On 01.07.2025 04:56, Steven Rostedt wrote: > On Mon, 30 Jun 2025 19:10:09 -0700 > Linus Torvalds <torvalds@xxxxxxxxxxxxxxxxxxxx> wrote: >> On Mon, 30 Jun 2025 at 17:54, Steven Rostedt <rostedt@xxxxxxxxxxx> wrote: >>> >>> + /* stack going in wrong direction? */ >>> + if (cfa <= state->sp) >>> + goto done; >> >> I suspect this should do a lot more testing. > > Sure. The above assumes: curr_frame_sp = state->sp prev_frame_sp = cfa // for arches that define CFA as SP at call site On s390 the prev_frame_sp may be equal to curr_frame_sp for the topmost frame, as long as the topmost function did not allocate any stack. For instance when early in the prologue or when in a leaf function that does not require any stack space. My s390 sframe support patches would therefore currently change above check to: /* stack going in wrong direction? */ if (sp <= state->sp - topmost) goto done; I assume that should be the case for all architectures whose function call instruction does not modify the SP, unlike x86-64's CALL does. >>> + if (frame->fp_off && get_user(fp, (unsigned long __user *)(cfa + frame->fp_off))) >>> + goto done; >> >> .. and this should check the frame for validity too. At a minimum it >> should be properly aligned, but things like "it had better be above >> the current frame" to avoid having some loop would seem to be a good >> idea. > > Makes sense. On s390 the FP (register) value does not necessarily need to be above the SP value, as the s390x ELF ABI does only designate a "preferred" FP register, so that the FP register may be used for other purposes, when a FP is not required in a function. So the output FP value cannot be checked on s390. But the input FP value could probably be checked as follows before computing the CFA: if (frame->use_fp && state->fp < state->sp) goto done; /* Get the Canonical Frame Address (CFA) */ cfa = (frame->use_fp ? state->fp : state->sp) + frame->cfa_off; >> Maybe even check that it's the same vma? > > Hmm, I call on to Jens Remus and ask if s390 can do anything whacky here? > Where something that isn't allowed on other architectures may be allowed > there? I know s390 has some strange type of stack usage. On s390, if a FP is required for dynamic stack allocation, it is only initialized as late as possible, that is usually after static stack allocation. Therefore SP == FP is rather seldom the case. Regards, Jens -- Jens Remus Linux on Z Development (D3303) +49-7031-16-1128 Office jremus@xxxxxxxxxx IBM IBM Deutschland Research & Development GmbH; Vorsitzender des Aufsichtsrats: Wolfgang Wendt; Geschäftsführung: David Faller; Sitz der Gesellschaft: Böblingen; Registergericht: Amtsgericht Stuttgart, HRB 243294 IBM Data Privacy Statement: https://www.ibm.com/privacy/
