lk/linux-kernel-test
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

[SPARC64]: Fix bugs in SYSV IPC handling in 64-bit processes.

Browse Source 
Thanks to Tom Callaway for the excellent bug report and
test case.

sys_ipc() has several problems, most to due with semaphore
call handling:

1) 'err' return should be a 'long'
2) "union semun" is passed in a register on 64-bit compared
   to 32-bit which provides it on the stack and therefore
   by reference
3) Second and third arguments to SEMCTL are swapped compared
   to 32-bit.

Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
David S. Miller
2007-10-09 20:56:31 -07:00
parent fa7744dbb6
commit 7379b42b60
1 changed files with 4 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
arch/sparc64/kernel/sys_sparc.c
View File

@@ -436,7 +436,7 @@ out:
asmlinkage long sys_ipc(unsigned int call, int first, unsigned long second, asmlinkage long sys_ipc(unsigned int call, int first, unsigned long second,
unsigned long third, void __user *ptr, long fifth) unsigned long third, void __user *ptr, long fifth)
{ {
int err; long err;
/* No need for backward compatibility. We can start fresh... */ /* No need for backward compatibility. We can start fresh... */
if (call <= SEMCTL) { if (call <= SEMCTL) {
@@ -453,16 +453,9 @@ asmlinkage long sys_ipc(unsigned int call, int first, unsigned long second,
err = sys_semget(first, (int)second, (int)third); err = sys_semget(first, (int)second, (int)third);
goto out; goto out;
case SEMCTL: { case SEMCTL: {
union semun fourth; err = sys_semctl(first, third,
err = -EINVAL; (int)second | IPC_64,
if (!ptr) (union semun) ptr);
goto out;
err = -EFAULT;
if (get_user(fourth.__pad,
(void __user * __user *) ptr))
goto out;
err = sys_semctl(first, (int)second | IPC_64,
(int)third, fourth);
goto out; goto out;
} }
default: default: