linux-mips
[Top] [All Lists]

Re: 64bit kernel/N32 userspace - shmctl corrupts userspace memory

To: Ralf Baechle <ralf@linux-mips.org>
Subject: Re: 64bit kernel/N32 userspace - shmctl corrupts userspace memory
From: Chad Reese <creese@caviumnetworks.com>
Date: Tue, 25 Jul 2006 19:30:45 -0700
Cc: linux-mips@linux-mips.org
In-reply-to: <20060726020427.GA21024@linux-mips.org>
Original-recipient: rfc822;linux-mips@linux-mips.org
References: <44C6B829.8050508@caviumnetworks.com> <20060726020427.GA21024@linux-mips.org>
Sender: linux-mips-bounce@linux-mips.org
User-agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.7.8) Gecko/20060629 Debian/1.7.8-1sarge7.1
compat.c is only included if CONFIG_SYSVIPC_COMPAT is defined. This
isn't anywhere in 2.6.16.26. Is this what you're refering to?

Chad

Ralf Baechle wrote:
> On Tue, Jul 25, 2006 at 05:32:41PM -0700, Chad Reese wrote:
> 
> 
>>If you're running a 64bit kernel with N32 userspace, shmctl will corrupt
>>memory in userspace. When copy_shmid_to_user() is called, it copies the
>>entire kernel shmid_ds into userspace. For a 64bit kernel, this is 88
>>bytes. In N32 userspace it is 76 bytes.
>>
>>My hack to get around the problem is attached, but I expect someone here
>>will be able to come up with a better fix. shmid_ds contains a lot of
>>members that are marked unused. Are these really useless?
> 
> 
> Can you try below patch?
> 
>   Ralf
> 
> diff --git a/arch/mips/kernel/scall64-n32.S b/arch/mips/kernel/scall64-n32.S
> index 98abbc5..605d393 100644
> --- a/arch/mips/kernel/scall64-n32.S
> +++ b/arch/mips/kernel/scall64-n32.S
> @@ -150,7 +150,7 @@ EXPORT(sysn32_call_table)
>       PTR     sys_madvise
>       PTR     sys_shmget
>       PTR     sys32_shmat
> -     PTR     sys_shmctl                      /* 6030 */
> +     PTR     compat_sys_shmctl               /* 6030 */
>       PTR     sys_dup
>       PTR     sys_dup2
>       PTR     sys_pause
> 

-- 

Chad Reese <kreese@caviumnetworks.com>
Cavium Networks
Phone: 650 - 623 - 7038
Cell: 321 - 438 - 7753


<Prev in Thread] Current Thread [Next in Thread>