On 01.07.2025 04:56, Steven Rostedt wrote:
> On Mon, 30 Jun 2025 19:10:09 -0700
> Linus Torvalds <[email protected]> wrote:
>> On Mon, 30 Jun 2025 at 17:54, Steven Rostedt <[email protected]> wrote:
>>>
>>> + /* stack going in wrong direction? */
>>> + if (cfa <= state->sp)
>>> + goto done;
>>
>> I suspect this should do a lot more testing.
>
> Sure.
The above assumes:
curr_frame_sp = state->sp
prev_frame_sp = cfa // for arches that define CFA as SP at call site
On s390 the prev_frame_sp may be equal to curr_frame_sp for the topmost
frame, as long as the topmost function did not allocate any stack. For
instance when early in the prologue or when in a leaf function that does
not require any stack space. My s390 sframe support patches would
therefore currently change above check to:
/* stack going in wrong direction? */
if (sp <= state->sp - topmost)
goto done;
I assume that should be the case for all architectures whose function
call instruction does not modify the SP, unlike x86-64's CALL does.
>>> + if (frame->fp_off && get_user(fp, (unsigned long __user *)(cfa +
>>> frame->fp_off)))
>>> + goto done;
>>
>> .. and this should check the frame for validity too. At a minimum it
>> should be properly aligned, but things like "it had better be above
>> the current frame" to avoid having some loop would seem to be a good
>> idea.
>
> Makes sense.
On s390 the FP (register) value does not necessarily need to be above
the SP value, as the s390x ELF ABI does only designate a "preferred" FP
register, so that the FP register may be used for other purposes, when a
FP is not required in a function.
So the output FP value cannot be checked on s390. But the input FP
value could probably be checked as follows before computing the CFA:
if (frame->use_fp && state->fp < state->sp)
goto done;
/* Get the Canonical Frame Address (CFA) */
cfa = (frame->use_fp ? state->fp : state->sp) + frame->cfa_off;
>> Maybe even check that it's the same vma?
>
> Hmm, I call on to Jens Remus and ask if s390 can do anything whacky here?
> Where something that isn't allowed on other architectures may be allowed
> there? I know s390 has some strange type of stack usage.
On s390, if a FP is required for dynamic stack allocation, it is only
initialized as late as possible, that is usually after static stack
allocation. Therefore SP == FP is rather seldom the case.
Regards,
Jens
--
Jens Remus
Linux on Z Development (D3303)
+49-7031-16-1128 Office
[email protected]
IBM
IBM Deutschland Research & Development GmbH; Vorsitzender des Aufsichtsrats:
Wolfgang Wendt; Geschäftsführung: David Faller; Sitz der Gesellschaft:
Böblingen; Registergericht: Amtsgericht Stuttgart, HRB 243294
IBM Data Privacy Statement: https://www.ibm.com/privacy/
