summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorRabin Vincent <rabin.vincent@stericsson.com>2011-02-09 11:35:12 +0100
committerRussell King <rmk+kernel@arm.linux.org.uk>2011-02-10 15:29:03 +0000
commitcb06199b1df492fcfbaedd2256b5054f944b664f (patch)
tree910e7c88876d5e56be4d4f96dc1ab99868ec047c
parent4a9cb360197684a861bc06f06d33d5fcc8ffcbf5 (diff)
downloadlinux-stable-cb06199b1df492fcfbaedd2256b5054f944b664f.tar.gz
linux-stable-cb06199b1df492fcfbaedd2256b5054f944b664f.tar.bz2
linux-stable-cb06199b1df492fcfbaedd2256b5054f944b664f.zip
ARM: 6654/1: perf/oprofile: fix off-by-one in stack check
Since tail is the previous fp - 1, we need to compare the new fp with tail + 1 to ensure that we don't end up passing in the same tail again, in order to avoid a potential infinite loop in the perf interrupt handler (which has been observed to occur). A similar fix seems to be needed in the OProfile code. Acked-by: Will Deacon <will.deacon@arm.com> Signed-off-by: Rabin Vincent <rabin.vincent@stericsson.com> Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
-rw-r--r--arch/arm/kernel/perf_event.c2
-rw-r--r--arch/arm/oprofile/common.c2
2 files changed, 2 insertions, 2 deletions
diff --git a/arch/arm/kernel/perf_event.c b/arch/arm/kernel/perf_event.c
index 5efa2647a2fb..d150ad1ccb5d 100644
--- a/arch/arm/kernel/perf_event.c
+++ b/arch/arm/kernel/perf_event.c
@@ -700,7 +700,7 @@ user_backtrace(struct frame_tail __user *tail,
* Frame pointers should strictly progress back up the stack
* (towards higher addresses).
*/
- if (tail >= buftail.fp)
+ if (tail + 1 >= buftail.fp)
return NULL;
return buftail.fp - 1;
diff --git a/arch/arm/oprofile/common.c b/arch/arm/oprofile/common.c
index 8aa974491dfc..6adda2b5fa31 100644
--- a/arch/arm/oprofile/common.c
+++ b/arch/arm/oprofile/common.c
@@ -85,7 +85,7 @@ static struct frame_tail* user_backtrace(struct frame_tail *tail)
/* frame pointers should strictly progress back up the stack
* (towards higher addresses) */
- if (tail >= buftail[0].fp)
+ if (tail + 1 >= buftail[0].fp)
return NULL;
return buftail[0].fp-1;