diff options
| author | Rabin Vincent <rabin.vincent@stericsson.com> | 2011-02-09 11:35:12 +0100 |
|---|---|---|
| committer | Russell King <rmk+kernel@arm.linux.org.uk> | 2011-02-10 15:29:03 +0000 |
| commit | cb06199b1df492fcfbaedd2256b5054f944b664f (patch) | |
| tree | 910e7c88876d5e56be4d4f96dc1ab99868ec047c /arch/arm | |
| parent | 4a9cb360197684a861bc06f06d33d5fcc8ffcbf5 (diff) | |
| download | op-kernel-dev-cb06199b1df492fcfbaedd2256b5054f944b664f.zip op-kernel-dev-cb06199b1df492fcfbaedd2256b5054f944b664f.tar.gz | |
ARM: 6654/1: perf/oprofile: fix off-by-one in stack check
Since tail is the previous fp - 1, we need to compare the new fp with tail + 1
to ensure that we don't end up passing in the same tail again, in order to
avoid a potential infinite loop in the perf interrupt handler (which has been
observed to occur). A similar fix seems to be needed in the OProfile code.
Acked-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Rabin Vincent <rabin.vincent@stericsson.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Diffstat (limited to 'arch/arm')
| -rw-r--r-- | arch/arm/kernel/perf_event.c | 2 | ||||
| -rw-r--r-- | arch/arm/oprofile/common.c | 2 |
2 files changed, 2 insertions, 2 deletions
diff --git a/arch/arm/kernel/perf_event.c b/arch/arm/kernel/perf_event.c index 5efa264..d150ad1 100644 --- a/arch/arm/kernel/perf_event.c +++ b/arch/arm/kernel/perf_event.c @@ -700,7 +700,7 @@ user_backtrace(struct frame_tail __user *tail, * Frame pointers should strictly progress back up the stack * (towards higher addresses). */ - if (tail >= buftail.fp) + if (tail + 1 >= buftail.fp) return NULL; return buftail.fp - 1; diff --git a/arch/arm/oprofile/common.c b/arch/arm/oprofile/common.c index 8aa9744..6adda2b 100644 --- a/arch/arm/oprofile/common.c +++ b/arch/arm/oprofile/common.c @@ -85,7 +85,7 @@ static struct frame_tail* user_backtrace(struct frame_tail *tail) /* frame pointers should strictly progress back up the stack * (towards higher addresses) */ - if (tail >= buftail[0].fp) + if (tail + 1 >= buftail[0].fp) return NULL; return buftail[0].fp-1; |
