N32 shmat problem identified! Kernel fix needed.

N32 shmat problem identified! Kernel fix needed.

[Kaz Kylheku]

The problem is simple.

The function named sys32_shmat has no reason to exist, and is broken. It
assumes that user space has passed a pointer to the location where the
resulting pointer should be stored. But that is not the shmat API, and
glibc will pass no such parameter. So a null dereference results,
leading to EFAULT.

The fix is to remove this function from the code base and quite simply
to wire the normal sys_shmat into the n32 syscall table. Since there is
in fact no pointer-to-pointer argument, this function doesn't have a 32
bit compatibility issues.

N32 shmat problem identified! Kernel fix needed.

[Kaz Kylheku]

The problem is simple.

The function named sys32_shmat has no reason to exist, and is broken. It
assumes that user space has passed a pointer to the location where the
resulting pointer should be stored. But that is not the shmat API, and
glibc will pass no such parameter. So a null dereference results,
leading to EFAULT.

The fix is to remove this function from the code base and quite simply
to wire the normal sys_shmat into the n32 syscall table. Since there is
in fact no pointer-to-pointer argument, this function doesn't have a 32
bit compatibility issues.

Re: N32 shmat problem identified! Kernel fix needed.

[Ralf Baechle]

On Fri, Dec 01, 2006 at 04:33:16PM -0800, Kaz Kylheku wrote:

> The function named sys32_shmat has no reason to exist, and is broken. It
> assumes that user space has passed a pointer to the location where the
> resulting pointer should be stored. But that is not the shmat API, and
> glibc will pass no such parameter. So a null dereference results,
> leading to EFAULT.
> 
> The fix is to remove this function from the code base and quite simply
> to wire the normal sys_shmat into the n32 syscall table. Since there is
> in fact no pointer-to-pointer argument, this function doesn't have a 32
> bit compatibility issues.

That's fixed since two months.

  Ralf

Re: N32 shmat problem identified! Kernel fix needed.

[Atsushi Nemoto]

On Sat, 2 Dec 2006 02:24:04 +0000, Ralf Baechle <ralf@linux-mips.org> wrote:
> > The fix is to remove this function from the code base and quite simply
> > to wire the normal sys_shmat into the n32 syscall table. Since there is
> > in fact no pointer-to-pointer argument, this function doesn't have a 32
> > bit compatibility issues.
> 
> That's fixed since two months.

Minor correction: about a month, not two :)

http://www.linux-mips.org/archives/linux-mips/2006-11/msg00030.html

This fix is already merged to master and linux-2.6.1x-stable branches
in linux-mips.org tree, though not merged to kernel.org's tree yet
unfortunately.

---
Atsushi Nemoto