[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <Zeg8wRYFemMjcCxG@shell.armlinux.org.uk>
Date: Wed, 6 Mar 2024 09:52:01 +0000
From: "Russell King (Oracle)" <linux@...linux.org.uk>
To: Josh Poimboeuf <jpoimboe@...nel.org>
Cc: Jiangfeng Xiao <xiaojiangfeng@...wei.com>,
Kees Cook <keescook@...omium.org>, Jann Horn <jannh@...gle.com>,
gustavoars@...nel.org, akpm@...ux-foundation.org,
peterz@...radead.org, dave.hansen@...ux.intel.com,
kirill.shutemov@...ux.intel.com, linux-kernel@...r.kernel.org,
linux-hardening@...r.kernel.org, linux-mm@...ck.org,
nixiaoming@...wei.com, kepler.chenxin@...wei.com,
wangbing6@...wei.com, wangfangpeng1@...wei.com,
douzhaolei@...wei.com, linux-arm-kernel@...ts.infradead.org,
Ard Biesheuvel <ardb@...nel.org>
Subject: Re: [PATCH] usercopy: delete __noreturn from usercopy_abort
On Tue, Mar 05, 2024 at 09:58:46AM -0800, Josh Poimboeuf wrote:
> This is an off-by-one bug which is common in unwinders, due to the fact
> that the address on the stack points to the return address rather than
> the call address.
>
> So, for example, when the last instruction of a function is a function
> call (e.g., to a noreturn function), it can cause the unwinder to
> incorrectly try to unwind from the function *after* the callee.
I suppose this can only happen in __noreturn functions because that
can be:
foo:
..
bl bar
.. end of function and thus next function ...
which results in LR pointing into the next function.
Would it make better sense to lookup the LR value winding it back by
one instruction like ORC on x86 does (as you mention) rather than
the patch you proposed which looks rather large and complicated?
--
RMK's Patch system: https://www.armlinux.org.uk/developer/patches/
FTTP is here! 80Mbps down 10Mbps up. Decent connectivity at last!
Powered by blists - more mailing lists