Re: Breakage in arch/mips/kernel/traps.c for 64bit

[tsbogend@xxxxxxxxxxxxxxxx (Thomas Bogendoerfer)]

On Sun, May 04, 2008 at 01:16:47AM +0900, Atsushi Nemoto wrote:
> On Fri, 2 May 2008 11:11:13 +0100, Ralf Baechle <ralf@xxxxxxxxxxxxxx> wrote:
> > It came as part of 39b8d5254246ac56342b72f812255c8f7a74dca9 which is a
> > patch amalgated from several other patches.  Below is the original patch
> > it came with.  I think the idea of the patch is valid but the idea needs a
> > bit of mending.
> 
> Then how about this fix?

hmm, why not simply use __get_user() when accessing the stack content ?
show_stacktrace() already does it for stack dumping ? This would
avoid any work for whatever sick stack mappings. Below is a patch,
which does this.

Thomas.

The newly added check for valid stack pointer address breaks at least for
64bit kernels.  Use __get_user() for accessing stack content to avoid crashes,
when doing the backtrace.

Signed-off-by: Thomas Bogendoerfer <tsbogend@xxxxxxxxxxxxxxxx>
---

 arch/mips/kernel/traps.c |   16 ++++++++--------
 1 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/arch/mips/kernel/traps.c b/arch/mips/kernel/traps.c
index cb8b0e2..c9ce8d6 100644
--- a/arch/mips/kernel/traps.c
+++ b/arch/mips/kernel/traps.c
@@ -81,22 +81,22 @@ void (*board_bind_eic_interrupt)(int irq, int regset);
 
 static void show_raw_backtrace(unsigned long reg29)
 {
-	unsigned long *sp = (unsigned long *)(reg29 & ~3);
+	unsigned long __user *sp = (unsigned long __user *)(reg29 & ~3);
 	unsigned long addr;
 
 	printk("Call Trace:");
 #ifdef CONFIG_KALLSYMS
 	printk("\n");
 #endif
-#define IS_KVA01(a) ((((unsigned int)a) & 0xc0000000) == 0x80000000)
-	if (IS_KVA01(sp)) {
-		while (!kstack_end(sp)) {
-			addr = *sp++;
-			if (__kernel_text_address(addr))
-				print_ip_sym(addr);
+	while (!kstack_end(sp)) {
+		if (__get_user(addr, sp++)) {
+			printk(" (Bad stack address)");
+			break;
 		}
-		printk("\n");
+		if (__kernel_text_address(addr))
+			print_ip_sym(addr);
 	}
+	printk("\n");
 }
 
 #ifdef CONFIG_KALLSYMS

-- 
Crap can work. Given enough thrust pigs will fly, but it's not necessary a
good idea.                                                [ RFC1925, 2.3 ]