From cb06199b1df492fcfbaedd2256b5054f944b664f Mon Sep 17 00:00:00 2001 From: Rabin Vincent Date: Wed, 9 Feb 2011 11:35:12 +0100 Subject: ARM: 6654/1: perf/oprofile: fix off-by-one in stack check Since tail is the previous fp - 1, we need to compare the new fp with tail + 1 to ensure that we don't end up passing in the same tail again, in order to avoid a potential infinite loop in the perf interrupt handler (which has been observed to occur). A similar fix seems to be needed in the OProfile code. Acked-by: Will Deacon Signed-off-by: Rabin Vincent Signed-off-by: Russell King diff --git a/arch/arm/kernel/perf_event.c b/arch/arm/kernel/perf_event.c index 5efa264..d150ad1 100644 --- a/arch/arm/kernel/perf_event.c +++ b/arch/arm/kernel/perf_event.c @@ -700,7 +700,7 @@ user_backtrace(struct frame_tail __user *tail, * Frame pointers should strictly progress back up the stack * (towards higher addresses). */ - if (tail >= buftail.fp) + if (tail + 1 >= buftail.fp) return NULL; return buftail.fp - 1; diff --git a/arch/arm/oprofile/common.c b/arch/arm/oprofile/common.c index 8aa9744..6adda2b 100644 --- a/arch/arm/oprofile/common.c +++ b/arch/arm/oprofile/common.c @@ -85,7 +85,7 @@ static struct frame_tail* user_backtrace(struct frame_tail *tail) /* frame pointers should strictly progress back up the stack * (towards higher addresses) */ - if (tail >= buftail[0].fp) + if (tail + 1 >= buftail[0].fp) return NULL; return buftail[0].fp-1; -- cgit v0.10.2