summaryrefslogtreecommitdiff
path: root/security
diff options
context:
space:
mode:
authorIlya Leoshkevich <iii@linux.ibm.com>2023-10-10 23:20:09 +0300
committerDaniel Borkmann <daniel@iogearbox.net>2023-10-11 01:08:34 +0300
commitce10fc0604bc6a0d626ed8e5d69088057edc71ab (patch)
tree161c940d7f0242d2a89a1f5580caea4f3aedc0cd /security
parent57ddeb86b311ff41925e0fac7b983c097336f1f3 (diff)
downloadlinux-ce10fc0604bc6a0d626ed8e5d69088057edc71ab.tar.xz
s390/bpf: Fix clobbering the caller's backchain in the trampoline
One of the first things that s390x kernel functions do is storing the the caller's frame address (backchain) on stack. This makes unwinding possible. The backchain is always stored at frame offset 152, which is inside the 160-byte stack area, that the functions allocate for their callees. The callees must preserve the backchain; the remaining 152 bytes they may use as they please. Currently the trampoline uses all 160 bytes, clobbering the backchain. This causes kernel panics when using __builtin_return_address() in functions called by the trampoline. Fix by reducing the usage of the caller-reserved stack area by 8 bytes in the trampoline. Fixes: 528eb2cb87bc ("s390/bpf: Implement arch_prepare_bpf_trampoline()") Reported-by: Song Liu <song@kernel.org> Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Link: https://lore.kernel.org/bpf/20231010203512.385819-2-iii@linux.ibm.com
Diffstat (limited to 'security')
0 files changed, 0 insertions, 0 deletions