Commit 508a9274 authored by Jeff Dike's avatar Jeff Dike Committed by Linus Torvalds

uml: fix irqstack crash

This patch fixes a crash caused by an interrupt coming in when an IRQ stack
is being torn down.  When this happens, handle_signal will loop, setting up
the IRQ stack again because the tearing down had finished, and handling
whatever signals had come in.

However, to_irq_stack returns a mask of pending signals to be handled, plus
bit zero is set if the IRQ stack was already active, and thus shouldn't be
torn down.  This causes a problem because when handle_signal goes around
the loop, sig will be zero, and to_irq_stack will duly set bit zero in the
returned mask, faking handle_signal into believing that it shouldn't tear
down the IRQ stack and return thread_info pointers back to their original
values.

This will eventually cause a crash, as the IRQ stack thread_info will
continue pointing to the original task_struct and an interrupt will look
into it after it has been freed.

The fix is to stop passing a signal number into to_irq_stack.  Rather, the
pending signals mask is initialized beforehand with the bit for sig already
set.  References to sig in to_irq_stack can be replaced with references to
the mask.

[akpm@linux-foundation.org: use UL]
Signed-off-by: default avatarJeff Dike <jdike@linux.intel.com>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent 480eccf9
...@@ -117,7 +117,7 @@ extern void sigio_handler(int sig, union uml_pt_regs *regs); ...@@ -117,7 +117,7 @@ extern void sigio_handler(int sig, union uml_pt_regs *regs);
extern void copy_sc(union uml_pt_regs *regs, void *from); extern void copy_sc(union uml_pt_regs *regs, void *from);
unsigned long to_irq_stack(int sig, unsigned long *mask_out); extern unsigned long to_irq_stack(unsigned long *mask_out);
unsigned long from_irq_stack(int nested); unsigned long from_irq_stack(int nested);
#endif #endif
...@@ -518,13 +518,13 @@ int init_aio_irq(int irq, char *name, irq_handler_t handler) ...@@ -518,13 +518,13 @@ int init_aio_irq(int irq, char *name, irq_handler_t handler)
static unsigned long pending_mask; static unsigned long pending_mask;
unsigned long to_irq_stack(int sig, unsigned long *mask_out) unsigned long to_irq_stack(unsigned long *mask_out)
{ {
struct thread_info *ti; struct thread_info *ti;
unsigned long mask, old; unsigned long mask, old;
int nested; int nested;
mask = xchg(&pending_mask, 1 << sig); mask = xchg(&pending_mask, *mask_out);
if(mask != 0){ if(mask != 0){
/* If any interrupts come in at this point, we want to /* If any interrupts come in at this point, we want to
* make sure that their bits aren't lost by our * make sure that their bits aren't lost by our
...@@ -534,7 +534,7 @@ unsigned long to_irq_stack(int sig, unsigned long *mask_out) ...@@ -534,7 +534,7 @@ unsigned long to_irq_stack(int sig, unsigned long *mask_out)
* and pending_mask contains a bit for each interrupt * and pending_mask contains a bit for each interrupt
* that came in. * that came in.
*/ */
old = 1 << sig; old = *mask_out;
do { do {
old |= mask; old |= mask;
mask = xchg(&pending_mask, old); mask = xchg(&pending_mask, old);
...@@ -550,6 +550,7 @@ unsigned long to_irq_stack(int sig, unsigned long *mask_out) ...@@ -550,6 +550,7 @@ unsigned long to_irq_stack(int sig, unsigned long *mask_out)
task = cpu_tasks[ti->cpu].task; task = cpu_tasks[ti->cpu].task;
tti = task_thread_info(task); tti = task_thread_info(task);
*ti = *tti; *ti = *tti;
ti->real_thread = tti; ti->real_thread = tti;
task->stack = ti; task->stack = ti;
......
...@@ -119,7 +119,7 @@ void (*handlers[_NSIG])(int sig, struct sigcontext *sc); ...@@ -119,7 +119,7 @@ void (*handlers[_NSIG])(int sig, struct sigcontext *sc);
void handle_signal(int sig, struct sigcontext *sc) void handle_signal(int sig, struct sigcontext *sc)
{ {
unsigned long pending = 0; unsigned long pending = 1UL << sig;
do { do {
int nested, bail; int nested, bail;
...@@ -134,7 +134,7 @@ void handle_signal(int sig, struct sigcontext *sc) ...@@ -134,7 +134,7 @@ void handle_signal(int sig, struct sigcontext *sc)
* have to return, and the upper handler will deal * have to return, and the upper handler will deal
* with this interrupt. * with this interrupt.
*/ */
bail = to_irq_stack(sig, &pending); bail = to_irq_stack(&pending);
if(bail) if(bail)
return; return;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment