From: Benjamin Herrenschmidt <benh@kernel.crashing.org> Date: 2006-11-01 03:11:07
The alignment exception used to only check the exception table for
-EFAULT, not for other errors. That opens an oops window if we can
coerce the kernel into getting an alignment exception for other reasons
in what would normally be a user-protected accessor, which can be done
via some of the futex ops. This fixes it by always checking the
exception tables.
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
---
This is 2.6.19 material and should probably go into stable as well.
(Greg: take it if paulus acks it and it applies :)
Index: linux-work/arch/powerpc/kernel/traps.c
===================================================================
From: Benjamin Herrenschmidt <benh@kernel.crashing.org> Date: 2006-11-01 03:43:54
The alignment exception used to only check the exception table for
-EFAULT, not for other errors. That opens an oops window if we can
coerce the kernel into getting an alignment exception for other reasons
in what would normally be a user-protected accessor, which can be done
via some of the futex ops. This fixes it by always checking the
exception tables.
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
---
Paul: this version also fixes arch/ppc
This is 2.6.19 material and should probably go into stable as well.
(Greg: take it if paulus acks it and it applies :)
Index: linux-work/arch/powerpc/kernel/traps.c
===================================================================
@@ -716,15 +716,11 @@ void alignment_exception(struct pt_regs emulate_single_step(regs);return;}-if(fixed==-EFAULT){-/* fixed == -EFAULT means the operand address was bad */-if(user_mode(regs))-_exception(SIGSEGV,regs,SEGV_ACCERR,regs->dar);-else-bad_page_fault(regs,regs->dar,SIGSEGV);-return;-}-_exception(SIGBUS,regs,BUS_ADRALN,regs->dar);+sig=fixed==-EFAULT?SIGSEGV:SIGBUS;+if(user_mode(regs))+_exception(sig,regs,SEGV_ACCERR,regs->dar);+else+bad_page_fault(regs,regs->dar,sig);}voidStackOverflow(structpt_regs*regs)
From: Benjamin Herrenschmidt <benh@kernel.crashing.org> Date: 2006-11-01 04:13:13
The alignment exception used to only check the exception table for
-EFAULT, not for other errors. That opens an oops window if we can
coerce the kernel into getting an alignment exception for other reasons
in what would normally be a user-protected accessor, which can be done
via some of the futex ops. This fixes it by always checking the
exception tables.
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
---
Paul: this version sets the correct si_code
This is 2.6.19 material and should probably go into stable as well.
(Greg: take it if paulus acks it and it applies :)
Index: linux-work/arch/powerpc/kernel/traps.c
===================================================================
@@ -717,14 +717,16 @@ void alignment_exception(struct pt_regs return;}if(fixed==-EFAULT){-/* fixed == -EFAULT means the operand address was bad */-if(user_mode(regs))-_exception(SIGSEGV,regs,SEGV_ACCERR,regs->dar);-else-bad_page_fault(regs,regs->dar,SIGSEGV);-return;+sig=SIGSEGV;+code=SEGV_ACCERR;+}else{+sig=SIGBUS;+code=BUS_ADRALN;}-_exception(SIGBUS,regs,BUS_ADRALN,regs->dar);+if(user_mode(regs))+_exception(sig,regs,code,regs->dar);+else+bad_page_fault(regs,regs->dar,sig);}voidStackOverflow(structpt_regs*regs)
On Wed, Nov 01, 2006 at 02:09:30PM +1100, Benjamin Herrenschmidt wrote:
The alignment exception used to only check the exception table for
-EFAULT, not for other errors. That opens an oops window if we can
coerce the kernel into getting an alignment exception for other reasons
in what would normally be a user-protected accessor, which can be done
via some of the futex ops. This fixes it by always checking the
exception tables.
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
---
This is 2.6.19 material and should probably go into stable as well.
(Greg: take it if paulus acks it and it applies :)
Please forward the final patch (which ever version it is :) to the
stable@kernel.org address when this goes into mainline.
thanks,
greg k-h
From: Benjamin Herrenschmidt <benh@kernel.crashing.org> Date: 2006-11-01 20:44:45
On Tue, 2006-10-31 at 22:34 -0800, Greg KH wrote:
On Wed, Nov 01, 2006 at 02:09:30PM +1100, Benjamin Herrenschmidt wrote:
quoted
The alignment exception used to only check the exception table for
-EFAULT, not for other errors. That opens an oops window if we can
coerce the kernel into getting an alignment exception for other reasons
in what would normally be a user-protected accessor, which can be done
via some of the futex ops. This fixes it by always checking the
exception tables.
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
---
This is 2.6.19 material and should probably go into stable as well.
(Greg: take it if paulus acks it and it applies :)
Please forward the final patch (which ever version it is :) to the
stable@kernel.org address when this goes into mainline.
Ok, will do. I wan't sure what the proper procedure was.
Cheers,
Ben.