* [PATCH 1/3] sys_poll: Fix negative timeout values for x86 userland on x86_64 kernels v2
@ 2011-09-18 8:04 Thomas Meyer
2011-09-18 8:04 ` Thomas Meyer
` (2 more replies)
0 siblings, 3 replies; 5+ messages in thread
From: Thomas Meyer @ 2011-09-18 8:04 UTC (permalink / raw)
To: Linux Kernel Mailing List, linux-arch
size of int and long differs on x86 and x86_64. the ia32 emulation calls
directly into the sys_poll function. when the timeout is set to -1
the test for sign will fail in sys_poll as the 64bit register is tested.
the timeout timer will be set to 0xffffffff milliseconds, but the timer
shouldn't get set at all in this situation.
Signed-off-by: Thomas Meyer <thomas@m3y3r.de>
---
arch/x86/ia32/ia32entry.S | 2 +-
fs/compat.c | 6 ++++++
include/linux/compat.h | 2 ++
3 files changed, 9 insertions(+), 1 deletions(-)
move sys_poll() out of the #ifdef
diff --git a/arch/x86/ia32/ia32entry.S b/arch/x86/ia32/ia32entry.S
index 54edb207..30f4116 100644
--- a/arch/x86/ia32/ia32entry.S
+++ b/arch/x86/ia32/ia32entry.S
@@ -671,7 +671,7 @@ ia32_sys_call_table:
.quad sys_getresuid16 /* 165 */
.quad sys32_vm86_warning /* vm86 */
.quad quiet_ni_syscall /* query_module */
- .quad sys_poll
+ .quad compat_sys_poll
.quad quiet_ni_syscall /* old nfsservctl */
.quad sys_setresgid16 /* 170 */
.quad sys_getresgid16
diff --git a/fs/compat.c b/fs/compat.c
index 58b1da4..232675e 100644
--- a/fs/compat.c
+++ b/fs/compat.c
@@ -1550,6 +1550,12 @@ asmlinkage long compat_sys_old_select(struct compat_sel_arg_struct __user *arg)
compat_ptr(a.exp), compat_ptr(a.tvp));
}
+asmlinkage long compat_sys_poll(struct pollfd __user *ufds, unsigned int nfds,
+ int timeout)
+{
+ return sys_poll(ufds, nfds, timeout);
+}
+
#ifdef HAVE_SET_RESTORE_SIGMASK
static long do_compat_pselect(int n, compat_ulong_t __user *inp,
compat_ulong_t __user *outp, compat_ulong_t __user *exp,
diff --git a/include/linux/compat.h b/include/linux/compat.h
index c6e7523..3bfb30a 100644
--- a/include/linux/compat.h
+++ b/include/linux/compat.h
@@ -433,6 +433,8 @@ asmlinkage long compat_sys_pselect6(int n, compat_ulong_t __user *inp,
compat_ulong_t __user *exp,
struct compat_timespec __user *tsp,
void __user *sig);
+asmlinkage long compat_sys_poll(struct pollfd __user *ufds, unsigned int nfds,
+ int timeout);
asmlinkage long compat_sys_ppoll(struct pollfd __user *ufds,
unsigned int nfds,
struct compat_timespec __user *tsp,
--
1.7.6
^ permalink raw reply related [flat|nested] 5+ messages in thread
* [PATCH 1/3] sys_poll: Fix negative timeout values for x86 userland on x86_64 kernels v2
2011-09-18 8:04 [PATCH 1/3] sys_poll: Fix negative timeout values for x86 userland on x86_64 kernels v2 Thomas Meyer
@ 2011-09-18 8:04 ` Thomas Meyer
2011-09-18 8:47 ` Geert Uytterhoeven
2011-09-18 8:58 ` Eric Dumazet
2 siblings, 0 replies; 5+ messages in thread
From: Thomas Meyer @ 2011-09-18 8:04 UTC (permalink / raw)
To: Linux Kernel Mailing List, linux-arch
size of int and long differs on x86 and x86_64. the ia32 emulation calls
directly into the sys_poll function. when the timeout is set to -1
the test for sign will fail in sys_poll as the 64bit register is tested.
the timeout timer will be set to 0xffffffff milliseconds, but the timer
shouldn't get set at all in this situation.
