Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751739Ab3JFHOe (ORCPT ); Sun, 6 Oct 2013 03:14:34 -0400 Received: from mail-ob0-f176.google.com ([209.85.214.176]:33310 "EHLO mail-ob0-f176.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751327Ab3JFHOd (ORCPT ); Sun, 6 Oct 2013 03:14:33 -0400 MIME-Version: 1.0 In-Reply-To: <20131002181116.GH29794@arm.com> References: <20131002181116.GH29794@arm.com> Date: Sun, 6 Oct 2013 12:44:32 +0530 Message-ID: Subject: Re: [Query] Stack Overflow in "arch/arm/kernel/unwind.c" while unwinding frame From: Anurag Aggarwal To: Catalin Marinas Cc: Jean Pihet , "linux@arm.linux.org.uk" , "linux-kernel@vger.kernel.org" , "linux-arm-kernel@lists.infradead.org" Content-Type: text/plain; charset=ISO-8859-1 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1825 Lines: 55 >From what I saw, it happened when the next page is not mapped to physical memory. I don't think that stack corruption can cause this. >From what I could understand about of the code there is not check if the memory beyond stack is physically mapped or not. To handle the problem I thought that checks can also be added in unwind_exec_insn() function for stack overflow. On Wed, Oct 2, 2013 at 11:41 PM, Catalin Marinas wrote: > On 24 September 2013 07:23, Anurag Aggarwal wrote: >> While executing unwind backtrace instructions in ARM, in the function >> unwind_exec_insn() >> there are chances that SP overflows from stack. >> >> >> For example while executing instruction with opcode 0xAE, vsp can go >> beyond stack to area that has not been allocated till now. >> >> unsigned long *vsp = (unsigned long *)ctrl->vrs[SP]; >> int reg; >> >> /* pop R4-R[4+bbb] */ >> for (reg = 4; reg <= 4 + (insn & 7); reg++) >> ctrl->vrs[reg] = *vsp++; >> >> The above scenario can happen while executing any of the unwind instruction. >> >> One of the ways to fix the problem is to check for vsp with stack >> limits before we increment it, but doing it for all the instructions >> seems a little bad. >> >> I just want to know that if anyone has faced the problem before > > I haven't seen it but I think with some stack (or unwind bytecode) > corruption it could happen. > > I think we could place some checks only when vsp is assigned and return > -URC_FAILURE, together with some warning. > > -- > Catalin -- Anurag Aggarwal -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/