[Linux-ia64] Unwind can load wrong data from pt_regs

Keith Owens
2002-12-09T08:35:03Z

2.4.19-ia64-020821/arch/ia64/kernel/unwind.c, compile_reg() contains

case UNW_WHERE_FR:
if (rval <= 5)
val = unw.preg_index[UNW_REG_F2 + (rval - 1)];
else if (rval >= 16 && rval <= 31)
val = unw.preg_index[UNW_REG_F16 + (rval - 16)];
else {
opc = UNW_INSN_ADD_SP;
val = -sizeof(struct pt_regs);
if (rval <= 9)
val += struct_offset(struct pt_regs, f6) + 16*(rval - 6);
else
dprintk("unwind: kernel may not touch f%lu\n", rval);
}
break;

case UNW_WHERE_BR:
if (rval >= 1 && rval <= 5)
val = unw.preg_index[UNW_REG_B1 + (rval - 1)];
else {
opc = UNW_INSN_ADD_SP;
val = -sizeof(struct pt_regs);
if (rval = 0)
val += struct_offset(struct pt_regs, b0);
else if (rval = 6)
val += struct_offset(struct pt_regs, b6);
else
val += struct_offset(struct pt_regs, b7);
}
break;

This implicitly assumes that when a fr or br register is required from
pt_regs, info->sp is pointing to pt_regs. But info->sp is modified as
the code unwinds through each function. The above code only gives
correct results for register lookups from the failing function.
Unwinding and accessing a fr or br register from earlier functions
loads incorrect values for those registers.