[AVR32] show_trace: Only walk valid stack addresses

Terminate the frame pointer walk if (a) the address is outside the
task's kernel stack or (b) if the frame pointer isn't monotonically
increasing. Without this fix, show_trace() may enter an infinite
loop, walking through random data anywhere in memory.

Since any address within the kernel stack is guaranteed to be valid,
we may eliminate the __get_user() calls as well.

Signed-off-by: Haavard Skinnemoen <hskinnemoen@atmel.com>

arch/avr32/kernel/traps.c

@@ -49,39 +49,45 @@ out:
 	return;
 }
 
+static inline int valid_stack_ptr(struct thread_info *tinfo, unsigned long p)
+{
+	return (p > (unsigned long)tinfo)
+		&& (p < (unsigned long)tinfo + THREAD_SIZE - 3);
+}
+
 #ifdef CONFIG_FRAME_POINTER
 static inline void __show_trace(struct task_struct *tsk, unsigned long *sp,
 				struct pt_regs *regs)
 {
-	unsigned long __user *fp;
+	unsigned long lr, fp;
-	unsigned long __user *last_fp = NULL;
+	struct thread_info *tinfo;
 
-	if (regs) {
+	tinfo = (struct thread_info *)
-		fp = (unsigned long __user *)regs->r7;
+		((unsigned long)sp & ~(THREAD_SIZE - 1));
-	} else if (tsk == current) {
+
-		register unsigned long __user *real_fp __asm__("r7");
+	if (regs)
-		fp = real_fp;
+		fp = regs->r7;
-	} else {
+	else if (tsk == current)
-		fp = (unsigned long __user *)tsk->thread.cpu_context.r7;
+		asm("mov %0, r7" : "=r"(fp));
-	}
+	else
+		fp = tsk->thread.cpu_context.r7;
 
 	/*
-	 * Walk the stack until (a) we get an exception, (b) the frame
+	 * Walk the stack as long as the frame pointer (a) is within
-	 * pointer becomes zero, or (c) the frame pointer gets stuck
+	 * the kernel stack of the task, and (b) it doesn't move
-	 * at the same value.
+	 * downwards.
 	 */
-	while (fp && fp != last_fp) {
+	while (valid_stack_ptr(tinfo, fp)) {
-		unsigned long lr, new_fp = 0;
+		unsigned long new_fp;
-
-		last_fp = fp;
-		if (__get_user(lr, fp))
-			break;
-		if (fp && __get_user(new_fp, fp + 1))
-			break;
-		fp = (unsigned long __user *)new_fp;
 
+		lr = *(unsigned long *)fp;
 		printk(" [<%08lx>] ", lr);
 		print_symbol("%s\n", lr);
+
+		new_fp = *(unsigned long *)(fp + 4);
+		if (new_fp <= fp)
+			break;
+		fp = new_fp;
 	}
 	printk("\n");
 }