Messages in this thread | | | Date | Tue, 14 Oct 2003 20:42:21 +0200 | From | Petr Vandrovec <> | Subject | Re: [x86] Access off the bottom of stack causes a segfault? |
| |
On Tue, Oct 14, 2003 at 01:49:04PM -0500, Chris Lattner wrote: > On Tue, 14 Oct 2003, Chris Lattner wrote: > > Generated code: > > .intel_syntax > > ... > > main: > > mov DWORD PTR [%ESP - 16004], %EBP # Save EBP to stack > > mov %EBP, %ESP # Set up EBP > > sub %ESP, 16004 # Finally adjust ESP > > lea %EAX, DWORD PTR [%EBP - 16000] # Get the address of the array > > ... > > mov %EAX, 0 # Setup return value > > mov %ESP, %EBP # restore ESP > > mov %EBP, DWORD PTR [%ESP - 16004] # Restore EBP from stack > > ret > > Ok, I found my own "answer": arch/i386/mm/fault.c: > > /* > * accessing the stack below %esp is always a bug. > * The "+ 32" is there due to some instructions (like > * pusha) doing post-decrement on the stack and that > * doesn't show up until later.. > */ > if (address + 32 < regs->esp) > goto bad_area; > > Why exactly is accessing the stack below %esp always a bug?
Any signal can overwrite any value stored below %esp. In kernel any interrupt/exception can overwrite any value stored below %esp. Your compiler is broken.... Petr Vandrovec
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |