On 01.07.2025 04:56, Steven Rostedt wrote:
On Mon, 30 Jun 2025 19:10:09 -0700
Linus Torvalds [off-list ref] wrote:
quoted
On Mon, 30 Jun 2025 at 17:54, Steven Rostedt [off-list ref] wrote:
quoted
+ /* stack going in wrong direction? */
+ if (cfa <= state->sp)
+ goto done;
I suspect this should do a lot more testing.
Sure.
The above assumes:
curr_frame_sp = state->sp
prev_frame_sp = cfa // for arches that define CFA as SP at call site
On s390 the prev_frame_sp may be equal to curr_frame_sp for the topmost
frame, as long as the topmost function did not allocate any stack. For
instance when early in the prologue or when in a leaf function that does
not require any stack space. My s390 sframe support patches would
therefore currently change above check to:
/* stack going in wrong direction? */
if (sp <= state->sp - topmost)
goto done;
I assume that should be the case for all architectures whose function
call instruction does not modify the SP, unlike x86-64's CALL does.
quoted
quoted
+ if (frame->fp_off && get_user(fp, (unsigned long __user *)(cfa + frame->fp_off)))
+ goto done;
.. and this should check the frame for validity too. At a minimum it
should be properly aligned, but things like "it had better be above
the current frame" to avoid having some loop would seem to be a good
idea.
Makes sense.
On s390 the FP (register) value does not necessarily need to be above
the SP value, as the s390x ELF ABI does only designate a "preferred" FP
register, so that the FP register may be used for other purposes, when a
FP is not required in a function.
So the output FP value cannot be checked on s390. But the input FP
value could probably be checked as follows before computing the CFA:
if (frame->use_fp && state->fp < state->sp)
goto done;
/* Get the Canonical Frame Address (CFA) */
cfa = (frame->use_fp ? state->fp : state->sp) + frame->cfa_off;
quoted
Maybe even check that it's the same vma?
Hmm, I call on to Jens Remus and ask if s390 can do anything whacky here?
Where something that isn't allowed on other architectures may be allowed
there? I know s390 has some strange type of stack usage.
On s390, if a FP is required for dynamic stack allocation, it is only
initialized as late as possible, that is usually after static stack
allocation. Therefore SP == FP is rather seldom the case.
Regards,
Jens
--
Jens Remus
Linux on Z Development (D3303)
+49-7031-16-1128 Office
jremus@de.ibm.com
IBM
IBM Deutschland Research & Development GmbH; Vorsitzender des Aufsichtsrats: Wolfgang Wendt; Geschäftsführung: David Faller; Sitz der Gesellschaft: Böblingen; Registergericht: Amtsgericht Stuttgart, HRB 243294
IBM Data Privacy Statement: https://www.ibm.com/privacy/