[Crash-utility] [PATCH 2/2] Fix again segfault in arm64_is_kernel_exception_frame() when corrupt stack pointer address is given

This is the second trial from the commit 9868ebc8e648e5791764a51567a23efae7170d9b that was reverted at the previous commit. As described in the previous commit, result of STACK_OFFSET_TYPE() can be an address out of bt->stackbuf and hence the address needs to be checked prior to being referred to as an pt_regs object. So, to fix the issue, let's check if stkptr points to within the range of the kernel stack first. Signed-off-by: HATAYAMA Daisuke <d.hatayama(a)fujitsu.com&gt; --- arm64.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/arm64.c b/arm64.c index efbdccb..ca63fb5 100644 --- a/arm64.c +++ b/arm64.c @@ -2381,6 +2381,9 @@ arm64_is_kernel_exception_frame(struct bt_info *bt, ulong stkptr) struct arm64_pt_regs *regs; struct machine_specific *ms = machdep->machspec; + if (stkptr > STACKSIZE() && !INSTACK(stkptr, bt)) + return FALSE; + regs = (struct arm64_pt_regs *)&bt->stackbuf[(ulong)(STACK_OFFSET_TYPE(stkptr))]; if (INSTACK(regs->sp, bt) && INSTACK(regs->regs[29], bt) && -- 2.25.1