-- Edit with latest update on the problem, it is not solved yet :( --
While playing with an ARM embedded Linux system (Version 3.8.13), out of curiosity, I created a small "debug" kernel module.
This "debug" module branches a specific flow in another kernel module to a function in this "debug" module, which executes some logic and then resumes execution peacefully.
To avoid clutter of the stack area, the first executed logic is changing SP to point at an empty area inside the "debug" module code section.
The system crashes couple of seconds after executing
mov sp, r2, and entering an infinite loop. (
r2 holds the address to the empty area).
Note that the crash happens before the "debug" module executes any stack-related opcode (or actually any other opcode, for that matter).
So I conducted the following checks:
- Made sure the address is 4-byte aligned
- Changed area to write-able, and big enough to hold a full context switch that is saved on the stack (about 0x300 bytes)
spvalue by small amounts (+-0x100) - did not crash the system
spto some arbitrary value - crashed the system.
spmomentarily and then immediately restoring its value does not crash the system
spmomentarily, executing an STMFD operation and then immediately restoring
sp's value does not crash the system!
From the last test, it's pretty clear that when a context-switch happens, some values are being saved on the stack. If it points to that free area, the system crashes
It seems that there isn't any problem with using stack operations on the free area, but yet when some context-switch happens, the system crashes.
- Is there a constraint on possible values of the
spregister? (Kernel configuration, perhaps? Specific bits of the address?)
- The code section has some sort of protection against being used as a stack when used outside of the current module?
- Context-switch requires more than 0x300 bytes of space?