arch: cortex-m: defend against large stack pointer #2723
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
If the stack pointer is really large the sp + frame_size arithmetic can overflow, negating the check. Use .saturating_add() instead. In the print context function rather than returning we now use dummy values so the user still gets the register printout for what _is_ valid. Also check for 4 byte alignment. I think that is a good idea.
alistair23
previously approved these changes
Aug 4, 2021
hudson-ayers
previously approved these changes
Aug 4, 2021
There was a problem hiding this comment.
These changes look good, though I seem to recall us concluding that there was no need to check stack pointer alignment last time we looked at this: #2478
lschuermann
previously approved these changes
Aug 4, 2021
We do not need to check the stack pointer alignment because the cortex-m hardware guarantees it will ensure the stack pointer is aligned on any exception or svc call. See #2478 for more detail.
1089413
|
I removed the alignment check since hardware guarantees alignment. |
hudson-ayers
approved these changes
Aug 5, 2021
|
bors r+ |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
If the stack pointer is really large the sp + frame_size arithmetic can overflow, negating the check. Use .saturating_add() instead.
In the print context function rather than returning we now use dummy values so the user still gets the register printout for what is valid.
Also check for 4 byte alignment. I think that is a good idea.
I found this by playing with the new tockloader features:
tockloader tbf-delete-tlv 8andtockloader tbf-modify-tlv 1 init_fn_offset 53. I found that if I corrupted the init fn offset in the right way I got a kernel crash.Testing Strategy
Running c_hello with a corrupted init fn offset and verifying the printout works as expected. Looks like:
TODO or Help Wanted
Should we check for 4 byte alignment?
Documentation Updated
/docs, or no updates are required.Formatting
make prepush.