Arnd Bergmann wrote: > On Tuesday 14 July 2009, Michal Simek wrote: >> Arnd Bergmann wrote: > >>>> r29=00000000, r30=00000000, r31=CE9759A4, rPC=C000123C >>>> msr=800045AE, ear=00000001, esr=000000B2, fsr=000080D0 >>>> Segmentation fault >>>> >>> I guess then you should check if 0xc000123c is in your >>> exception table, or why it is not. >> on that address is load instruction for unaligned exception because addr is >> odd number >> that's why is called unaligned exception handler and from this function >> is called load instruction which failed. :-( >> >> Currently this make more sense why that tests failed. If that pointers are >> even number exception is not taken and exception sure don't have fixup for >> it because >> this is generic code. :-( >> >> That's the problem because we are looking for regs->pc but this point to >> unaligned exception >> handler. > > Ok, that makes a lot of sense. > > The solution then is to handle fixups from the unaligned exception handler > if you come from the kernel. That should fix the three text cases. > > I don't fully understand your exception handling there, but I think you > also need to add code checking for __range_ok() to your unaligned handler, > to prevent malicious user space code from accessing the kernel through > unaligned pointers.
when the code tried to read/write from unaligned address (and in cpu is turn on unaligned exception) then is caused unaligned exception and asm code assemble/return value which is on that unaligned address. (Assemble it that read/write every byte separately). That will be harder to prevent all this cases because unaligned exception is in generic code. What do you mean add __range_ok? Range checking is ok. The problem is when in case get_user kernel try to load unaligned addr - unaligned exception is perform and try to load that value separately. If that page is not there, page fault handler is called and not find it, it is performed search from exception table and that address is not there of course - because address in pc is generic unaligned code. I think that handling this needs more code. Maybe if the address with from unaligned exception handler (there are some address which can caused it) and find out which aligned address is there and find out proper fixup for it. I think that this could work. What do you think? Michal > > Arnd <>< -- Michal Simek, Ing. (M.Eng) w: www.monstr.eu p: +42-0-721842854 ------------------------------------------------------------------------------ Enter the BlackBerry Developer Challenge This is your chance to win up to $100,000 in prizes! For a limited time, vendors submitting new applications to BlackBerry App World(TM) will have the opportunity to enter the BlackBerry Developer Challenge. See full prize details at: http://p.sf.net/sfu/Challenge _______________________________________________ Ltp-list mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/ltp-list
