No description
  • C 98.2%
  • Assembly 1%
  • Makefile 0.3%
  • Shell 0.2%
  • Python 0.1%
Find a file
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Mikulas Patocka 1a2f728b03 parisc: fix crash with signals and alloca
commit 030f653078316a9cc9ca6bd1b0234dcf858be35d upstream.

I was debugging some crashes on parisc and I found out that there is a
crash possibility if a function using alloca is interrupted by a signal.
The reason for the crash is that the gcc alloca implementation leaves
garbage in the upper 32 bits of the sp register. This normally doesn't
matter (the upper bits are ignored because the PSW W-bit is clear),
however the signal delivery routine in the kernel uses full 64 bits of sp
and it fails with -EFAULT if the upper 32 bits are not zero.

I created this program that demonstrates the problem:

#include <stdlib.h>
#include <unistd.h>
#include <signal.h>
#include <alloca.h>

static __attribute__((noinline,noclone)) void aa(int *size)
{
	void * volatile p = alloca(-*size);
	while (1) ;
}

static void handler(int sig)
{
	write(1, "signal delivered\n", 17);
	_exit(0);
}

int main(void)
{
	int size = -0x100;
	signal(SIGALRM, handler);
	alarm(1);
	aa(&size);
}

If you compile it with optimizations, it will crash.
The "aa" function has this disassembly:

000106a0 <aa>:
   106a0:       08 03 02 41     copy r3,r1
   106a4:       08 1e 02 43     copy sp,r3
   106a8:       6f c1 00 80     stw,ma r1,40(sp)
   106ac:       37 dc 3f c1     ldo -20(sp),ret0
   106b0:       0c 7c 12 90     stw ret0,8(r3)
   106b4:       0f 40 10 9c     ldw 0(r26),ret0		; ret0 = 0x00000000FFFFFF00
   106b8:       97 9c 00 7e     subi 3f,ret0,ret0	; ret0 = 0xFFFFFFFF0000013F
   106bc:       d7 80 1c 1a     depwi 0,31,6,ret0	; ret0 = 0xFFFFFFFF00000100
   106c0:       0b 9e 0a 1e     add,l sp,ret0,sp	;   sp = 0xFFFFFFFFxxxxxxxx
   106c4:       e8 1f 1f f7     b,l,n 106c4 <aa+0x24>,r0

This patch fixes the bug by truncating the "usp" variable to 32 bits.

Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Cc: stable@vger.kernel.org
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-09-22 12:26:37 +02:00
arch parisc: fix crash with signals and alloca 2021-09-22 12:26:37 +02:00
block scsi: bsg: Remove support for SCSI_IOCTL_SEND_COMMAND 2021-09-22 12:26:23 +02:00
certs certs: Trigger creation of RSA module signing key if it's not an RSA key 2021-09-15 09:47:29 +02:00
crypto crypto: shash - avoid comparing pointers to exported functions under CFI 2021-07-14 16:53:13 +02:00
Documentation docs: Fix infiniband uverbs minor number 2021-09-22 12:26:23 +02:00
drivers net: w5100: check return value after calling platform_get_resource() 2021-09-22 12:26:36 +02:00
fs cifs: fix wrong release in sess_alloc_buffer() failed path 2021-09-22 12:26:35 +02:00
include serial: 8250: Define RX trigger levels for OxSemi 950 devices 2021-09-22 12:26:29 +02:00
init kbuild: add CONFIG_LD_IS_LLD 2021-06-30 08:47:44 -04:00
ipc
kernel workqueue: Fix possible memory leaks in wq_numa_init() 2021-09-22 12:26:30 +02:00
lib bpf/tests: Do not PASS tests without actually testing the result 2021-09-22 12:26:29 +02:00
LICENSES
mm mm/page_alloc: speed up the iteration of max_order 2021-09-12 08:56:41 +02:00
net fix array-index-out-of-bounds in taprio_change 2021-09-22 12:26:36 +02:00
samples samples: bpf: Fix tracex7 error raised on the missing argument 2021-09-22 12:26:30 +02:00
scripts kbuild: Fix 'no symbols' warning when CONFIG_TRIM_UNUSD_KSYMS=y 2021-09-22 12:26:26 +02:00
security Smack: Fix wrong semantics in smk_access_entry() 2021-09-22 12:26:27 +02:00
sound ASoC: rockchip: i2s: Fixup config for DAIFMT_DSP_A/B 2021-09-22 12:26:35 +02:00
tools selftests/bpf: Enlarge select() timeout for test_maps 2021-09-22 12:26:34 +02:00
usr
virt KVM: Do not leak memory for duplicate debugfs directories 2021-08-12 13:21:03 +02:00
.clang-format
.cocciconfig
.get_maintainer.ignore
.gitattributes
.gitignore
.mailmap
COPYING
CREDITS
Kbuild
Kconfig
MAINTAINERS
Makefile Linux 5.4.147 2021-09-16 12:56:14 +02:00
README

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.