Possible bug on signal.h

Possible bug on signal.h

[Jordi Brinquez]

Hi,

I think I found a possible bug on file signal.h.

The problem comes when you define a struct sigaction on a user program
and then you use the function sigaction to remap a signal handler (in
my case a page_fault) for my own function, this system call is
compiled as __NR_sigaction system call (by default this routine is
managed by sys_sigaction routine) and if the architecture defines
__ARCH_WANT_SYS_RT_SIGACTION kernel uses the routine sys_rt_sigaction
on the file kernel/signal.c that instead of copying the fields from
one structure to the other it just uses copy_from_user and
copy_to_user with the consequent mess with the fields.

One possible solution will be to change the field order in all struct
sigaction under arch/ folder and reorder the fields exactly the same
as in the kernel definition (on kernel mode are defined in this order
sa_handler, sa_flags, sa_restorer, sa_mask and on user mode
_sa_handler | _sa_sigaction, sa_mask, sa_flags, sa_restorer).

Another solution will be change the copy_to_user and copy_from_user
for calls like in arch/i386/kernel/signal.c (__get_user(...) and
__put_user(...)).

Or what I think it will be better change both.

I've been searching and I think that the affected architectures are
those ones, but I may forgot some:

- arm
- arm26
- cris
- i386
- m32r
- m68k
- m68knommu
- s390
- sh
- sh64
- sparc64
- um
- v850

Hope I explained the problem quite clear if not please ask for more
info and I'll give you all that you need.

Greets,

Jordi

Re: Possible bug on signal.h

[linux-os]

On Thu, 24 Feb 2005, Jordi Brinquez wrote:

> Hi,
>
> I think I found a possible bug on file signal.h.
>
> The problem comes when you define a struct sigaction on a user program
> and then you use the function sigaction to remap a signal handler (in
> my case a page_fault) for my own function, this system call is
> compiled as __NR_sigaction system call (by default this routine is
> managed by sys_sigaction routine) and if the architecture defines
> __ARCH_WANT_SYS_RT_SIGACTION kernel uses the routine sys_rt_sigaction
> on the file kernel/signal.c that instead of copying the fields from
> one structure to the other it just uses copy_from_user and
> copy_to_user with the consequent mess with the fields.
>

You NEVER use kernel headers for user code.... EVER. If you
are making something strange, like as you said a page-fault
handler, then you make an in-kernel driver (module).

FYI, no page-fault handler could ever work in user-mode
anyway. A page-fault occurs because the user accesses some
page it doesn't own (probably because it isn't in memory).
The kernel page-fault handler checks to see if the page was
promised. If not, it terminates the user-mode task with
a signal. If so, it finds some free page or makes one
available and maps it into the user's address-space before
returning control to the user. Since the user doesn't own
any free pages, it can't map in any.


[SNIPPED...]


Cheers,
Dick Johnson
Penguin : Linux version 2.6.10 on an i686 machine (5537.79 BogoMips).
  Notice : All mail here is now cached for review by Dictator Bush.
                  98.36% of all statistics are fiction.

Re: Possible bug on signal.h

[Jordi Brínquez]

I'm trying to modify UML so I'm using kernel headers

but anyway there is a problem on sigaction definition on signal.h

Jordi



linux-os wrote:

> On Thu, 24 Feb 2005, Jordi Brinquez wrote:
>
>> Hi,
>>
>> I think I found a possible bug on file signal.h.
>>
>> The problem comes when you define a struct sigaction on a user program
>> and then you use the function sigaction to remap a signal handler (in
>> my case a page_fault) for my own function, this system call is
>> compiled as __NR_sigaction system call (by default this routine is
>> managed by sys_sigaction routine) and if the architecture defines
>> __ARCH_WANT_SYS_RT_SIGACTION kernel uses the routine sys_rt_sigaction
>> on the file kernel/signal.c that instead of copying the fields from
>> one structure to the other it just uses copy_from_user and
>> copy_to_user with the consequent mess with the fields.
>>
>
> You NEVER use kernel headers for user code.... EVER. If you
> are making something strange, like as you said a page-fault
> handler, then you make an in-kernel driver (module).
>
> FYI, no page-fault handler could ever work in user-mode
> anyway. A page-fault occurs because the user accesses some
> page it doesn't own (probably because it isn't in memory).
> The kernel page-fault handler checks to see if the page was
> promised. If not, it terminates the user-mode task with
> a signal. If so, it finds some free page or makes one
> available and maps it into the user's address-space before
> returning control to the user. Since the user doesn't own
> any free pages, it can't map in any.
>
>
> [SNIPPED...]
>
>
> Cheers,
> Dick Johnson
> Penguin : Linux version 2.6.10 on an i686 machine (5537.79 BogoMips).
>  Notice : All mail here is now cached for review by Dictator Bush.
>                  98.36% of all statistics are fiction.
>