Bug in __copy_user

Bug in __copy_user

[Carsten Langgaard]

[-- Attachment #1: Type: text/plain, Size: 1155 bytes --]

I have started to look a little bit at the LTP tests.
And one of the testcases that fails (actually it doesn't fail as it
supposed to do) is the syscall getsockopt.
I think the failure is due to the copy_to_user(0, from, 4) call returns
0, which I wouldn't expect when the destination pointer is NULL.

I think the problem is in the __copy_user function in
arch/mips/lib/memcpy.
It tries to handle the exception, which we get because the destination
pointer is NULL, by returning the number of uncopied bytes in $a2 to the
caller.
But in this case the length is only 4 bytes, and the copying is done by
a single 'sw'. The problem is the length ($a2) is decreased by 4 before
the 'sw' is executed.
The 'sw' fails and __copy_user terminates, but returns with $a2 = 0
(instead 4).

I thing the following patch will solve the problem.

/Carsten



--
_    _ ____  ___   Carsten Langgaard   Mailto:carstenl@mips.com
|\  /|||___)(___   MIPS Denmark        Direct: +45 4486 5527
| \/ |||    ____)  Lautrupvang 4B      Switch: +45 4486 5555
  TECHNOLOGIES     2750 Ballerup       Fax...: +45 4486 5556
                   Denmark             http://www.mips.com



[-- Attachment #2: memcpy.patch --]
[-- Type: text/plain, Size: 538 bytes --]

Index: arch/mips/lib/memcpy.S
===================================================================
RCS file: /home/repository/sw/linux-2.4.18/arch/mips/lib/memcpy.S,v
retrieving revision 1.1.1.1
diff -u -r1.1.1.1 memcpy.S
--- arch/mips/lib/memcpy.S	4 Mar 2002 11:12:21 -0000	1.1.1.1
+++ arch/mips/lib/memcpy.S	24 Jun 2002 13:46:07 -0000
@@ -248,8 +248,8 @@
 1:
 EXC(	LOAD	 t0, 0(src),		l_exc)
 	ADD	src, src, NBYTES
-	SUB	len, len, NBYTES
 EXC(	STORE	t0, 0(dst),		s_exc)
+	SUB	len, len, NBYTES
 	bne	rem, len, 1b
 	 ADD	dst, dst, NBYTES
 

Re: Bug in __copy_user

[Gleb O. Raiko]

Carsten Langgaard wrote:
> 
> I have started to look a little bit at the LTP tests.
> And one of the testcases that fails (actually it doesn't fail as it
> supposed to do) is the syscall getsockopt.
> I think the failure is due to the copy_to_user(0, from, 4) call returns
> 0, which I wouldn't expect when the destination pointer is NULL.
> 
> I think the problem is in the __copy_user function in
> arch/mips/lib/memcpy.
> It tries to handle the exception, which we get because the destination
> pointer is NULL, by returning the number of uncopied bytes in $a2 to the
> caller.
> But in this case the length is only 4 bytes, and the copying is done by
> a single 'sw'. The problem is the length ($a2) is decreased by 4 before
> the 'sw' is executed.
> The 'sw' fails and __copy_user terminates, but returns with $a2 = 0
> (instead 4).
> 
> I thing the following patch will solve the problem.

Been here, done that. In fact, I posted the following patch few days ago
to the list:
less_than_4units:
        /*
         * rem = len % NBYTES
         */
        beq     rem, len, copy_bytes
         nop
1:
EXC(    LOAD     t0, 0(src),            l_exc)
        ADD     src, src, NBYTES
        SUB     len, len, NBYTES
-EXC(    STORE   t0, 0(dst),             s_exc)
+EXC(    STORE   t0, 0(dst),             s_exc_p1u)
        bne     rem, len, 1b
         ADD    dst, dst, NBYTES

This patch also solves the problem for mips in 2.4/2.5 kernel. My
question was about the patch for mips64 and mips in 2.2 kernel.

Shall memcpy.S from 2.4/2.5 be backported to 2.2 and mips64?

Regards,
Gleb.

Re: Bug in __copy_user

[Ralf Baechle]

Gleb,

On Mon, Jun 24, 2002 at 07:14:51PM +0400, Gleb O. Raiko wrote:

> This patch also solves the problem for mips in 2.4/2.5 kernel. My
> question was about the patch for mips64 and mips in 2.2 kernel.
> 
> Shall memcpy.S from 2.4/2.5 be backported to 2.2 and mips64?

I think that would be the prefered solution as it'll be easier to maintain.

I've not received any 2.2 patches in a very long, long time - anybody
actually still using it?

  Ralf

Re: Bug in __copy_user

[Gleb O. Raiko]

Ralf Baechle wrote:
> 
> Gleb,
> 
> On Mon, Jun 24, 2002 at 07:14:51PM +0400, Gleb O. Raiko wrote:
> 
> > This patch also solves the problem for mips in 2.4/2.5 kernel. My
> > question was about the patch for mips64 and mips in 2.2 kernel.
> >
> > Shall memcpy.S from 2.4/2.5 be backported to 2.2 and mips64?
> 
> I think that would be the prefered solution as it'll be easier to maintain.
> 
> I've not received any 2.2 patches in a very long, long time - anybody
> actually still using it?

