From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org,
Konstantin Khlebnikov <k.khlebnikov@samsung.com>,
Russell King <rmk+kernel@arm.linux.org.uk>
Subject: [PATCH 3.4 06/31] ARM: 7913/1: fix framepointer check in unwind_frame
Date: Wed, 18 Dec 2013 13:08:14 -0800 [thread overview]
Message-ID: <20131218210522.971706803@linuxfoundation.org> (raw)
In-Reply-To: <20131218210522.790152625@linuxfoundation.org>
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konstantin Khlebnikov <k.khlebnikov@samsung.com>
commit 3abb6671a9c04479c4bd026798a05f857393b7e2 upstream.
This patch fixes corner case when (fp + 4) overflows unsigned long,
for example: fp = 0xFFFFFFFF -> fp + 4 == 3.
Signed-off-by: Konstantin Khlebnikov <k.khlebnikov@samsung.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/kernel/stacktrace.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/arm/kernel/stacktrace.c
+++ b/arch/arm/kernel/stacktrace.c
@@ -31,7 +31,7 @@ int notrace unwind_frame(struct stackfra
high = ALIGN(low, THREAD_SIZE);
/* check current frame pointer is within bounds */
- if (fp < (low + 12) || fp + 4 >= high)
+ if (fp < low + 12 || fp > high - 4)
return -EINVAL;
/* restore the registers from the stack frame */
next prev parent reply other threads:[~2013-12-18 22:16 UTC|newest]
Thread overview: 37+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-12-18 21:08 [PATCH 3.4 00/31] 3.4.75-stable review Greg Kroah-Hartman
2013-12-18 21:08 ` [PATCH 3.4 01/31] MIPS: DMA: For BMIPS5000 cores flush region just like non-coherent R10000 Greg Kroah-Hartman
2013-12-18 21:08 ` [PATCH 3.4 02/31] ALSA: memalloc.h - fix wrong truncation of dma_addr_t Greg Kroah-Hartman
2013-12-18 21:08 ` Greg Kroah-Hartman
2013-12-18 21:08 ` [PATCH 3.4 03/31] ARM: pxa: tosa: fix keys mapping Greg Kroah-Hartman
2013-12-18 21:08 ` [PATCH 3.4 04/31] ARM: OMAP3: hwmod data: Dont prevent RESET of USB Host module Greg Kroah-Hartman
2013-12-18 21:08 ` [PATCH 3.4 05/31] ARM: 7912/1: check stack pointer in get_wchan Greg Kroah-Hartman
2013-12-18 21:08 ` Greg Kroah-Hartman [this message]
2013-12-18 21:08 ` [PATCH 3.4 07/31] KVM: Improve create VCPU parameter (CVE-2013-4587) Greg Kroah-Hartman
2013-12-18 21:08 ` [PATCH 3.4 08/31] hwmon: (w83l786ng) Fix fan speed control mode setting and reporting Greg Kroah-Hartman
2013-12-18 21:08 ` [PATCH 3.4 09/31] xfs: underflow bug in xfs_attrlist_by_handle() Greg Kroah-Hartman
2013-12-18 21:08 ` [PATCH 3.4 10/31] futex: fix handling of read-only-mapped hugepages Greg Kroah-Hartman
2013-12-18 21:08 ` [PATCH 3.4 11/31] usb: hub: Use correct reset for wedged USB3 devices that are NOTATTACHED Greg Kroah-Hartman
2013-12-18 21:08 ` [PATCH 3.4 12/31] usb: dwc3: fix implementation of endpoint wedge Greg Kroah-Hartman
2013-12-18 21:08 ` [PATCH 3.4 13/31] usb: gadget: composite: reset delayed_status on reset_config Greg Kroah-Hartman
2013-12-18 21:08 ` [PATCH 3.4 14/31] USB: serial: option: blacklist interface 1 for Huawei E173s-6 Greg Kroah-Hartman
2013-12-18 21:08 ` [PATCH 3.4 15/31] USB: option: support new huawei devices Greg Kroah-Hartman
2013-12-18 21:08 ` [PATCH 3.4 16/31] Input: usbtouchscreen - separate report and transmit buffer size handling Greg Kroah-Hartman
2013-12-18 21:08 ` [PATCH 3.4 17/31] drivers/rtc/rtc-at91rm9200.c: correct alarm over day/month wrap Greg Kroah-Hartman
2013-12-18 21:08 ` [PATCH 3.4 18/31] selinux: handle TCP SYN-ACK packets correctly in selinux_ip_output() Greg Kroah-Hartman
2013-12-18 21:08 ` [PATCH 3.4 19/31] selinux: handle TCP SYN-ACK packets correctly in selinux_ip_postroute() Greg Kroah-Hartman
2013-12-18 21:08 ` [PATCH 3.4 20/31] mac80211: dont attempt to reorder multicast frames Greg Kroah-Hartman
2013-12-18 21:08 ` [PATCH 3.4 21/31] drm/radeon: fixup bad vram size on SI Greg Kroah-Hartman
2013-12-18 21:08 ` [PATCH 3.4 22/31] x86, efi: Dont use (U)EFI time services on 32 bit Greg Kroah-Hartman
2013-12-18 21:08 ` [PATCH 3.4 23/31] dm bufio: initialize read-only module parameters Greg Kroah-Hartman
2013-12-18 21:08 ` [PATCH 3.4 24/31] dm delay: fix a possible deadlock due to shared workqueue Greg Kroah-Hartman
2013-12-18 21:08 ` [PATCH 3.4 25/31] dm table: fail dm_table_create on dm_round_up overflow Greg Kroah-Hartman
2013-12-18 21:08 ` [PATCH 3.4 27/31] staging: comedi: pcmuio: fix possible NULL deref on detach Greg Kroah-Hartman
2013-12-18 21:08 ` [PATCH 3.4 28/31] staging: comedi: ssv_dnp: use comedi_dio_update_state() Greg Kroah-Hartman
2013-12-18 21:08 ` [PATCH 3.4 29/31] sc1200_wdt: Fix oops Greg Kroah-Hartman
2013-12-18 21:08 ` [PATCH 3.4 30/31] hpfs: fix warnings when the filesystem fills up Greg Kroah-Hartman
2013-12-18 21:08 ` [PATCH 3.4 31/31] Revert "net: update consumers of MSG_MORE to recognize MSG_SENDPAGE_NOTLAST" Greg Kroah-Hartman
2013-12-19 2:02 ` [PATCH 3.4 00/31] 3.4.75-stable review Guenter Roeck
2013-12-19 3:40 ` Greg Kroah-Hartman
2013-12-19 19:54 ` Guenter Roeck
2013-12-19 20:13 ` Greg Kroah-Hartman
2013-12-19 20:46 ` Shuah Khan
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20131218210522.971706803@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=k.khlebnikov@samsung.com \
--cc=linux-kernel@vger.kernel.org \
--cc=rmk+kernel@arm.linux.org.uk \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.