ARM: 6654/1: perf/oprofile: fix off-by-one in stack check (cb06199b) · Commits · 戴 / test

Since tail is the previous fp - 1, we need to compare the new fp with tail + 1 to ensure that we don't end up passing in the same tail again, in order to avoid a potential infinite loop in the perf interrupt handler (which has been observed to occur). A similar fix seems to be needed in the OProfile code. Acked-by:

Will Deacon <will.deacon@arm.com> Signed-off-by:

Rabin Vincent <rabin.vincent@stericsson.com> Signed-off-by:

Russell King <rmk+kernel@arm.linux.org.uk>

arch/arm/kernel/perf_event.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -700,7 +700,7 @@ user_backtrace(struct frame_tail __user *tail,
		* Frame pointers should strictly progress back up the stack
		* (towards higher addresses).
		*/
		if (tail >= buftail.fp)
		if (tail + 1 >= buftail.fp)
		return NULL;

		return buftail.fp - 1;

arch/arm/oprofile/common.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -85,7 +85,7 @@ static struct frame_tail* user_backtrace(struct frame_tail *tail)

		/* frame pointers should strictly progress back up the stack
		* (towards higher addresses) */
		if (tail >= buftail[0].fp)
		if (tail + 1 >= buftail[0].fp)
		return NULL;

		return buftail[0].fp-1;

Admin message