Yes, I am still using 2.2. Considering pathes, I've got patches for r3k,
which doesn't work with a standard 2.2 kernel. But those patches are
backports from 2.4. So, I don't think they shall be applied. From other
hand, I don't plan develop 'normal' patches for 2.2.

Regards,
Gleb.

Re: Bug in __copy_user

[Kevin D. Kissell]

From: "Ralf Baechle" <ralf@oss.sgi.com> 
> On Mon, Jun 24, 2002 at 07:14:51PM +0400, Gleb O. Raiko wrote:
> 
> > This patch also solves the problem for mips in 2.4/2.5 kernel. My
> > question was about the patch for mips64 and mips in 2.2 kernel.
> > 
> > Shall memcpy.S from 2.4/2.5 be backported to 2.2 and mips64?
> 
> I think that would be the prefered solution as it'll be easier to maintain.
> 
> I've not received any 2.2 patches in a very long, long time - anybody
> actually still using it?

Only a few thousand (or tens of thousands) of Sony Playstation 2
users.  ;-)  Most of them are running the wierd 2.2.1.?? Sony
branch, but there are a few poor deluded souls tryng to update
to 2.2.20...

            Kevin K.

Re: Bug in __copy_user

[Kevin D. Kissell]

From: "Ralf Baechle" <ralf@oss.sgi.com> 
> On Mon, Jun 24, 2002 at 07:14:51PM +0400, Gleb O. Raiko wrote:
> 
> > This patch also solves the problem for mips in 2.4/2.5 kernel. My
> > question was about the patch for mips64 and mips in 2.2 kernel.
> > 
> > Shall memcpy.S from 2.4/2.5 be backported to 2.2 and mips64?
> 
> I think that would be the prefered solution as it'll be easier to maintain.
> 
> I've not received any 2.2 patches in a very long, long time - anybody
> actually still using it?

Only a few thousand (or tens of thousands) of Sony Playstation 2
users.  ;-)  Most of them are running the wierd 2.2.1.?? Sony
branch, but there are a few poor deluded souls tryng to update
to 2.2.20...

            Kevin K.

Re: Bug in __copy_user

[Ralf Baechle]

On Mon, Jun 24, 2002 at 06:07:18PM +0200, Kevin D. Kissell wrote:

> Only a few thousand (or tens of thousands) of Sony Playstation 2
> users.  ;-)  Most of them are running the wierd 2.2.1.?? Sony
> branch, but there are a few poor deluded souls tryng to update
> to 2.2.20...

Just in time when the Linux world has already mostly abandoned 2.2 ...

  Ralf

Re: Bug in __copy_user

[Kevin D. Kissell]

From: "Ralf Baechle" <ralf@oss.sgi.com>
> On Mon, Jun 24, 2002 at 06:07:18PM +0200, Kevin D. Kissell wrote:
> 
> > Only a few thousand (or tens of thousands) of Sony Playstation 2
> > users.  ;-)  Most of them are running the wierd 2.2.1.?? Sony
> > branch, but there are a few poor deluded souls tryng to update
> > to 2.2.20...
> 
> Just in time when the Linux world has already mostly abandoned 2.2 ...

Well, like I said last week, we need to get the PS2 onto 2.4 ASAP,
for a whole bunch of reasons...

            Kevin K.

Re: Bug in __copy_user

[Kevin D. Kissell]

From: "Ralf Baechle" <ralf@oss.sgi.com>
> On Mon, Jun 24, 2002 at 06:07:18PM +0200, Kevin D. Kissell wrote:
> 
> > Only a few thousand (or tens of thousands) of Sony Playstation 2
> > users.  ;-)  Most of them are running the wierd 2.2.1.?? Sony
> > branch, but there are a few poor deluded souls tryng to update
> > to 2.2.20...
> 
> Just in time when the Linux world has already mostly abandoned 2.2 ...

Well, like I said last week, we need to get the PS2 onto 2.4 ASAP,
for a whole bunch of reasons...

            Kevin K.

Re: Bug in __copy_user

[M. R. Brown]

[-- Attachment #1: Type: text/plain, Size: 703 bytes --]

* Kevin D. Kissell <kevink@mips.com> on Mon, Jun 24, 2002:

> From: "Ralf Baechle" <ralf@oss.sgi.com>
> > On Mon, Jun 24, 2002 at 06:07:18PM +0200, Kevin D. Kissell wrote:
> > 
> > > Only a few thousand (or tens of thousands) of Sony Playstation 2
> > > users.  ;-)  Most of them are running the wierd 2.2.1.?? Sony
> > > branch, but there are a few poor deluded souls tryng to update
> > > to 2.2.20...
> > 
> > Just in time when the Linux world has already mostly abandoned 2.2 ...
> 
> Well, like I said last week, we need to get the PS2 onto 2.4 ASAP,
> for a whole bunch of reasons...
> 

ps2hacking.sourceforge.net - broken port of Sony's 2.2.1 kernel to 2.4.8
(or so).

M. R.

[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]