Re: [x86] Access off the bottom of stack causes a segfault?

[Chris Lattner]

On Tue, 14 Oct 2003, Chris Lattner wrote:
> Generated code:
>         .intel_syntax
> ...
> main:
>         mov DWORD PTR [%ESP - 16004], %EBP    # Save EBP to stack
>         mov %EBP, %ESP                        # Set up EBP
>         sub %ESP, 16004                       # Finally adjust ESP
>         lea %EAX, DWORD PTR [%EBP - 16000]    # Get the address of the array
> ...
>         mov %EAX, 0                           # Setup return value
>         mov %ESP, %EBP                        # restore ESP
>         mov %EBP, DWORD PTR [%ESP - 16004]    # Restore EBP from stack
>         ret

Ok, I found my own "answer": arch/i386/mm/fault.c:

                /*
                 * accessing the stack below %esp is always a bug.
                 * The "+ 32" is there due to some instructions (like
                 * pusha) doing post-decrement on the stack and that
                 * doesn't show up until later..
                 */
                if (address + 32 < regs->esp)
                        goto bad_area;

Why exactly is accessing the stack below %esp always a bug?

-Chris

-- 
http://llvm.cs.uiuc.edu/
http://www.nondot.org/~sabre/Projects/

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/