[AVR32] show_trace: Only walk valid stack addresses
authorHaavard Skinnemoen <hskinnemoen@atmel.com>
Wed, 21 Feb 2007 12:08:06 +0000 (13:08 +0100)
committerHaavard Skinnemoen <hskinnemoen@atmel.com>
Wed, 7 Mar 2007 09:50:27 +0000 (10:50 +0100)
Terminate the frame pointer walk if (a) the address is outside the
task's kernel stack or (b) if the frame pointer isn't monotonically
increasing. Without this fix, show_trace() may enter an infinite
loop, walking through random data anywhere in memory.

Since any address within the kernel stack is guaranteed to be valid,
we may eliminate the __get_user() calls as well.

Signed-off-by: Haavard Skinnemoen <hskinnemoen@atmel.com>
arch/avr32/kernel/traps.c

index 7e803f4d7a12902972da2ce1325acd0bc43cafc2..adc01a12d15487ff8ae335f8352b9820d00b9395 100644 (file)
@@ -49,39 +49,45 @@ out:
        return;
 }
 
+static inline int valid_stack_ptr(struct thread_info *tinfo, unsigned long p)
+{
+       return (p > (unsigned long)tinfo)
+               && (p < (unsigned long)tinfo + THREAD_SIZE - 3);
+}
+
 #ifdef CONFIG_FRAME_POINTER
 static inline void __show_trace(struct task_struct *tsk, unsigned long *sp,
                                struct pt_regs *regs)
 {
-       unsigned long __user *fp;
-       unsigned long __user *last_fp = NULL;
-
-       if (regs) {
-               fp = (unsigned long __user *)regs->r7;
-       } else if (tsk == current) {
-               register unsigned long __user *real_fp __asm__("r7");
-               fp = real_fp;
-       } else {
-               fp = (unsigned long __user *)tsk->thread.cpu_context.r7;
-       }
+       unsigned long lr, fp;
+       struct thread_info *tinfo;
+
+       tinfo = (struct thread_info *)
+               ((unsigned long)sp & ~(THREAD_SIZE - 1));
+
+       if (regs)
+               fp = regs->r7;
+       else if (tsk == current)
+               asm("mov %0, r7" : "=r"(fp));
+       else
+               fp = tsk->thread.cpu_context.r7;
 
        /*
-        * Walk the stack until (a) we get an exception, (b) the frame
-        * pointer becomes zero, or (c) the frame pointer gets stuck
-        * at the same value.
+        * Walk the stack as long as the frame pointer (a) is within
+        * the kernel stack of the task, and (b) it doesn't move
+        * downwards.
         */
-       while (fp && fp != last_fp) {
-               unsigned long lr, new_fp = 0;
-
-               last_fp = fp;
-               if (__get_user(lr, fp))
-                       break;
-               if (fp && __get_user(new_fp, fp + 1))
-                       break;
-               fp = (unsigned long __user *)new_fp;
+       while (valid_stack_ptr(tinfo, fp)) {
+               unsigned long new_fp;
 
+               lr = *(unsigned long *)fp;
                printk(" [<%08lx>] ", lr);
                print_symbol("%s\n", lr);
+
+               new_fp = *(unsigned long *)(fp + 4);
+               if (new_fp <= fp)
+                       break;
+               fp = new_fp;
        }
        printk("\n");
 }