Commit c894ed69 authored by Catalin Marinas's avatar Catalin Marinas Committed by Russell King

[ARM] 5558/1: Add extra checks to ARM unwinder to avoid tracing corrupt stacks

There are situations where the unwinder goes beyond stack boundaries and
unwinds random data. This patch moves the stack boundaries check after
the unwind_exec_insn() call and adds an extra check for possible
infinite loops (like "mov pc, lr" with pc == lr).

The patch also fixes a bug in the unwind instructions interpreter. The
0xb0 instruction can only set PC to LR if this wasn't already set by
a previous instruction (this is used on exceptions taken while in kernel
mode where svc_entry is annotated with ".save {r0 - pc}").
Tested-by: default avatarTony Lindgren <tony@atomide.com>
Signed-off-by: default avatarCatalin Marinas <catalin.marinas@arm.com>
Signed-off-by: default avatarRussell King <rmk+kernel@arm.linux.org.uk>
parent 7436127c
...@@ -212,7 +212,8 @@ static int unwind_exec_insn(struct unwind_ctrl_block *ctrl) ...@@ -212,7 +212,8 @@ static int unwind_exec_insn(struct unwind_ctrl_block *ctrl)
ctrl->vrs[14] = *vsp++; ctrl->vrs[14] = *vsp++;
ctrl->vrs[SP] = (unsigned long)vsp; ctrl->vrs[SP] = (unsigned long)vsp;
} else if (insn == 0xb0) { } else if (insn == 0xb0) {
ctrl->vrs[PC] = ctrl->vrs[LR]; if (ctrl->vrs[PC] == 0)
ctrl->vrs[PC] = ctrl->vrs[LR];
/* no further processing */ /* no further processing */
ctrl->entries = 0; ctrl->entries = 0;
} else if (insn == 0xb1) { } else if (insn == 0xb1) {
...@@ -309,18 +310,20 @@ int unwind_frame(struct stackframe *frame) ...@@ -309,18 +310,20 @@ int unwind_frame(struct stackframe *frame)
} }
while (ctrl.entries > 0) { while (ctrl.entries > 0) {
int urc; int urc = unwind_exec_insn(&ctrl);
if (ctrl.vrs[SP] < low || ctrl.vrs[SP] >= high)
return -URC_FAILURE;
urc = unwind_exec_insn(&ctrl);
if (urc < 0) if (urc < 0)
return urc; return urc;
if (ctrl.vrs[SP] < low || ctrl.vrs[SP] >= high)
return -URC_FAILURE;
} }
if (ctrl.vrs[PC] == 0) if (ctrl.vrs[PC] == 0)
ctrl.vrs[PC] = ctrl.vrs[LR]; ctrl.vrs[PC] = ctrl.vrs[LR];
/* check for infinite loop */
if (frame->pc == ctrl.vrs[PC])
return -URC_FAILURE;
frame->fp = ctrl.vrs[FP]; frame->fp = ctrl.vrs[FP];
frame->sp = ctrl.vrs[SP]; frame->sp = ctrl.vrs[SP];
frame->lr = ctrl.vrs[LR]; frame->lr = ctrl.vrs[LR];
...@@ -332,7 +335,6 @@ int unwind_frame(struct stackframe *frame) ...@@ -332,7 +335,6 @@ int unwind_frame(struct stackframe *frame)
void unwind_backtrace(struct pt_regs *regs, struct task_struct *tsk) void unwind_backtrace(struct pt_regs *regs, struct task_struct *tsk)
{ {
struct stackframe frame; struct stackframe frame;
unsigned long high, low;
register unsigned long current_sp asm ("sp"); register unsigned long current_sp asm ("sp");
pr_debug("%s(regs = %p tsk = %p)\n", __func__, regs, tsk); pr_debug("%s(regs = %p tsk = %p)\n", __func__, regs, tsk);
...@@ -362,9 +364,6 @@ void unwind_backtrace(struct pt_regs *regs, struct task_struct *tsk) ...@@ -362,9 +364,6 @@ void unwind_backtrace(struct pt_regs *regs, struct task_struct *tsk)
frame.pc = thread_saved_pc(tsk); frame.pc = thread_saved_pc(tsk);
} }
low = frame.sp & ~(THREAD_SIZE - 1);
high = low + THREAD_SIZE;
while (1) { while (1) {
int urc; int urc;
unsigned long where = frame.pc; unsigned long where = frame.pc;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment