[Linux-ia64] [Patch] Fix in unwind.c

[Linux-ia64] [Patch] Fix in unwind.c

[Siddha, Suresh B]

[-- Attachment #1: Type: text/plain, Size: 2297 bytes --]

Current code in unw_create_gate_table() looks like this:

start = (unsigned long) __start_gate_section - segbase;
end   = (unsigned long) __stop_gate_section - segbase;
size  = 0;
first = lookup(&unw.kernel_table, start);
for (entry = first; entry->start_offset < end; ++entry)
                size += 3*8 + 8 + 8*UNW_LENGTH(*(u64 *) (segbase + entry->info_offset));

Code starts with first unwind kernel table entry for the gate page and goes through all the gate page unwind table entries. Assume if all the gate page unwind table entries comes to the end of kernel unwind table(typically this is what happens because of  the order in vmlinux.lds.S), then there is a chance that we go past beyond the kernel unwind table and resulting in a fault while we access "segbase +  entry->info_offset". 

Attached/appended patch fixes this problem.

thanks,
suresh

diff -Nru linux-2.5.52/arch/ia64/kernel/unwind.c~ linux-2.5.52/arch/ia64/kernel/unwind.c
--- linux-2.5.52/arch/ia64/kernel/unwind.c~	Fri Jan 17 14:53:48 2003
+++ linux-2.5.52/arch/ia64/kernel/unwind.c	Fri Jan 17 15:26:58 2003
@@ -1998,6 +1998,7 @@
 	extern char __start_gate_section[], __stop_gate_section[];
 	unsigned long *lp, start, end, segbase = unw.kernel_table.segment_base;
 	const struct unw_table_entry *entry, *first;
+	extern int ia64_unw_end;
 	size_t info_size, size;
 	char *info;
 
@@ -2006,7 +2007,10 @@
 	size  = 0;
 	first = lookup(&unw.kernel_table, start);
 
-	for (entry = first; entry->start_offset < end; ++entry)
+	for (entry = first; 
+	     (entry < (struct unw_table_entry *) &ia64_unw_end) && 
+	     (entry->start_offset < end); 
+	     ++entry)
 		size += 3*8 + 8 + 8*UNW_LENGTH(*(u64 *) (segbase + entry->info_offset));
 	size += 8;	/* reserve space for "end of table" marker */
 
@@ -2021,7 +2025,10 @@
 	lp = unw.gate_table;
 	info = (char *) unw.gate_table + size;
 
-	for (entry = first; entry->start_offset < end; ++entry, lp += 3) {
+	for (entry = first; 
+	     (entry < (struct unw_table_entry *) &ia64_unw_end) && 
+	     (entry->start_offset < end); 
+	     ++entry, lp += 3) {
 		info_size = 8 + 8*UNW_LENGTH(*(u64 *) (segbase + entry->info_offset));
 		info -= info_size;
 		memcpy(info, (char *) segbase + entry->info_offset, info_size);


[-- Attachment #2: unwind.c.diff --]
[-- Type: application/octet-stream, Size: 1419 bytes --]

diff -Nru linux-2.5.52/arch/ia64/kernel/unwind.c~ linux-2.5.52/arch/ia64/kernel/unwind.c
--- linux-2.5.52/arch/ia64/kernel/unwind.c~	Fri Jan 17 14:53:48 2003
+++ linux-2.5.52/arch/ia64/kernel/unwind.c	Fri Jan 17 15:26:58 2003
@@ -1998,6 +1998,7 @@
 	extern char __start_gate_section[], __stop_gate_section[];
 	unsigned long *lp, start, end, segbase = unw.kernel_table.segment_base;
 	const struct unw_table_entry *entry, *first;
+	extern int ia64_unw_end;
 	size_t info_size, size;
 	char *info;
 
@@ -2006,7 +2007,10 @@
 	size  = 0;
 	first = lookup(&unw.kernel_table, start);
 
-	for (entry = first; entry->start_offset < end; ++entry)
+	for (entry = first; 
+	     (entry < (struct unw_table_entry *) &ia64_unw_end) && 
+	     (entry->start_offset < end); 
+	     ++entry)
 		size += 3*8 + 8 + 8*UNW_LENGTH(*(u64 *) (segbase + entry->info_offset));
 	size += 8;	/* reserve space for "end of table" marker */
 
@@ -2021,7 +2025,10 @@
 	lp = unw.gate_table;
 	info = (char *) unw.gate_table + size;
 
-	for (entry = first; entry->start_offset < end; ++entry, lp += 3) {
+	for (entry = first; 
+	     (entry < (struct unw_table_entry *) &ia64_unw_end) && 
+	     (entry->start_offset < end); 
+	     ++entry, lp += 3) {
 		info_size = 8 + 8*UNW_LENGTH(*(u64 *) (segbase + entry->info_offset));
 		info -= info_size;
 		memcpy(info, (char *) segbase + entry->info_offset, info_size);

Re: [Linux-ia64] [Patch] Fix in unwind.c

[David Mosberger]

>>>>> On Fri, 17 Jan 2003 17:52:18 -0800, "Siddha, Suresh B" <suresh.b.siddha@intel.com> said:

  Suresh> Current code in unw_create_gate_table() looks like this:
  Suresh> start = (unsigned long) __start_gate_section - segbase; end
  Suresh> = (unsigned long) __stop_gate_section - segbase; size = 0;
  Suresh> first = lookup(&unw.kernel_table, start); for (entry   Suresh> first; entry->start_offset < end; ++entry) size += 3*8 + 8 +
  Suresh> 8*UNW_LENGTH(*(u64 *) (segbase + entry->info_offset));

  Suresh> Code starts with first unwind kernel table entry for the
  Suresh> gate page and goes through all the gate page unwind table
  Suresh> entries. Assume if all the gate page unwind table entries
  Suresh> comes to the end of kernel unwind table(typically this is
  Suresh> what happens because of the order in vmlinux.lds.S), then
  Suresh> there is a chance that we go past beyond the kernel unwind
  Suresh> table and resulting in a fault while we access "segbase +
  Suresh> entry->info_offset".

Yes, I agree that's a bug.  I fixed it in the source code, though
slightly differently from what you had in the patch.

Thanks,

	--david