unaligned handler problem

unaligned handler problem

[Pete Popov]

The changes betwen rev 1.23 and 1.24 in unaligned.c, to replace
check_axs() with verify_area(), causes any unaligned access from within
a kernel module to crash. access_ok() returns -EFAULT as the
__access_mask is 0xffffffff so __access_ok evaluates to > 0.  It's too
late for me to look into it any further but perhaps the problem will be
obvious to someone else. I'm not sure what get_fs() should return in
this case (again, the access is from within a kernel module) but it
returns 0xffffffff.

Pete

Re: unaligned handler problem

[Ralf Baechle]

On Fri, Jan 03, 2003 at 02:29:22AM -0800, Pete Popov wrote:

> The changes betwen rev 1.23 and 1.24 in unaligned.c, to replace
> check_axs() with verify_area(), causes any unaligned access from within
> a kernel module to crash. access_ok() returns -EFAULT as the
> __access_mask is 0xffffffff so __access_ok evaluates to > 0.  It's too
> late for me to look into it any further but perhaps the problem will be
> obvious to someone else. I'm not sure what get_fs() should return in
> this case (again, the access is from within a kernel module) but it
> returns 0xffffffff.

The address error handler should do something like:

	mm_segment_t seg;

	seg = get_fs();
	if (!user_mode(regs))
		set_fs(KERNEL_DS);

	... usual unaligned stuff goes here ...

	set_fs(seg);

  Ralf

PATCH: unaligned handler problem

[Pete Popov]

On Fri, 2003-01-03 at 05:46, Ralf Baechle wrote:
> On Fri, Jan 03, 2003 at 02:29:22AM -0800, Pete Popov wrote:
> 
> > The changes betwen rev 1.23 and 1.24 in unaligned.c, to replace
> > check_axs() with verify_area(), causes any unaligned access from within
> > a kernel module to crash. access_ok() returns -EFAULT as the
> > __access_mask is 0xffffffff so __access_ok evaluates to > 0.  It's too
> > late for me to look into it any further but perhaps the problem will be
> > obvious to someone else. I'm not sure what get_fs() should return in
> > this case (again, the access is from within a kernel module) but it
> > returns 0xffffffff.
> 
> The address error handler should do something like:
> 
> 	mm_segment_t seg;
> 
> 	seg = get_fs();
> 	if (!user_mode(regs))
> 		set_fs(KERNEL_DS);
> 
> 	... usual unaligned stuff goes here ...
> 
> 	set_fs(seg);

Thanks! The patch below works. I had a test case plus a pcmcia driver that was
crashing, and now they both pass.


--- linux-2.4-head/arch/mips/kernel/unaligned.c	Thu Dec 26 21:35:00 2002
+++ linux-2.4-dev/arch/mips/kernel/unaligned.c	Sat Jan  4 12:21:06 2003
@@ -98,6 +98,11 @@
 	union mips_instruction insn;
 	unsigned long value, fixup;
 	unsigned int res;
+	mm_segment_t seg;
+
+	seg = get_fs();
+	if (!user_mode(regs))
+		set_fs(KERNEL_DS);
 
 	regs->regs[0] = 0;
 	/*
@@ -458,6 +463,7 @@
 	unaligned_instructions++;
 #endif
 
+	set_fs(seg);
 	return;
 
 fault:
@@ -469,24 +475,28 @@
 		printk(KERN_DEBUG "%s: Forwarding exception at [<%lx>] (%lx)\n",
 		       current->comm, regs->cp0_epc, new_epc);
 		regs->cp0_epc = new_epc;
+		set_fs(seg);
 		return;
 	}
 
 	die_if_kernel ("Unhandled kernel unaligned access", regs);
 	send_sig(SIGSEGV, current, 1);
 
+	set_fs(seg);
 	return;
 
 sigbus:
 	die_if_kernel("Unhandled kernel unaligned access", regs);
 	send_sig(SIGBUS, current, 1);
 
+	set_fs(seg);
 	return;
 
 sigill:
 	die_if_kernel("Unhandled kernel unaligned access or invalid instruction", regs);
 	send_sig(SIGILL, current, 1);
 
+	set_fs(seg);
 	return;
 }