Re: [PATCH 2/2] Fix again segfault in arm64_is_kernel_exception_frame() when corrupt stack pointer address is given

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On 2023/06/07 18:37, HATAYAMA Daisuke wrote:
> This is the second trial from the commit
> 9868ebc8e648e5791764a51567a23efae7170d9b that was reverted at the
> previous commit.
> 
> As described in the previous commit, result of STACK_OFFSET_TYPE() can
> be an address out of bt->stackbuf and hence the address needs to be
> checked prior to being referred to as an pt_regs object.
> 
> So, to fix the issue, let's check if stkptr points to within the range
> of the kernel stack first.
> 
> Signed-off-by: HATAYAMA Daisuke <d.hatayama@xxxxxxxxxxx>

Looks more cautious than before.  For the series,

Acked-by: Kazuhito Hagio <k-hagio-ab@xxxxxxx>

Thanks,
Kazu

> ---
>   arm64.c | 3 +++
>   1 file changed, 3 insertions(+)
> 
> diff --git a/arm64.c b/arm64.c
> index efbdccb..ca63fb5 100644
> --- a/arm64.c
> +++ b/arm64.c
> @@ -2381,6 +2381,9 @@ arm64_is_kernel_exception_frame(struct bt_info *bt, ulong stkptr)
>           struct arm64_pt_regs *regs;
>   	struct machine_specific *ms = machdep->machspec;
>   
> +	if (stkptr > STACKSIZE() && !INSTACK(stkptr, bt))
> +		return FALSE;
> +
>           regs = (struct arm64_pt_regs *)&bt->stackbuf[(ulong)(STACK_OFFSET_TYPE(stkptr))];
>   
>   	if (INSTACK(regs->sp, bt) && INSTACK(regs->regs[29], bt) &&
--
Crash-utility mailing list
Crash-utility@xxxxxxxxxx
https://listman.redhat.com/mailman/listinfo/crash-utility
Contribution Guidelines: https://github.com/crash-utility/crash/wiki




[Index of Archives]     [Fedora Development]     [Fedora Desktop]     [Fedora SELinux]     [Yosemite News]     [KDE Users]     [Fedora Tools]

 

Powered by Linux