linuxppc-dev.lists.ozlabs.org archive mirror
 help / color / mirror / Atom feed
* NULL-pointer dereference in ELF core dump, and proposed fix
@ 2003-12-23 14:46 John Whitney
  2003-12-24  3:51 ` Benjamin Herrenschmidt
  0 siblings, 1 reply; 11+ messages in thread
From: John Whitney @ 2003-12-23 14:46 UTC (permalink / raw)
  To: Mailing List: linuxppc-dev


Hello,

As stated in the subject, I've found a NULL-pointer dereference in the ELF
core dump code path, and wanted comments on my proposed solution.

In fs/binfmt_elf.c, elf_core_dump() calls elf_dump_thread_status().
elf_dump_thread_status calls elf_core_copy_task_fpregs() (elfcore.h), with a
second parameter (struct pt_regs *regs) of NULL.

This inlined routine in turn calls dump_fpu() (arch/ppc/kernel/process.c),
again with a NULL "regs" parameter.

dump_fpu immediately dereferences the regs parameter with the line:

if (regs->msr & MSR_FP)
    giveup_fpu (current);

This, obviously, causes a kernel oops.  My proposed solution to this problem
is to change the above line of code to

if (last_task_used_math == current)
    giveup_fpu (current);

Anyone see any problems with this change?

Thanks,
John Whitney


** Sent via the linuxppc-dev mail list. See http://lists.linuxppc.org/

^ permalink raw reply	[flat|nested] 11+ messages in thread

end of thread, other threads:[~2003-12-31  4:15 UTC | newest]

Thread overview: 11+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2003-12-23 14:46 NULL-pointer dereference in ELF core dump, and proposed fix John Whitney
2003-12-24  3:51 ` Benjamin Herrenschmidt
2003-12-30  6:34   ` A question on kernel clock: John Zhou
2003-12-30 10:22     ` Wolfgang Denk
2003-12-30 10:45       ` John Zhou
2003-12-30 18:49         ` Wolfgang Denk
2003-12-30 21:07           ` Dale Harris
2003-12-30 21:40             ` Wolfgang Denk
2003-12-31  4:15               ` John Zhou
2003-12-31  2:44           ` John Zhou
2003-12-31  2:44           ` about small dhcp client/server and http client/server John Zhou

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).