* [RFC PATCH v2] compat: poll() in 32-bit applications does not handle negative timeout values properly on 64-bit kernels
@ 2012-02-11 5:54 Josh Hunt
2012-02-11 5:54 ` Josh Hunt
2012-02-11 15:47 ` Eric Dumazet
0 siblings, 2 replies; 4+ messages in thread
From: Josh Hunt @ 2012-02-11 5:54 UTC (permalink / raw)
To: Al Viro, linux-fsdevel@vger.kernel.org, tglx, mingo, hpa, x86,
arnd, linux-arch
Cc: linux-kernel@vger.kernel.org
[-- Attachment #1: Type: text/plain, Size: 664 bytes --]
We have hit an issue where our 32-bit applications using poll() and
passing in a value of -1 for the timeout value return after ~49 days
(2^32 msec), instead of waiting indefinitely. I've instrumented the
kernel and found we are hitting the case where poll() believes we've
passed in a positive number and thus creates a timespec, etc. I've
implemented compat_sys_poll() to sign-extend the timeout value and
resolve the issue.
There was an almost identical patch submitted last year, but for
whatever reason did not make it in:
https://lkml.org/lkml/2011/9/18/19
I am guessing there are other architectures affected by this bug. This
patch only fixes x86.
Josh
[-- Attachment #2: compat-sys-poll.patch --]
[-- Type: text/x-patch, Size: 2339 bytes --]
commit cde9eb901ccb3b5af3e501b018b90f16c53942c2
Author: Josh Hunt <johunt@akamai.com>
Date: Mon Feb 6 20:51:31 2012 -0800
compat: poll() in 32-bit applications does not handle negative timeout values properly on 64-bit kernels
We have observed our 32-bit applications running on 64-bit kernels do not
wait infinitely when passed a negative value for the timeout argument.
Instead we see poll() returning in ~49 days or 2^32 msecs, because the
timeout argument is not getting sign-extended. Implementing
compat_sys_poll() to handle this case.
Reported-by: Phil Lisiecki <lisiecki@akamai.com>
Signed-off-by: Josh Hunt <johunt@akamai.com>
Cc: <stable@vger.kernel.org>
diff --git a/arch/x86/syscalls/syscall_32.tbl b/arch/x86/syscalls/syscall_32.tbl
index ce98e28..8407150 100644
--- a/arch/x86/syscalls/syscall_32.tbl
+++ b/arch/x86/syscalls/syscall_32.tbl
@@ -174,7 +174,7 @@
165 i386 getresuid sys_getresuid16
166 i386 vm86 ptregs_vm86 sys32_vm86_warning
167 i386 query_module
-168 i386 poll sys_poll
+168 i386 poll sys_poll compat_sys_poll
169 i386 nfsservctl
170 i386 setresgid sys_setresgid16
171 i386 getresgid sys_getresgid16
diff --git a/fs/compat.c b/fs/compat.c
index fa9d721..77bd50e 100644
--- a/fs/compat.c
+++ b/fs/compat.c
@@ -1611,6 +1611,12 @@ asmlinkage long compat_sys_pselect6(int n, compat_ulong_t __user *inp,
sigsetsize);
}
+asmlinkage long compat_sys_poll(struct pollfd __user *ufds, unsigned int nfds,
+ int timeout_msecs)
+{
+ return sys_poll(ufds, nfds, timeout_msecs);
+}
+
asmlinkage long compat_sys_ppoll(struct pollfd __user *ufds,
unsigned int nfds, struct compat_timespec __user *tsp,
const compat_sigset_t __user *sigmask, compat_size_t sigsetsize)
diff --git a/include/linux/compat.h b/include/linux/compat.h
index 41c9f65..66e61e0 100644
--- a/include/linux/compat.h
+++ b/include/linux/compat.h
@@ -433,6 +433,8 @@ asmlinkage long compat_sys_pselect6(int n, compat_ulong_t __user *inp,
compat_ulong_t __user *exp,
struct compat_timespec __user *tsp,
void __user *sig);
+asmlinkage long compat_sys_poll(struct pollfd __user *ufds, unsigned int nfds,
+ int timeout_msecs);
asmlinkage long compat_sys_ppoll(struct pollfd __user *ufds,
unsigned int nfds,
struct compat_timespec __user *tsp,
^ permalink raw reply related [flat|nested] 4+ messages in thread
