From 0f48bfb53e253d1f6ac36c83ac4d19ea3bf36dfd Mon Sep 17 00:00:00 2001 From: maxv Date: Sat, 6 Jun 2020 07:03:21 +0000 Subject: [PATCH] If the frame is not aligned, leave right away. This place probably needs to be revisited, because %rbp could easily contain garbage. Reported-by: syzbot+ecb40cf7f8acc102c29b@syzkaller.appspotmail.com --- sys/arch/amd64/amd64/db_machdep.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/sys/arch/amd64/amd64/db_machdep.c b/sys/arch/amd64/amd64/db_machdep.c index a9749fb9cb4f..ae1df3789316 100644 --- a/sys/arch/amd64/amd64/db_machdep.c +++ b/sys/arch/amd64/amd64/db_machdep.c @@ -1,4 +1,4 @@ -/* $NetBSD: db_machdep.c,v 1.7 2020/05/14 16:57:53 maxv Exp $ */ +/* $NetBSD: db_machdep.c,v 1.8 2020/06/06 07:03:21 maxv Exp $ */ /* * Mach Operating System @@ -26,7 +26,7 @@ * rights to redistribute these changes. */ #include -__KERNEL_RCSID(0, "$NetBSD: db_machdep.c,v 1.7 2020/05/14 16:57:53 maxv Exp $"); +__KERNEL_RCSID(0, "$NetBSD: db_machdep.c,v 1.8 2020/06/06 07:03:21 maxv Exp $"); #include #include @@ -151,6 +151,8 @@ db_nextframe(long **nextframe, long **retaddr, long **arg0, db_addr_t *ip, db_get_value((long)&tf->tf_rbp, 8, false); if (fp == NULL) return 0; + if (((uintptr_t)fp & 7) != 0) + return 0; *nextframe = (long *)&fp->f_frame; *retaddr = (long *)&fp->f_retaddr; *arg0 = (long *)&fp->f_arg0;