Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 5480675d authored by Matt Fleming's avatar Matt Fleming
Browse files

sh: Fix bug calculating the end of the FDE instructions 



The 'end' member of struct dwarf_fde denotes one byte past the end of
the CFA instruction stream for an FDE. The value of 'end' was being
calcualted incorrectly, it was being set too high. This resulted in
dwarf_cfa_execute_insns() interpreting data past the end of valid
instructions, thus causing all sorts of weird crashes.

Signed-off-by: default avatarMatt Fleming <matt@console-pimps.org>
parent fe98dd31

arch/sh/kernel/dwarf.c

+4 −3
Original line number Original line Diff line number Diff line
@@ -751,7 +751,8 @@ static int dwarf_parse_cie(void *entry, void *p, unsigned long len, 
}

}





static int dwarf_parse_fde(void *entry, u32 entry_type,

static int dwarf_parse_fde(void *entry, u32 entry_type,

			   void *start, unsigned long len)

			   void *start, unsigned long len,

			   unsigned char *end)

{

{

	struct dwarf_fde *fde;

	struct dwarf_fde *fde;

	struct dwarf_cie *cie;

	struct dwarf_cie *cie;
@@ -798,7 +799,7 @@ static int dwarf_parse_fde(void *entry, u32 entry_type, 




	/* Call frame instructions. */

	/* Call frame instructions. */

	fde->instructions = p;

	fde->instructions = p;

	fde->end = start + len;

	fde->end = end;





	/* Add to list. */

	/* Add to list. */

	spin_lock_irqsave(&dwarf_fde_lock, flags);

	spin_lock_irqsave(&dwarf_fde_lock, flags);
@@ -932,7 +933,7 @@ static int __init dwarf_unwinder_init(void) 
			else

			else

				c_entries++;

				c_entries++;

		} else {

		} else {

			err = dwarf_parse_fde(entry, entry_type, p, len);

			err = dwarf_parse_fde(entry, entry_type, p, len, end);

			if (err < 0)

			if (err < 0)

				goto out;

				goto out;

			else

			else