Messages in this thread | ![/](/images/icornerl.gif) | | Date | Tue, 14 Oct 2003 13:49:04 -0500 (CDT) | From | Chris Lattner <> | Subject | Re: [x86] Access off the bottom of stack causes a segfault? |
| |
On Tue, 14 Oct 2003, Chris Lattner wrote: > Generated code: > .intel_syntax > ... > main: > mov DWORD PTR [%ESP - 16004], %EBP # Save EBP to stack > mov %EBP, %ESP # Set up EBP > sub %ESP, 16004 # Finally adjust ESP > lea %EAX, DWORD PTR [%EBP - 16000] # Get the address of the array > ... > mov %EAX, 0 # Setup return value > mov %ESP, %EBP # restore ESP > mov %EBP, DWORD PTR [%ESP - 16004] # Restore EBP from stack > ret
Ok, I found my own "answer": arch/i386/mm/fault.c:
/* * accessing the stack below %esp is always a bug. * The "+ 32" is there due to some instructions (like * pusha) doing post-decrement on the stack and that * doesn't show up until later.. */ if (address + 32 < regs->esp) goto bad_area;
Why exactly is accessing the stack below %esp always a bug?
-Chris
-- http://llvm.cs.uiuc.edu/ http://www.nondot.org/~sabre/Projects/
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| ![\](/images/icornerr.gif) |