Re: [x86] Access off the bottom of stack causes a segfault?

[Petr Vandrovec]

On Tue, Oct 14, 2003 at 01:49:04PM -0500, Chris Lattner wrote:
> On Tue, 14 Oct 2003, Chris Lattner wrote:
> > Generated code:
> >         .intel_syntax
> > ...
> > main:
> >         mov DWORD PTR [%ESP - 16004], %EBP    # Save EBP to stack
> >         mov %EBP, %ESP                        # Set up EBP
> >         sub %ESP, 16004                       # Finally adjust ESP
> >         lea %EAX, DWORD PTR [%EBP - 16000]    # Get the address of the array
> > ...
> >         mov %EAX, 0                           # Setup return value
> >         mov %ESP, %EBP                        # restore ESP
> >         mov %EBP, DWORD PTR [%ESP - 16004]    # Restore EBP from stack
> >         ret
> 
> Ok, I found my own "answer": arch/i386/mm/fault.c:
> 
>                 /*
>                  * accessing the stack below %esp is always a bug.
>                  * The "+ 32" is there due to some instructions (like
>                  * pusha) doing post-decrement on the stack and that
>                  * doesn't show up until later..
>                  */
>                 if (address + 32 < regs->esp)
>                         goto bad_area;
> 
> Why exactly is accessing the stack below %esp always a bug?

Any signal can overwrite any value stored below %esp. In kernel
any interrupt/exception can overwrite any value stored below %esp.
Your compiler is broken....
							Petr Vandrovec

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/