* [RFC PATCH v2] compat: poll() in 32-bit applications does not handle negative timeout values properly on 64-bit kernels
2012-02-11 5:54 [RFC PATCH v2] compat: poll() in 32-bit applications does not handle negative timeout values properly on 64-bit kernels Josh Hunt
@ 2012-02-11 5:54 ` Josh Hunt
2012-02-11 15:47 ` Eric Dumazet
1 sibling, 0 replies; 4+ messages in thread
From: Josh Hunt @ 2012-02-11 5:54 UTC (permalink / raw)
To: Al Viro, linux-fsdevel@vger.kernel.org, tglx, mingo, hpa, x86,
arnd, linux-arch
Cc: linux-kernel@vger.kernel.org
[-- Attachment #1: Type: text/plain, Size: 664 bytes --]
We have hit an issue where our 32-bit applications using poll() and
passing in a value of -1 for the timeout value return after ~49 days
(2^32 msec), instead of waiting indefinitely. I've instrumented the
kernel and found we are hitting the case where poll() believes we've
passed in a positive number and thus creates a timespec, etc. I've
implemented compat_sys_poll() to sign-extend the timeout value and
resolve the issue.
There was an almost identical patch submitted last year, but for
whatever reason did not make it in:
https://lkml.org/lkml/2011/9/18/19
I am guessing there are other architectures affected by this bug. This
patch only fixes x86.
Josh
[-- Attachment #2: compat-sys-poll.patch --]
[-- Type: text/x-patch, Size: 2339 bytes --]
commit cde9eb901ccb3b5af3e501b018b90f16c53942c2
Author: Josh Hunt <johunt@akamai.com>
Date: Mon Feb 6 20:51:31 2012 -0800
compat: poll() in 32-bit applications does not handle negative timeout values properly on 64-bit kernels
We have observed our 32-bit applications running on 64-bit kernels do not
wait infinitely when passed a negative value for the timeout argument.
Instead we see poll() returning in ~49 days or 2^32 msecs, because the
timeout argument is not getting sign-extended. Implementing
compat_sys_poll() to handle this case.
Reported-by: Phil Lisiecki <lisiecki@akamai.com>
Signed-off-by: Josh Hunt <johunt@akamai.com>
Cc: <stable@vger.kernel.org>
diff --git a/arch/x86/syscalls/syscall_32.tbl b/arch/x86/syscalls/syscall_32.tbl
index ce98e28..8407150 100644
--- a/arch/x86/syscalls/syscall_32.tbl
+++ b/arch/x86/syscalls/syscall_32.tbl
@@ -174,7 +174,7 @@
165 i386 getresuid sys_getresuid16
166 i386 vm86 ptregs_vm86 sys32_vm86_warning
167 i386 query_module
-168 i386 poll sys_poll
+168 i386 poll sys_poll compat_sys_poll
169 i386 nfsservctl
170 i386 setresgid sys_setresgid16
171 i386 getresgid sys_getresgid16
diff --git a/fs/compat.c b/fs/compat.c
index fa9d721..77bd50e 100644
--- a/fs/compat.c
+++ b/fs/compat.c
@@ -1611,6 +1611,12 @@ asmlinkage long compat_sys_pselect6(int n, compat_ulong_t __user *inp,
sigsetsize);
}
+asmlinkage long compat_sys_poll(struct pollfd __user *ufds, unsigned int nfds,
+ int timeout_msecs)
+{
+ return sys_poll(ufds, nfds, timeout_msecs);
+}
+
asmlinkage long compat_sys_ppoll(struct pollfd __user *ufds,
unsigned int nfds, struct compat_timespec __user *tsp,
const compat_sigset_t __user *sigmask, compat_size_t sigsetsize)
diff --git a/include/linux/compat.h b/include/linux/compat.h
index 41c9f65..66e61e0 100644
--- a/include/linux/compat.h
+++ b/include/linux/compat.h
@@ -433,6 +433,8 @@ asmlinkage long compat_sys_pselect6(int n, compat_ulong_t __user *inp,
compat_ulong_t __user *exp,
struct compat_timespec __user *tsp,
void __user *sig);
+asmlinkage long compat_sys_poll(struct pollfd __user *ufds, unsigned int nfds,
+ int timeout_msecs);
asmlinkage long compat_sys_ppoll(struct pollfd __user *ufds,
unsigned int nfds,
struct compat_timespec __user *tsp,
