Check that the frame pointer is within the current stack.

[jhb]

Summary

This same check is used on other architectures. Previously this would
permit a stack frame to unwind into any arbitrary kernel address
(including unmapped addresses).

Test Plan

• in a CHERI kernel where the stack uses a pointer with bounds, this was faulting when it tried to read off the end of the stack inside ddb

[mhorne]

I was investigating a panic recently encountered on the Jenkins run of the test suite, and ended up with an identical patch.

While I haven't had any luck reproducing the issue, the excerpt (P412) shows recursive panics in unwind_frame(), so I strongly suspect this is the cause.

Note that arm64 might benefit from this check as well, but that code has been in widespread use for a while now and has seemingly never encountered this.

[jhb]

In D25996#576826, @mhorne wrote:

I was investigating a panic recently encountered on the Jenkins run of the test suite, and ended up with an identical patch.

While I haven't had any luck reproducing the issue, the excerpt (P412) shows recursive panics in unwind_frame(), so I strongly suspect this is the cause.

Note that arm64 might benefit from this check as well, but that code has been in widespread use for a while now and has seemingly never encountered this.

arm64 almost certainly needs the same check. Tagging @andrew so he sees this.

[andrew]

On arm64 we have the following in fork_trampoline to stop unwinding past the top of the stack.

mov     fp, #0  /* Stack traceback stops here. */

[jhb]

In D25996#578091, @andrew wrote:

On arm64 we have the following in fork_trampoline to stop unwinding past the top of the stack.

mov     fp, #0  /* Stack traceback stops here. */

Yes, but you will want to validate that the frame pointer is contained in td_kstack and not random garbage. It is much nicer to have ddb abort the trace when the frame pointer goes off in the weeds due to the stack being trashed than to have it do a nested fault in ddb, or worse, do a fault in stack_capture() that turns into a kernel panic.