[parisc-linux] bug in arg checking in clone.S ?

[parisc-linux] bug in arg checking in clone.S ?

[Mike Frysinger]

[-- Attachment #1: Type: text/plain, Size: 669 bytes --]

for some reason the attached test case (originally from LTP) segfaults on 
glibc/hppa systems ... every other arch ive tested on works fine ...

for example, a good run would be:
$ gcc errno.c -o errno ; ./errno ; echo $?
0

on hppa, i get:
$ gcc errno.c -o errno ; ./errno ; echo $?
Segmentation fault

tested on Debian (glibc 2.3.5-11) and Gentoo (glibc 2.3.4.20040808-r1), both 
fail in the same way:
Program received signal SIGSEGV, Segmentation fault.
0x40538990 in __errno_location () from /lib/libc.so.6
(gdb) bt
#0  0x40538990 in __errno_location () from /lib/libc.so.6
#1  0x40538748 in __libc_start_main () from /lib/libc.so.6
#2  0x00010644 in main ()
-mike

[-- Attachment #2: errno.c --]
[-- Type: text/x-csrc, Size: 497 bytes --]

/* based originally on one the clone tests in the LTP */

#include <stdio.h>
#include <stdlib.h>
#include <errno.h>
#include <sched.h>

int child_fn(void *arg)
{
	fprintf(stderr, "in child_fn\n");
	exit(1);
}

int main(void)
{
	int r_clone, ret_errno;

	r_clone = clone(child_fn, NULL, (int) NULL, NULL);
	ret_errno = errno;
	if (ret_errno != EINVAL || r_clone != -1) {
		fprintf(stderr, "clone: res=%d (wanted -1) errno=%d (wanted %d)\n",
			r_clone, errno, EINVAL);
		return 1;
	}

	return 0;
}

[-- Attachment #3: Type: text/plain, Size: 169 bytes --]

_______________________________________________
parisc-linux mailing list
parisc-linux@lists.parisc-linux.org
http://lists.parisc-linux.org/mailman/listinfo/parisc-linux

Re: [parisc-linux] confirme: bug in arg checking in clone.S

[Joel Soete]

Hello Mike and list,

Mike Frysinger wrote:
> for some reason the attached test case (originally from LTP) segfaults on 
> glibc/hppa systems ... every other arch ive tested on works fine ...
> 
Ok I find this LTP Stuff.
# ./clone04
clone04     1  BROK  :  Unexpected signal 11 received.


Effectively, as the comment said:
  * DESCRIPTION
  *      Verify that,
  *      clone(2) returns -1 and sets errno to EINVAL if
  *      child stack is set to a zero value(NULL)

Also as your subject better explain, the hppa implementation didn't do a "Sanity check arguments" (as other arch does).

Can somebody could check this patch proposal:
--- ./sysdeps/unix/sysv/linux/hppa/clone.S.Orig 2006-01-14 17:48:33.000000000 +0000
+++ ./sysdeps/unix/sysv/linux/hppa/clone.S      2006-03-04 19:46:03.000000000 +0000
@@ -46,6 +46,11 @@
          .text
  ENTRY(__clone)

+       /* Sanity check arguments.  */
+       ldi     -EINVAL, %ret0
+       comib,=,n       0,%r26,.Lerror  /* no NULL function pointers */
+       comib,=,n       0,%r25,.Lerror  /* no NULL stack pointers */
+
         /* Save the fn ptr and arg on the new stack.  */
         stwm    %r26,64(%r25)
         stw     %r23,-60(%r25)
====<>====

(Not sure I didn't miss some nop in delay slot on comib?)

Thanks in advance,
	Joel
_______________________________________________
parisc-linux mailing list
parisc-linux@lists.parisc-linux.org
http://lists.parisc-linux.org/mailman/listinfo/parisc-linux