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [RFC PATCH v2] compat: poll() in 32-bit applications does not handle negative timeout values properly on 64-bit kernels
2012-02-11 5:54 [RFC PATCH v2] compat: poll() in 32-bit applications does not handle negative timeout values properly on 64-bit kernels Josh Hunt
2012-02-11 5:54 ` Josh Hunt
@ 2012-02-11 15:47 ` Eric Dumazet
2012-02-16 16:22 ` Josh Hunt
1 sibling, 1 reply; 4+ messages in thread
From: Eric Dumazet @ 2012-02-11 15:47 UTC (permalink / raw)
To: Josh Hunt
Cc: Al Viro, linux-fsdevel@vger.kernel.org, tglx, mingo, hpa, x86,
arnd, linux-arch, linux-kernel@vger.kernel.org
Le vendredi 10 février 2012 à 23:54 -0600, Josh Hunt a écrit :
> We have hit an issue where our 32-bit applications using poll() and
> passing in a value of -1 for the timeout value return after ~49 days
> (2^32 msec), instead of waiting indefinitely. I've instrumented the
> kernel and found we are hitting the case where poll() believes we've
> passed in a positive number and thus creates a timespec, etc. I've
> implemented compat_sys_poll() to sign-extend the timeout value and
> resolve the issue.
>
> There was an almost identical patch submitted last year, but for
> whatever reason did not make it in:
> https://lkml.org/lkml/2011/9/18/19
Probably because Thomas Meyer didnt answer to patch reviewers, and not
enough people cared.
By the way, an inline patch is better, as stated in
Documentation/SubmittingPatches
Anyway, its time to fix this bug...
Acked-by: Eric Dumazet <eric.dumazet@gmail.com>
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [RFC PATCH v2] compat: poll() in 32-bit applications does not handle negative timeout values properly on 64-bit kernels
2012-02-11 15:47 ` Eric Dumazet
@ 2012-02-16 16:22 ` Josh Hunt
0 siblings, 0 replies; 4+ messages in thread
From: Josh Hunt @ 2012-02-16 16:22 UTC (permalink / raw)
To: Eric Dumazet
Cc: Al Viro, linux-fsdevel@vger.kernel.org, tglx@linutronix.de,
mingo@redhat.com, hpa@zytor.com, x86@kernel.org, arnd@arndb.de,
linux-arch@vger.kernel.org, linux-kernel@vger.kernel.org
On 02/11/2012 09:47 AM, Eric Dumazet wrote:
> Le vendredi 10 février 2012 à 23:54 -0600, Josh Hunt a écrit :
>> We have hit an issue where our 32-bit applications using poll() and
>> passing in a value of -1 for the timeout value return after ~49 days
>> (2^32 msec), instead of waiting indefinitely. I've instrumented the
>> kernel and found we are hitting the case where poll() believes we've
>> passed in a positive number and thus creates a timespec, etc. I've
>> implemented compat_sys_poll() to sign-extend the timeout value and
>> resolve the issue.
>>
>> There was an almost identical patch submitted last year, but for
>> whatever reason did not make it in:
>> https://lkml.org/lkml/2011/9/18/19
>
> Probably because Thomas Meyer didnt answer to patch reviewers, and not
> enough people cared.
>
> By the way, an inline patch is better, as stated in
> Documentation/SubmittingPatches
>
> Anyway, its time to fix this bug...
>
> Acked-by: Eric Dumazet <eric.dumazet@gmail.com>
>
I can resubmit the patch inline if you feel that will get more attention
by whoever needs to do the final approval on this.
Josh
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2012-02-16 16:22 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2012-02-11 5:54 [RFC PATCH v2] compat: poll() in 32-bit applications does not handle negative timeout values properly on 64-bit kernels Josh Hunt
2012-02-11 5:54 ` Josh Hunt
2012-02-11 15:47 ` Eric Dumazet
2012-02-16 16:22 ` Josh Hunt
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).