linux-um archives
 help / color / mirror / Atom feed
From: BlaisorBlade <blaisorblade_spam@yahoo.it>
To: azu <azu@sysgo.de>, user-mode-linux-devel@lists.sourceforge.net
Subject: Re: [uml-devel] Patch for arch/um/kernel/trap_kern.c to fix bad panic
Date: Tue, 29 Jun 2004 20:34:44 +0200	[thread overview]
Message-ID: <200406291604.51726.blaisorblade_spam@yahoo.it> (raw)
In-Reply-To: <40E0036D.2070108@sysgo.de>

Alle 13:39, lunedì 28 giugno 2004, azu ha scritto:
> Hi,

> I triggered the following panic from userspace in skas mode
> by mapping pages above 0xa0000000 ...

> The check is useless in skas-mode (kernel faults get filtered
> in segv() before handle_page_fault() is called),
> so I added an ifdef for tt mode.

This is a more sensible version of the patch (with runtime checking instead 
that compile time), if I did not overlook anything: it must be an if(mode_tt). 
I always compile in TT mode and normally don't use it (and sometimes UML does 
not compile otherwise), and the patch must still work.


However, I don't think this is the proper fix: please elaborate a bit more. 
Segv() works the same way under TT and SKAS, and I think that more likely 
there were an actual stack overflow (try to increase 
CONFIG_KERNEL_STACK_ORDER and try to re-get the panic).

diff -puN arch/um/kernel/trap_kern.c~silly_panic arch/um/kernel/trap_kern.c
--- uml-linux-2.6.7/arch/um/kernel/trap_kern.c~silly_panic	2004-06-28 
21:42:06.025387464 +0200
+++ uml-linux-2.6.7-paolo/arch/um/kernel/trap_kern.c	2004-06-28 
21:43:47.676934080 +0200
@@ -54,8 +54,10 @@ int handle_page_fault(unsigned long addr
 	if(is_write && !(vma->vm_flags & VM_WRITE)) 
 		goto out;
 	page = address & PAGE_MASK;
-	if(page == (unsigned long) current_thread + PAGE_SIZE)
-		panic("Kernel stack overflow");
+	if (mode_tt) {
+		if(page == (unsigned long) current_thread + PAGE_SIZE)
+			panic("Kernel stack overflow");
+	}
 	pgd = pgd_offset(mm, page);
 	pmd = pmd_offset(pgd, page);
 	do {

-- 
Paolo Giarrusso, aka Blaisorblade
Linux registered user n. 292729



-------------------------------------------------------
This SF.Net email sponsored by Black Hat Briefings & Training.
Attend Black Hat Briefings & Training, Las Vegas July 24-29 - 
digital self defense, top technical experts, no vendor pitches, 
unmatched networking opportunities. Visit www.blackhat.com
_______________________________________________
User-mode-linux-devel mailing list
User-mode-linux-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/user-mode-linux-devel

  reply	other threads:[~2004-06-29 18:22 UTC|newest]

Thread overview: 11+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2004-06-28 11:39 [uml-devel] Patch for arch/um/kernel/trap_kern.c to fix bad panic azu
2004-06-29 18:34 ` BlaisorBlade [this message]
2004-06-30 10:04   ` [uml-devel] bad panic "Kernel stack overflow" - demo exploit azu
2004-07-01 12:01     ` BlaisorBlade
2004-07-01 13:34     ` BlaisorBlade
2004-07-01 17:57       ` Alex Züpke
2004-07-01 19:33         ` BlaisorBlade
2004-07-03 18:25           ` BlaisorBlade
2004-08-17 15:40             ` BlaisorBlade
2004-08-20 15:09               ` Jeff Dike
2004-09-05 16:41                 ` BlaisorBlade

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=200406291604.51726.blaisorblade_spam@yahoo.it \
    --to=blaisorblade_spam@yahoo.it \
    --cc=azu@sysgo.de \
    --cc=user-mode-linux-devel@lists.sourceforge.net \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox