summaryrefslogtreecommitdiff
path: root/arch/avr32
diff options
context:
space:
mode:
authorHaavard Skinnemoen <hskinnemoen@atmel.com>2007-02-21 13:08:06 +0100
committerHaavard Skinnemoen <hskinnemoen@atmel.com>2007-03-07 10:50:27 +0100
commit3338368e922a6686a3b3d6f4da07babd224788d4 (patch)
treefa29c8aaef547723cb5f5f81fe60d441947481b6 /arch/avr32
parent9a596a6236e1b4d6c2e6105bd85eac19c9f4ec4c (diff)
downloadlinux-3.10-3338368e922a6686a3b3d6f4da07babd224788d4.tar.gz
linux-3.10-3338368e922a6686a3b3d6f4da07babd224788d4.tar.bz2
linux-3.10-3338368e922a6686a3b3d6f4da07babd224788d4.zip
[AVR32] show_trace: Only walk valid stack addresses
Terminate the frame pointer walk if (a) the address is outside the task's kernel stack or (b) if the frame pointer isn't monotonically increasing. Without this fix, show_trace() may enter an infinite loop, walking through random data anywhere in memory. Since any address within the kernel stack is guaranteed to be valid, we may eliminate the __get_user() calls as well. Signed-off-by: Haavard Skinnemoen <hskinnemoen@atmel.com>
Diffstat (limited to 'arch/avr32')
-rw-r--r--arch/avr32/kernel/traps.c52
1 files changed, 29 insertions, 23 deletions
diff --git a/arch/avr32/kernel/traps.c b/arch/avr32/kernel/traps.c
index 7e803f4d7a1..adc01a12d15 100644
--- a/arch/avr32/kernel/traps.c
+++ b/arch/avr32/kernel/traps.c
@@ -49,39 +49,45 @@ out:
return;
}
+static inline int valid_stack_ptr(struct thread_info *tinfo, unsigned long p)
+{
+ return (p > (unsigned long)tinfo)
+ && (p < (unsigned long)tinfo + THREAD_SIZE - 3);
+}
+
#ifdef CONFIG_FRAME_POINTER
static inline void __show_trace(struct task_struct *tsk, unsigned long *sp,
struct pt_regs *regs)
{
- unsigned long __user *fp;
- unsigned long __user *last_fp = NULL;
-
- if (regs) {
- fp = (unsigned long __user *)regs->r7;
- } else if (tsk == current) {
- register unsigned long __user *real_fp __asm__("r7");
- fp = real_fp;
- } else {
- fp = (unsigned long __user *)tsk->thread.cpu_context.r7;
- }
+ unsigned long lr, fp;
+ struct thread_info *tinfo;
+
+ tinfo = (struct thread_info *)
+ ((unsigned long)sp & ~(THREAD_SIZE - 1));
+
+ if (regs)
+ fp = regs->r7;
+ else if (tsk == current)
+ asm("mov %0, r7" : "=r"(fp));
+ else
+ fp = tsk->thread.cpu_context.r7;
/*
- * Walk the stack until (a) we get an exception, (b) the frame
- * pointer becomes zero, or (c) the frame pointer gets stuck
- * at the same value.
+ * Walk the stack as long as the frame pointer (a) is within
+ * the kernel stack of the task, and (b) it doesn't move
+ * downwards.
*/
- while (fp && fp != last_fp) {
- unsigned long lr, new_fp = 0;
-
- last_fp = fp;
- if (__get_user(lr, fp))
- break;
- if (fp && __get_user(new_fp, fp + 1))
- break;
- fp = (unsigned long __user *)new_fp;
+ while (valid_stack_ptr(tinfo, fp)) {
+ unsigned long new_fp;
+ lr = *(unsigned long *)fp;
printk(" [<%08lx>] ", lr);
print_symbol("%s\n", lr);
+
+ new_fp = *(unsigned long *)(fp + 4);
+ if (new_fp <= fp)
+ break;
+ fp = new_fp;
}
printk("\n");
}