From mboxrd@z Thu Jan 1 00:00:00 1970 From: bugzilla-daemon-CC+yJ3UmIYqDUpFQwHEjaQ@public.gmane.org Subject: [Bug 73473] New: Potential crash bug in src/gallium/auxiliary/rtasm/rtasm_execmem.c Date: Fri, 10 Jan 2014 13:47:01 +0000 Message-ID: Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="===============1944323219==" Return-path: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: nouveau-bounces-PD4FTy7X32lNgt0PjOBp9y5qC8QIuHrW@public.gmane.org Errors-To: nouveau-bounces-PD4FTy7X32lNgt0PjOBp9y5qC8QIuHrW@public.gmane.org To: nouveau-PD4FTy7X32lNgt0PjOBp9y5qC8QIuHrW@public.gmane.org List-Id: nouveau.vger.kernel.org --===============1944323219== Content-Type: multipart/alternative; boundary="1389361621.bD8Bf0.28454"; charset="us-ascii" --1389361621.bD8Bf0.28454 Date: Fri, 10 Jan 2014 13:47:01 +0000 MIME-Version: 1.0 Content-Type: text/plain; charset="UTF-8" https://bugs.freedesktop.org/show_bug.cgi?id=73473 Priority: medium Bug ID: 73473 Assignee: nouveau-PD4FTy7X32lNgt0PjOBp9y5qC8QIuHrW@public.gmane.org Summary: Potential crash bug in src/gallium/auxiliary/rtasm/rtasm_execmem.c Severity: critical Classification: Unclassified OS: Linux (All) Reporter: jaak-89mTbI93R4uuvFJfX82//w@public.gmane.org Hardware: x86-64 (AMD64) Status: NEW Version: unspecified Component: Drivers/DRI/nouveau Product: Mesa glxgears[4186]: segfault at ffffffffffffffff ip 000078805fc4b901 sp 00007ce9598e21c0 error 7 in nouveau_dri.so[78805f7d1000+136c000] Stracing it revealed that the crash happens after a mmap(NULL, 10485760, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE,MAP_ANONYMOUS, -1, 0) syscall returns -1. I think it might be caused by the return value of mmap not being checked in src/gallium/auxiliary/rtasm/rtasm_execmem.c, leading to the the memory being accessed somewhere else. So it probably needs some if (exec_mem == MAP_FAILED) check somewhere. PS: Sorry if this is not the correct component. -- You are receiving this mail because: You are the assignee for the bug. --1389361621.bD8Bf0.28454 Date: Fri, 10 Jan 2014 13:47:01 +0000 MIME-Version: 1.0 Content-Type: text/html; charset="UTF-8"
Priority medium
Bug ID 73473
Assignee nouveau@lists.freedesktop.org
Summary Potential crash bug in src/gallium/auxiliary/rtasm/rtasm_execmem.c
Severity critical
Classification Unclassified
OS Linux (All)
Reporter jaak@ristioja.ee
Hardware x86-64 (AMD64)
Status NEW
Version unspecified
Component Drivers/DRI/nouveau
Product Mesa 

glxgears[4186]: segfault at ffffffffffffffff ip 000078805fc4b901 sp
00007ce9598e21c0 error 7 in nouveau_dri.so[78805f7d1000+136c000]

Stracing it revealed that the crash happens after a mmap(NULL, 10485760,
PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE,MAP_ANONYMOUS, -1, 0) syscall
returns -1.

I think it might be caused by the return value of mmap not being checked in
src/gallium/auxiliary/rtasm/rtasm_execmem.c, leading to the the memory being
accessed somewhere else.

So it probably needs some

  if (exec_mem == MAP_FAILED)

check somewhere.

PS: Sorry if this is not the correct component.

You are receiving this mail because:
  • You are the assignee for the bug.
--1389361621.bD8Bf0.28454-- --===============1944323219== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Nouveau mailing list Nouveau-PD4FTy7X32lNgt0PjOBp9y5qC8QIuHrW@public.gmane.org http://lists.freedesktop.org/mailman/listinfo/nouveau --===============1944323219==--