From: "Siddha, Suresh B" <suresh.b.siddha@intel.com>
To: linux-ia64@vger.kernel.org
Subject: [Linux-ia64] [Patch] Fix in unwind.c
Date: Sat, 18 Jan 2003 01:52:18 +0000 [thread overview]
Message-ID: <marc-linux-ia64-105590709805721@msgid-missing> (raw)
[-- Attachment #1: Type: text/plain, Size: 2297 bytes --]
Current code in unw_create_gate_table() looks like this:
start = (unsigned long) __start_gate_section - segbase;
end = (unsigned long) __stop_gate_section - segbase;
size = 0;
first = lookup(&unw.kernel_table, start);
for (entry = first; entry->start_offset < end; ++entry)
size += 3*8 + 8 + 8*UNW_LENGTH(*(u64 *) (segbase + entry->info_offset));
Code starts with first unwind kernel table entry for the gate page and goes through all the gate page unwind table entries. Assume if all the gate page unwind table entries comes to the end of kernel unwind table(typically this is what happens because of the order in vmlinux.lds.S), then there is a chance that we go past beyond the kernel unwind table and resulting in a fault while we access "segbase + entry->info_offset".
Attached/appended patch fixes this problem.
thanks,
suresh
diff -Nru linux-2.5.52/arch/ia64/kernel/unwind.c~ linux-2.5.52/arch/ia64/kernel/unwind.c
--- linux-2.5.52/arch/ia64/kernel/unwind.c~ Fri Jan 17 14:53:48 2003
+++ linux-2.5.52/arch/ia64/kernel/unwind.c Fri Jan 17 15:26:58 2003
@@ -1998,6 +1998,7 @@
extern char __start_gate_section[], __stop_gate_section[];
unsigned long *lp, start, end, segbase = unw.kernel_table.segment_base;
const struct unw_table_entry *entry, *first;
+ extern int ia64_unw_end;
size_t info_size, size;
char *info;
@@ -2006,7 +2007,10 @@
size = 0;
first = lookup(&unw.kernel_table, start);
- for (entry = first; entry->start_offset < end; ++entry)
+ for (entry = first;
+ (entry < (struct unw_table_entry *) &ia64_unw_end) &&
+ (entry->start_offset < end);
+ ++entry)
size += 3*8 + 8 + 8*UNW_LENGTH(*(u64 *) (segbase + entry->info_offset));
size += 8; /* reserve space for "end of table" marker */
@@ -2021,7 +2025,10 @@
lp = unw.gate_table;
info = (char *) unw.gate_table + size;
- for (entry = first; entry->start_offset < end; ++entry, lp += 3) {
+ for (entry = first;
+ (entry < (struct unw_table_entry *) &ia64_unw_end) &&
+ (entry->start_offset < end);
+ ++entry, lp += 3) {
info_size = 8 + 8*UNW_LENGTH(*(u64 *) (segbase + entry->info_offset));
info -= info_size;
memcpy(info, (char *) segbase + entry->info_offset, info_size);
[-- Attachment #2: unwind.c.diff --]
[-- Type: application/octet-stream, Size: 1419 bytes --]
diff -Nru linux-2.5.52/arch/ia64/kernel/unwind.c~ linux-2.5.52/arch/ia64/kernel/unwind.c
--- linux-2.5.52/arch/ia64/kernel/unwind.c~ Fri Jan 17 14:53:48 2003
+++ linux-2.5.52/arch/ia64/kernel/unwind.c Fri Jan 17 15:26:58 2003
@@ -1998,6 +1998,7 @@
extern char __start_gate_section[], __stop_gate_section[];
unsigned long *lp, start, end, segbase = unw.kernel_table.segment_base;
const struct unw_table_entry *entry, *first;
+ extern int ia64_unw_end;
size_t info_size, size;
char *info;
@@ -2006,7 +2007,10 @@
size = 0;
first = lookup(&unw.kernel_table, start);
- for (entry = first; entry->start_offset < end; ++entry)
+ for (entry = first;
+ (entry < (struct unw_table_entry *) &ia64_unw_end) &&
+ (entry->start_offset < end);
+ ++entry)
size += 3*8 + 8 + 8*UNW_LENGTH(*(u64 *) (segbase + entry->info_offset));
size += 8; /* reserve space for "end of table" marker */
@@ -2021,7 +2025,10 @@
lp = unw.gate_table;
info = (char *) unw.gate_table + size;
- for (entry = first; entry->start_offset < end; ++entry, lp += 3) {
+ for (entry = first;
+ (entry < (struct unw_table_entry *) &ia64_unw_end) &&
+ (entry->start_offset < end);
+ ++entry, lp += 3) {
info_size = 8 + 8*UNW_LENGTH(*(u64 *) (segbase + entry->info_offset));
info -= info_size;
memcpy(info, (char *) segbase + entry->info_offset, info_size);
next reply other threads:[~2003-01-18 1:52 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2003-01-18 1:52 Siddha, Suresh B [this message]
2003-01-18 7:41 ` [Linux-ia64] [Patch] Fix in unwind.c David Mosberger
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=marc-linux-ia64-105590709805721@msgid-missing \
--to=suresh.b.siddha@intel.com \
--cc=linux-ia64@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox