summaryrefslogtreecommitdiffstats
path: root/kernel/compat.c
diff options
context:
space:
mode:
authorOleg Nesterov <oleg@tv-sign.ru>2008-02-01 17:29:05 +0300
committerThomas Gleixner <tglx@linutronix.de>2008-02-10 10:48:03 +0100
commit080344b98805553f9b01de0f59a41b1533036d8d (patch)
treedf56b37cca4b0ce233967682526158b58fa151b9 /kernel/compat.c
parente13a2e61dd5152f5499d2003470acf9c838eab84 (diff)
downloadop-kernel-dev-080344b98805553f9b01de0f59a41b1533036d8d.zip
op-kernel-dev-080344b98805553f9b01de0f59a41b1533036d8d.tar.gz
hrtimer: fix *rmtp handling in hrtimer_nanosleep()
Spotted by Pavel Emelyanov and Alexey Dobriyan. hrtimer_nanosleep() sets restart_block->arg1 = rmtp, but this rmtp points to the local variable which lives in the caller's stack frame. This means that if sys_restart_syscall() actually happens and it is interrupted as well, we don't update the user-space variable, but write into the already dead stack frame. Introduced by commit 04c227140fed77587432667a574b14736a06dd7f hrtimer: Rework hrtimer_nanosleep to make sys_compat_nanosleep easier Change the callers to pass "__user *rmtp" to hrtimer_nanosleep(), and change hrtimer_nanosleep() to use copy_to_user() to actually update *rmtp. Small problem remains. man 2 nanosleep states that *rtmp should be written if nanosleep() was interrupted (it says nothing whether it is OK to update *rmtp if nanosleep returns 0), but (with or without this patch) we can dirty *rem even if nanosleep() returns 0. NOTE: this patch doesn't change compat_sys_nanosleep(), because it has other bugs. Fixed by the next patch. Signed-off-by: Oleg Nesterov <oleg@tv-sign.ru> Cc: Alexey Dobriyan <adobriyan@sw.ru> Cc: Michael Kerrisk <mtk.manpages@googlemail.com> Cc: Pavel Emelyanov <xemul@sw.ru> Cc: Peter Zijlstra <a.p.zijlstra@chello.nl> Cc: Toyo Abe <toyoa@mvista.com> Cc: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Thomas Gleixner <tglx@linutronix.de> include/linux/hrtimer.h | 2 - kernel/hrtimer.c | 51 +++++++++++++++++++++++++----------------------- kernel/posix-timers.c | 14 +------------ 3 files changed, 30 insertions(+), 37 deletions(-)
Diffstat (limited to 'kernel/compat.c')
0 files changed, 0 insertions, 0 deletions
OpenPOWER on IntegriCloud