• Vincent Whitchurch's avatar
    ARM: 8948/1: Prevent OOB access in stacktrace · 40ff1ddb
    Vincent Whitchurch authored
    The stacktrace code can read beyond the stack size, when it attempts to
    read pt_regs from exception frames.
    
    This can happen on normal, non-corrupt stacks.  Since the unwind
    information in the extable is not correct for function prologues, the
    unwinding code can return data from the stack which is not actually the
    caller function address, and if in_entry_text() happens to succeed on
    this value, we can end up reading data from outside the task's stack
    when attempting to read pt_regs, since there is no bounds check.
    
    Example:
    
     [<8010e729>] (unwind_backtrace) from [<8010a9c9>] (show_stack+0x11/0x14)
     [<8010a9c9>] (show_stack) from [<8057d8d7>] (dump_stack+0x87/0xac)
     [<8057d8d7>] (dump_stack) from [<8012271d>] (tasklet_action_common.constprop.4+0xa5/0xa8)
     [<8012271d>] (tasklet_action_common.constprop.4) from [<80102333>] (__do_softirq+0x11b/0x31c)
     [<80102333>] (__do_softirq) from [<80122485>] (irq_exit+0xad/0xd8)
     [<80122485>] (irq_exit) from [<8015f3d7>] (__handle_domain_irq+0x47/0x84)
     [<8015f3d7>] (__handle_domain_irq) from [<8036a523>] (gic_handle_irq+0x43/0x78)
     [<8036a523>] (gic_handle_irq) from [<80101a49>] (__irq_svc+0x69/0xb4)
     Exception stack(0xeb491f58 to 0xeb491fa0)
     1f40:                                                       7eb14794 00000000
     1f60: ffffffff 008dd32c 008dd324 ffffffff 008dd314 0000002a 801011e4 eb490000
     1f80: 0000002a 7eb1478c 50c5387d eb491fa8 80101001 8023d09c 40080033 ffffffff
     [<80101a49>] (__irq_svc) from [<8023d09c>] (do_pipe2+0x0/0xac)
     [<8023d09c>] (do_pipe2) from [<ffffffff>] (0xffffffff)
     Exception stack(0xeb491fc8 to 0xeb492010)
     1fc0:                   008dd314 0000002a 00511ad8 008de4c8 7eb14790 7eb1478c
     1fe0: 00511e34 7eb14774 004c8557 76f44098 60080030 7eb14794 00000000 00000000
     2000: 00000001 00000000 ea846c00 ea847cc0
    
    In this example, the stack limit is 0xeb492000, but 16 bytes outside the
    stack have been read.
    
    Fix it by adding bounds checks.
    Signed-off-by: default avatarVincent Whitchurch <vincent.whitchurch@axis.com>
    Signed-off-by: default avatarRussell King <rmk+kernel@armlinux.org.uk>
    40ff1ddb
stacktrace.c 4.1 KB