Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754501Ab3JBSMO (ORCPT ); Wed, 2 Oct 2013 14:12:14 -0400 Received: from fw-tnat.cambridge.arm.com ([217.140.96.21]:53681 "EHLO cam-smtp0.cambridge.arm.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1753184Ab3JBSMN (ORCPT ); Wed, 2 Oct 2013 14:12:13 -0400 Date: Wed, 2 Oct 2013 19:11:17 +0100 From: Catalin Marinas To: Anurag Aggarwal Cc: Jean Pihet , "linux@arm.linux.org.uk" , "linux-kernel@vger.kernel.org" , "linux-arm-kernel@lists.infradead.org" Subject: Re: [Query] Stack Overflow in "arch/arm/kernel/unwind.c" while unwinding frame Message-ID: <20131002181116.GH29794@arm.com> References: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.20 (2009-06-14) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1307 Lines: 37 On 24 September 2013 07:23, Anurag Aggarwal wrote: > While executing unwind backtrace instructions in ARM, in the function > unwind_exec_insn() > there are chances that SP overflows from stack. > > > For example while executing instruction with opcode 0xAE, vsp can go > beyond stack to area that has not been allocated till now. > > unsigned long *vsp = (unsigned long *)ctrl->vrs[SP]; > int reg; > > /* pop R4-R[4+bbb] */ > for (reg = 4; reg <= 4 + (insn & 7); reg++) > ctrl->vrs[reg] = *vsp++; > > The above scenario can happen while executing any of the unwind instruction. > > One of the ways to fix the problem is to check for vsp with stack > limits before we increment it, but doing it for all the instructions > seems a little bad. > > I just want to know that if anyone has faced the problem before I haven't seen it but I think with some stack (or unwind bytecode) corruption it could happen. I think we could place some checks only when vsp is assigned and return -URC_FAILURE, together with some warning. -- Catalin -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/