MIN_STACK_SIZE(stack_ptr)); + min_stack_size(stack_ptr)); instruction_pointer_set(regs, (unsigned long) jp->entry); preempt_disable(); @@ -548,7 +554,7 @@ int __kprobes longjmp_break_handler(struct kprobe *p, struct pt_regs *regs) unpause_graph_tracing(); *regs = kcb->jprobe_saved_regs; memcpy((void *)stack_addr, kcb->jprobes_stack, - MIN_STACK_SIZE(stack_addr)); + min_stack_size(stack_addr)); preempt_enable_no_resched(); return 1; } |