Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ab4c1325 authored by Marc Zyngier's avatar Marc Zyngier Committed by Catalin Marinas
Browse files

arm64: kprobes: Fix overflow when saving stack 



The MIN_STACK_SIZE macro tries evaluate how much stack space needs
to be saved in the jprobes_stack array, sized at 128 bytes.

When using the IRQ stack, said macro can happily return up to
IRQ_STACK_SIZE, which is 16kB. Mayhem follows.

This patch fixes things by getting rid of the crazy macro and
limiting the copy to be at most the size of the jprobes_stack
array, no matter which stack we're on.

Signed-off-by: default avatarMarc Zyngier <marc.zyngier@arm.com>
Signed-off-by: default avatarCatalin Marinas <catalin.marinas@arm.com>
parent 44bd887c

arch/arm64/kernel/probes/kprobes.c

+14 −8
Original line number Diff line number Diff line
@@ -34,12 +34,6 @@ 


#include "decode-insn.h"



#define MIN_STACK_SIZE(addr)	(on_irq_stack(addr, raw_smp_processor_id()) ? \

	min((unsigned long)IRQ_STACK_SIZE,	\

	IRQ_STACK_PTR(raw_smp_processor_id()) - (addr)) : \

	min((unsigned long)MAX_STACK_SIZE,	\

	(unsigned long)current_thread_info() + THREAD_START_SP - (addr)))



void jprobe_return_break(void);



DEFINE_PER_CPU(struct kprobe *, current_kprobe) = NULL;
@@ -48,6 +42,18 @@ DEFINE_PER_CPU(struct kprobe_ctlblk, kprobe_ctlblk); 
static void __kprobes

post_kprobe_handler(struct kprobe_ctlblk *, struct pt_regs *);



static inline unsigned long min_stack_size(unsigned long addr)

{

	unsigned long size;



	if (on_irq_stack(addr, raw_smp_processor_id()))

		size = IRQ_STACK_PTR(raw_smp_processor_id()) - addr;

	else

		size = (unsigned long)current_thread_info() + THREAD_START_SP - addr;



	return min(size, FIELD_SIZEOF(struct kprobe_ctlblk, jprobes_stack));

}



static void __kprobes arch_prepare_ss_slot(struct kprobe *p)

{

	/* prepare insn slot */
@@ -495,7 +501,7 @@ int __kprobes setjmp_pre_handler(struct kprobe *p, struct pt_regs *regs) 
	 * the argument area.

	 */

	memcpy(kcb->jprobes_stack, (void *)stack_ptr,

	       MIN_STACK_SIZE(stack_ptr));

	       min_stack_size(stack_ptr));



	instruction_pointer_set(regs, (unsigned long) jp->entry);

	preempt_disable();
@@ -548,7 +554,7 @@ int __kprobes longjmp_break_handler(struct kprobe *p, struct pt_regs *regs) 
	unpause_graph_tracing();

	*regs = kcb->jprobe_saved_regs;

	memcpy((void *)stack_addr, kcb->jprobes_stack,

	       MIN_STACK_SIZE(stack_addr));

	       min_stack_size(stack_addr));

	preempt_enable_no_resched();

	return 1;

}