mprotect broken on ppc

mprotect broken on ppc

[Olaf Hering]

Hi,

there seems to be a bug in mprotect which was introduced in
test9->test10.

The result is an invalid pointer from the getpwuid(3) function, this
function is used in rpm to check owner and group permissions.

Just an example:

bad, su(1) is called with "-" to read the profile and make a login
shell:
...
lemon:~/lsof # chroot /abuild/buildsystem.lemon.broken_build/ su -c "rpm
-ba /usr/src/packages/SOURCES/lsof.spec" - < /dev/null
getUname(): pw = 0 , uid = 0
parsePrep
Bad owner/group: /usr/src/packages/SOURCES/lsof_4.52.tar.bz2
...
this works on all other archs.

same as above, rpm is a symlink to rpm.sh which reads the /etc/profile
in the chroot:
....
lemon:~/lsof # chroot /abuild/buildsystem.lemon.broken_build/ su -c
"/bin/rpm.sh -ba /usr/src/packages/SOURCES/lsof.spec" - < /dev/null
getUname(): pw = 0 , uid = 0
parsePrep
Bad owner/group: /usr/src/packages/SOURCES/lsof_4.52.tar.bz2
...


if I call the rpm binary directly it works as expected:
....
lemon:~/lsof # chroot /abuild/buildsystem.lemon.broken_build/ su -c
"/bin/rpm.bin -ba /usr/src/packages/SOURCES/lsof.spec" - < /dev/null
getUname(): pw = 1925cb8 , uid = 0
Executing(%prep): /bin/sh -e /var/tmp/rpm-tmp.83927
+ umask 022
+ cd /usr/src/packages/BUILD
+ cd /usr/src/packages/BUILD
+ rm -rf lsof_4.52
...

pw in rpm/build/names:getUname() returns something.


Here is the strace output from the failed build:
....
3902  open("/etc/ld.so.cache", O_RDONLY) = 5
3902  fstat(5, {st_mode=S_IFREG|0644, st_size=10630, ...}) = 0
3902  mmap(NULL, 10630, PROT_READ, MAP_PRIVATE, 5, 0) = 0x30002000
3902  close(5)                          = 0
3902  open("/lib/libnss_compat.so.2", O_RDONLY) = 5
3902  read(5, "\177ELF\1\2\1\0\0\0\0\0\0\0\0\0\0\3\0\24\0\0\0\1\0\0\034"..., 1024) = 1024
3902  fstat(5, {st_mode=S_IFREG|0755, st_size=57990, ...}) = 0
3902  brk(0x1938370)                    = 0x1938370
3902  mmap(0x6ffd4450, 113580, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE, 5, 0) = 0x6ffd5000
3902  mprotect(0x6ffdffb0, 68604, PROT_NONE) = -1 EINVAL (Invalid argument)
                                           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
3902  mmap(0x6ffe5000, 47264, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED, 5, 0) = 0x6ffe5000
3902  mmap(0x6fff08a0, 780, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = -1 EINVAL (Inval
3902  close(5)                          = 0
3902  munmap(0x30002000, 10630)         = 0
3902  write(2, "Bad owner/group: /usr/src/packag"..., 60) = 60
3902  write(2, "\n", 1)                 = 1
3902  open("/usr/lib/rpm/rpmrc", O_RDONLY) = 5
.....


The same mprotect works with test9.
It doesnt matter what .config I use or if highmem is on. It happens on
all machines with 2.4.0-test10 and newer kernels.

The diff between these two kernels show many changes in the memory
system, so I guess something went wrong for ppc.

The files, strace output and such can be found at
http://penguinppc.org/~olaf/broken_build/


Any ideas how to fix that? Or what might be wrong here?



Gruss Olaf

--
 $ man clone

BUGS
       Main feature not yet implemented...

** Sent via the linuxppc-dev mail list. See http://lists.linuxppc.org/

Re: mprotect broken on ppc

[Olaf Hering]

On Sat, Jan 20, Olaf Hering wrote:

>
> Hi,
>
> there seems to be a bug in mprotect which was introduced in
> test9->test10.
>
> The result is an invalid pointer from the getpwuid(3) function, this
> function is used in rpm to check owner and group permissions.

forgot some facts:

the build host runs always a glibc2.13 system with 2.2 headers. The
build chroot runs a glibc2.2 system with 2.4.0ac2 headers.
And it fails when a kernel 2.4.0-test10 or later is running, every other
kernel works fine.


Gruss Olaf

--
 $ man clone

BUGS
       Main feature not yet implemented...

** Sent via the linuxppc-dev mail list. See http://lists.linuxppc.org/

Re: mprotect broken on ppc

[Olaf Hering]

On Sat, Jan 20, Olaf Hering wrote:

>
> On Sat, Jan 20, Olaf Hering wrote:
>
> >
> > Hi,
> >
> > there seems to be a bug in mprotect which was introduced in
> > test9->test10.
> >
> > The result is an invalid pointer from the getpwuid(3) function, this
> > function is used in rpm to check owner and group permissions.
>
> forgot some facts:
>
> the build host runs always a glibc2.13 system with 2.2 headers. The
> build chroot runs a glibc2.2 system with 2.4.0ac2 headers.
> And it fails when a kernel 2.4.0-test10 or later is running, every other
> kernel works fine.

I put some debug in mm/mprotect.c:
...
asmlinkage long sys_mprotect(unsigned long start, size_t len, unsigned
long prot)
{
        unsigned long nstart, end, tmp;
        struct vm_area_struct * vma, * next;
        int error = -EINVAL;

        if (start & ~PAGE_MASK) {
                printk("sys_mprotect start \n");
                return -EINVAL;
        }
...

it fails here.
Jan 21 18:28:06 mandarine kernel: sys_mprotect start

Gruss Olaf

--
 $ man clone

BUGS
       Main feature not yet implemented...

** Sent via the linuxppc-dev mail list. See http://lists.linuxppc.org/

Re: mprotect broken on ppc

[Olaf Hering]

On Sun, Jan 21, Olaf Hering wrote:

>
> On Sat, Jan 20, Olaf Hering wrote:
>
> >
> > On Sat, Jan 20, Olaf Hering wrote:
> >
> > >
> > > Hi,
> > >
> > > there seems to be a bug in mprotect which was introduced in
> > > test9->test10.
> > >
> > > The result is an invalid pointer from the getpwuid(3) function, this
> > > function is used in rpm to check owner and group permissions.
> >
> > forgot some facts:
> >
> > the build host runs always a glibc2.13 system with 2.2 headers. The
> > build chroot runs a glibc2.2 system with 2.4.0ac2 headers.
> > And it fails when a kernel 2.4.0-test10 or later is running, every other
> > kernel works fine.
>
> I put some debug in mm/mprotect.c:
> ...
> asmlinkage long sys_mprotect(unsigned long start, size_t len, unsigned
> long prot)
> {
>         unsigned long nstart, end, tmp;
>         struct vm_area_struct * vma, * next;
>         int error = -EINVAL;
>
>         if (start & ~PAGE_MASK) {
>                 printk("sys_mprotect start \n");
>                 return -EINVAL;
>         }
> ...
>
> it fails here.
> Jan 21 18:28:06 mandarine kernel: sys_mprotect start

sys_mprotect start= 6ffdffb0,PAGE_MASK= fffff000


It was solved with this patch:
http://penguinppc.org/~olaf/broken_build/elf.diff


Gruss Olaf

--
 $ man clone

BUGS
       Main feature not yet implemented...

** Sent via the linuxppc-dev mail list. See http://lists.linuxppc.org/