linux-mips
[Top] [All Lists]

Re: 64bit kernel/N32 userspace - shmctl corrupts userspace memory

To: Chad Reese <creese@caviumnetworks.com.redhat.com>
Subject: Re: 64bit kernel/N32 userspace - shmctl corrupts userspace memory
From: Ralf Baechle <ralf@linux-mips.org>
Date: Tue, 25 Jul 2006 22:04:27 -0400
Cc: linux-mips@linux-mips.org
In-reply-to: <44C6B829.8050508@caviumnetworks.com>
Original-recipient: rfc822;linux-mips@linux-mips.org
References: <44C6B829.8050508@caviumnetworks.com>
Sender: linux-mips-bounce@linux-mips.org
User-agent: Mutt/1.4.2.1i
On Tue, Jul 25, 2006 at 05:32:41PM -0700, Chad Reese wrote:

> If you're running a 64bit kernel with N32 userspace, shmctl will corrupt
> memory in userspace. When copy_shmid_to_user() is called, it copies the
> entire kernel shmid_ds into userspace. For a 64bit kernel, this is 88
> bytes. In N32 userspace it is 76 bytes.
> 
> My hack to get around the problem is attached, but I expect someone here
> will be able to come up with a better fix. shmid_ds contains a lot of
> members that are marked unused. Are these really useless?

Can you try below patch?

  Ralf

diff --git a/arch/mips/kernel/scall64-n32.S b/arch/mips/kernel/scall64-n32.S
index 98abbc5..605d393 100644
--- a/arch/mips/kernel/scall64-n32.S
+++ b/arch/mips/kernel/scall64-n32.S
@@ -150,7 +150,7 @@ EXPORT(sysn32_call_table)
        PTR     sys_madvise
        PTR     sys_shmget
        PTR     sys32_shmat
-       PTR     sys_shmctl                      /* 6030 */
+       PTR     compat_sys_shmctl               /* 6030 */
        PTR     sys_dup
        PTR     sys_dup2
        PTR     sys_pause

<Prev in Thread] Current Thread [Next in Thread>