[RFC,v2,01/25] stackdepot: check depot_index before accessing the stack slab

Commit Message

Alexander Potapenko Oct. 30, 2019, 2:22 p.m. UTC

Avoid crashes on corrupted stack ids.

Signed-off-by: Alexander Potapenko <[e-mail]>
To: Alexander Potapenko <[e-mail]>
Cc: Vegard Nossum <[e-mail]>
Cc: Dmitry Vyukov <[e-mail]>
Cc: [e-mail]

---

Change-Id: I0a0b38ed5057090696a2c6ff0be7cfcc24ae6738
---
 lib/stackdepot.c | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

Patch

diff --git a/lib/stackdepot.c b/lib/stackdepot.c
index ed717dd08ff3..0d00d2ac0c4b 100644
--- a/lib/stackdepot.c
+++ b/lib/stackdepot.c
@@ -198,9 +198,22 @@  unsigned int stack_depot_fetch(depot_stack_handle_t handle,
 			       unsigned long **entries)
 {
 	union handle_parts parts = { .handle = handle };
-	void *slab = stack_slabs[parts.slabindex];
+	void *slab;
 	size_t offset = parts.offset << STACK_ALLOC_ALIGN;
-	struct stack_record *stack = slab + offset;
+	struct stack_record *stack;
+
+	if (parts.slabindex > depot_index) {
+		WARN(1, "slab index %d out of bounds (%d) for stack id %08x\n",
+			parts.slabindex, depot_index, handle);
+		__memset(trace, 0, sizeof(*trace));
+		return;
+	}
+	slab = stack_slabs[parts.slabindex];
+	stack = slab + offset;
+	if (!stack) {
+		entries = NULL;
+		return 0;
+	}
 
 	*entries = stack->entries;
 	return stack->size;