64bit kernel, o32 userspace.
The call to elf_core_copy_regs() from elf_core_dump() is writing
beyond the end of prstatus because the wrong copy function is being
called:
slab error in cache_free_debugcheck(): cache `size-256': double free, or memory
outside object was overwritten
Call Trace:
[<ffffffff8016f77c>] __slab_error+0x2c/0x38
[<ffffffff80171c50>] cache_free_debugcheck+0x290/0x318
[<ffffffff80171c1c>] cache_free_debugcheck+0x25c/0x318
[<ffffffff80172d80>] kfree+0x98/0x168
[<ffffffff80172ce8>] kfree+0x0/0x168
[<ffffffff8011a250>] elf_core_dump+0x508/0xb58
[<ffffffff8019b394>] do_coredump+0x234/0x260
[<ffffffff80144a28>] __dequeue_signal+0x0/0x2c0
[<ffffffff80147118>] get_signal_to_deliver+0x210/0x390
[<ffffffff80116d10>] do_signal32+0x80/0x288
[<ffffffff80145f80>] kill_something_info+0x48/0x128
[<ffffffff8011727c>] sys32_rt_sigprocmask+0xfc/0x1c0
[<ffffffff80106ed4>] do_notify_resume+0x3c/0x48
[<ffffffff801039cc>] work_notifysig+0xc/0x14
[<ffffffff8011a9c0>] handle_sys+0x120/0x13c
a80000013ff0b2b8: redzone 1: 0x170fc2a5, redzone 2: 0x7a120.
redzone 2 has been overwritten.
--
Running binfmt_elfo32.c through the pre-processor reveals that
elf_core_copy_regs() is calling dump_regs() instead of
elf32_core_copy_regs().
In arch/mips/kernel/binfmt_elfo32.c:
#undef ELF_CORE_COPY_REGS
#define ELF_CORE_COPY_REGS(_dest,_regs) elf32_core_copy_regs(_dest,_regs);
Those 2 have no effect because elf_core_copy_regs() has already been
defined inline by including 'linux/elfcore.h' at the top of
binfmt_elfo32.c.
Changing elf32_core_copy_regs to a static also reveals the problem:
CC arch/mips/kernel/binfmt_elfo32.o
arch/mips/kernel/binfmt_elfo32.c:116: warning: `elf32_core_copy_regs' defined
but not used
--
There's probably 10 different ways to fix this by re-ordering
#includes/#defines in arch/mips/kernel/binfmt_elfo32.c.
--
I found a reference to this in the mailing list from Jan/Feb 2005, but
the proposed patch didn't seem to get applied.
Suggestions on the best way to fix this? Was that patch no good?
--
Dave Johnson
Starent Networks
|