Signed-off-by: Thomas Meyer <thomas@m3y3r.de>
---
arch/x86/ia32/ia32entry.S | 2 +-
fs/compat.c | 6 ++++++
include/linux/compat.h | 2 ++
3 files changed, 9 insertions(+), 1 deletions(-)
move sys_poll() out of the #ifdef
diff --git a/arch/x86/ia32/ia32entry.S b/arch/x86/ia32/ia32entry.S
index 54edb207..30f4116 100644
--- a/arch/x86/ia32/ia32entry.S
+++ b/arch/x86/ia32/ia32entry.S
@@ -671,7 +671,7 @@ ia32_sys_call_table:
.quad sys_getresuid16 /* 165 */
.quad sys32_vm86_warning /* vm86 */
.quad quiet_ni_syscall /* query_module */
- .quad sys_poll
+ .quad compat_sys_poll
.quad quiet_ni_syscall /* old nfsservctl */
.quad sys_setresgid16 /* 170 */
.quad sys_getresgid16
diff --git a/fs/compat.c b/fs/compat.c
index 58b1da4..232675e 100644
--- a/fs/compat.c
+++ b/fs/compat.c
@@ -1550,6 +1550,12 @@ asmlinkage long compat_sys_old_select(struct compat_sel_arg_struct __user *arg)
compat_ptr(a.exp), compat_ptr(a.tvp));
}
+asmlinkage long compat_sys_poll(struct pollfd __user *ufds, unsigned int nfds,
+ int timeout)
+{
+ return sys_poll(ufds, nfds, timeout);
+}
+
#ifdef HAVE_SET_RESTORE_SIGMASK
static long do_compat_pselect(int n, compat_ulong_t __user *inp,
compat_ulong_t __user *outp, compat_ulong_t __user *exp,
diff --git a/include/linux/compat.h b/include/linux/compat.h
index c6e7523..3bfb30a 100644
--- a/include/linux/compat.h
+++ b/include/linux/compat.h
@@ -433,6 +433,8 @@ asmlinkage long compat_sys_pselect6(int n, compat_ulong_t __user *inp,
compat_ulong_t __user *exp,
struct compat_timespec __user *tsp,
void __user *sig);
+asmlinkage long compat_sys_poll(struct pollfd __user *ufds, unsigned int nfds,
+ int timeout);
asmlinkage long compat_sys_ppoll(struct pollfd __user *ufds,
unsigned int nfds,
struct compat_timespec __user *tsp,
--
1.7.6
^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [PATCH 1/3] sys_poll: Fix negative timeout values for x86 userland on x86_64 kernels v2
2011-09-18 8:04 [PATCH 1/3] sys_poll: Fix negative timeout values for x86 userland on x86_64 kernels v2 Thomas Meyer
2011-09-18 8:04 ` Thomas Meyer
@ 2011-09-18 8:47 ` Geert Uytterhoeven
2011-09-18 8:58 ` Eric Dumazet
2 siblings, 0 replies; 5+ messages in thread
From: Geert Uytterhoeven @ 2011-09-18 8:47 UTC (permalink / raw)
To: Thomas Meyer; +Cc: Linux Kernel Mailing List, linux-arch
On Sun, Sep 18, 2011 at 10:04, Thomas Meyer <thomas@m3y3r.de> wrote:
> size of int and long differs on x86 and x86_64. the ia32 emulation calls
The size of int is the same on x86 and x86_64.
Gr{oetje,eeting}s,
Geert
--
Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert@linux-m68k.org
In personal conversations with technical people, I call myself a hacker. But
when I'm talking to journalists I just say "programmer" or something like that.
-- Linus Torvalds
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH 1/3] sys_poll: Fix negative timeout values for x86 userland on x86_64 kernels v2
2011-09-18 8:04 [PATCH 1/3] sys_poll: Fix negative timeout values for x86 userland on x86_64 kernels v2 Thomas Meyer
2011-09-18 8:04 ` Thomas Meyer
2011-09-18 8:47 ` Geert Uytterhoeven
@ 2011-09-18 8:58 ` Eric Dumazet
2011-09-18 8:58 ` Eric Dumazet
2 siblings, 1 reply; 5+ messages in thread
From: Eric Dumazet @ 2011-09-18 8:58 UTC (permalink / raw)
To: Thomas Meyer; +Cc: Linux Kernel Mailing List, linux-arch
Le dimanche 18 septembre 2011 à 10:04 +0200, Thomas Meyer a écrit :
> size of int and long differs on x86 and x86_64. the ia32 emulation calls
> directly into the sys_poll function. when the timeout is set to -1
> the test for sign will fail in sys_poll as the 64bit register is tested.
> the timeout timer will be set to 0xffffffff milliseconds, but the timer
> shouldn't get set at all in this situation.
>
As I said, you should CC stable@kernel.org team on this patch.
All previous linux versions had this bug : A program might misbehave
because of a spurious poll(..., timeout < 0) wakeup.
Could you please refine this Changelog again ?
On 32bit user program, all negative timeout values should not set a
timout at all, not only 0xffffffff (-1)
man poll states :
The timeout argument specifies an upper limit on the time for which
poll() will block, in milliseconds. Specifying a negative value in
timeout means an infinite timeout.
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH 1/3] sys_poll: Fix negative timeout values for x86 userland on x86_64 kernels v2
2011-09-18 8:58 ` Eric Dumazet
@ 2011-09-18 8:58 ` Eric Dumazet
0 siblings, 0 replies; 5+ messages in thread
From: Eric Dumazet @ 2011-09-18 8:58 UTC (permalink / raw)
To: Thomas Meyer; +Cc: Linux Kernel Mailing List, linux-arch
Le dimanche 18 septembre 2011 à 10:04 +0200, Thomas Meyer a écrit :
> size of int and long differs on x86 and x86_64. the ia32 emulation calls
> directly into the sys_poll function. when the timeout is set to -1
> the test for sign will fail in sys_poll as the 64bit register is tested.
> the timeout timer will be set to 0xffffffff milliseconds, but the timer
> shouldn't get set at all in this situation.
>
As I said, you should CC stable@kernel.org team on this patch.
All previous linux versions had this bug : A program might misbehave
because of a spurious poll(..., timeout < 0) wakeup.
Could you please refine this Changelog again ?
On 32bit user program, all negative timeout values should not set a
timout at all, not only 0xffffffff (-1)
man poll states :
The timeout argument specifies an upper limit on the time for which
poll() will block, in milliseconds. Specifying a negative value in
timeout means an infinite timeout.
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2011-09-18 9:03 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2011-09-18 8:04 [PATCH 1/3] sys_poll: Fix negative timeout values for x86 userland on x86_64 kernels v2 Thomas Meyer
2011-09-18 8:04 ` Thomas Meyer
2011-09-18 8:47 ` Geert Uytterhoeven
2011-09-18 8:58 ` Eric Dumazet
2011-09-18 8:58 ` Eric Dumazet
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox