Messages in this thread Patch in this message | | | From | Dmitry Monakhov <> | Subject | [PATCH 2/2] x86/unwind/orc: Fix address check size for deref_stack_iret_regs | Date | Tue, 12 Apr 2022 10:40:04 +0300 |
| |
For historical reasons we check only IRET_FRAME_OFFSET, but this check is no longer valid because we also access regs->sp field which is located beyond IRET_FRAME, so it is reasonable to validate full structure.
Signed-off-by: Dmitry Monakhov <dmtrmonakhov@yandex-team.ru> --- arch/x86/kernel/unwind_orc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/x86/kernel/unwind_orc.c b/arch/x86/kernel/unwind_orc.c index 80b878772b86..a249ecabe689 100644 --- a/arch/x86/kernel/unwind_orc.c +++ b/arch/x86/kernel/unwind_orc.c @@ -379,7 +379,7 @@ static bool deref_stack_iret_regs(struct unwind_state *state, unsigned long addr { struct pt_regs *regs = (void *)addr - IRET_FRAME_OFFSET; - if (!stack_access_ok(state, addr, IRET_FRAME_SIZE)) + if (!stack_access_ok(state, addr, sizeof(struct pt_regs))) return false; *ip = READ_ONCE_NOCHECK(regs->ip); -- 2.7.4
| |