linux-kernel - [PATCH] 2.6.22.6 user-mode linux: use address instead of value as argument in os_free_irq_by

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Sat, 22 Sep 2007 12:39:55 +0800
From:	lepton <ytht.net@...il.com>
To:	jdike@...aya.com
Cc:	lkm <linux-kernel@...r.kernel.org>
Subject: [PATCH] 2.6.22.6 user-mode linux: use address instead of value as argument in os_free_irq_by_cb

Hi,
  There is a bug in os_free_irq_by_cb, when the first element
  of active_fds list  is free, the value of active_fds is not
  updated, just value in stack is updated.

  The intresting thing is that without this patch, a poweroff
  in user mode linux guest will halt the host linux system.It
  seems that after the tracing thread is dead, the syscall to
  sys_reboot of the traced thread is executed by host. I don't
  know if it is another bug.

Signed-off-by: Lepton Wu <ytht.net@...il.com>

diff -X linux-2.6.22.6/Documentation/dontdiff -pru linux-2.6.22.6/arch/um/include/os.h linux-2.6.22.6-lepton/arch/um/include/os.h
--- linux-2.6.22.6/arch/um/include/os.h	2007-09-14 17:41:10.000000000 +0800
+++ linux-2.6.22.6-lepton/arch/um/include/os.h	2007-09-22 12:15:28.000000000 +0800
@@ -325,7 +325,7 @@ extern void reboot_skas(void);
 extern int os_waiting_for_events(struct irq_fd *active_fds);
 extern int os_create_pollfd(int fd, int events, void *tmp_pfd, int size_tmpfds);
 extern void os_free_irq_by_cb(int (*test)(struct irq_fd *, void *), void *arg,
-		struct irq_fd *active_fds, struct irq_fd ***last_irq_ptr2);
+		struct irq_fd **active_fds_ptr, struct irq_fd ***last_irq_ptr2);
 extern void os_free_irq_later(struct irq_fd *active_fds,
 		int irq, void *dev_id);
 extern int os_get_pollfd(int i);
diff -X linux-2.6.22.6/Documentation/dontdiff -pru linux-2.6.22.6/arch/um/kernel/irq.c linux-2.6.22.6-lepton/arch/um/kernel/irq.c
--- linux-2.6.22.6/arch/um/kernel/irq.c	2007-09-14 17:41:10.000000000 +0800
+++ linux-2.6.22.6-lepton/arch/um/kernel/irq.c	2007-09-22 12:15:05.000000000 +0800
@@ -218,7 +218,7 @@ static void free_irq_by_cb(int (*test)(s
 	unsigned long flags;
 
 	spin_lock_irqsave(&irq_lock, flags);
-	os_free_irq_by_cb(test, arg, active_fds, &last_irq_ptr);
+	os_free_irq_by_cb(test, arg, &active_fds, &last_irq_ptr);
 	spin_unlock_irqrestore(&irq_lock, flags);
 }
 
diff -X linux-2.6.22.6/Documentation/dontdiff -pru linux-2.6.22.6/arch/um/os-Linux/irq.c linux-2.6.22.6-lepton/arch/um/os-Linux/irq.c
--- linux-2.6.22.6/arch/um/os-Linux/irq.c	2007-09-14 17:41:10.000000000 +0800
+++ linux-2.6.22.6-lepton/arch/um/os-Linux/irq.c	2007-09-22 12:15:42.000000000 +0800
@@ -84,12 +84,12 @@ int os_create_pollfd(int fd, int events,
 }
 
 void os_free_irq_by_cb(int (*test)(struct irq_fd *, void *), void *arg,
-		struct irq_fd *active_fds, struct irq_fd ***last_irq_ptr2)
+		struct irq_fd **active_fds_ptr, struct irq_fd ***last_irq_ptr2)
 {
 	struct irq_fd **prev;
 	int i = 0;
 
-	prev = &active_fds;
+	prev = active_fds_ptr;
 	while (*prev != NULL) {
 		if ((*test)(*prev, arg)) {
 			struct irq_fd *old_fd = *prev;
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/