linux-kernel - Re: m68k libc5 regression

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20080601005338.3affe880.akpm@linux-foundation.org>
Date:	Sun, 1 Jun 2008 00:53:38 -0700
From:	Andrew Morton <akpm@...ux-foundation.org>
To:	Jiri Kosina <jkosina@...e.cz>
Cc:	Geert Uytterhoeven <geert@...ux-m68k.org>,
	Ingo Molnar <mingo@...e.hu>,
	Linux/m68k <linux-m68k@...r.kernel.org>,
	Linux Kernel Development <linux-kernel@...r.kernel.org>
Subject: Re: m68k libc5 regression

On Tue, 27 May 2008 00:19:32 +0200 (CEST) Jiri Kosina <jkosina@...e.cz> wrote:

> On Mon, 26 May 2008, Geert Uytterhoeven wrote:
> 
> > Recently I noticed a regression when running an old libc5 binary
> > (amiga-lilo) on m68k. It fails with the error message:
> 
> Hmm, libc5 is known to make broken assumptions about brk location, that's 
> why we introduced CONFIG_COMPAT_BRK, do you have that option turned on?
> 
> > So I bisected it to:
> > commit 4cc6028d4040f95cdb590a87db478b42b8be0508
> > Author: Jiri Kosina <jkosina@...e.cz>
> > Date:   Wed Feb 6 22:39:44 2008 +0100
> >     brk: check the lower bound properly
> 
> Indeed, this should take CONFIG_COMPAT_BRK into account. Does the patch 
> below fix it? (assuming that you have CONFIG_COMPAT_BRK=y):
> 
> 
> 
> From: Jiri Kosina <jkosina@...e.cz>
> 
> brk: check lower bound properly
> 
> The check in sys_brk() on minimum value the brk might have must take 
> CONFIG_COMPAT_BRK setting into account. When this option is turned on 
> (i.e. we support ancient legacy binaries, e.g. libc5-linked stuff), the 
> lower bound on brk value is mm->end_code, otherwise the brk start is 
> allowed to be arbitrarily shifted.
> 
> Signed-off-by: Jiri Kosina <jkosina@...e.cz>
> 
> diff --git a/mm/mmap.c b/mm/mmap.c
> index fac6633..834118b 100644
> --- a/mm/mmap.c
> +++ b/mm/mmap.c
> @@ -245,10 +245,16 @@ asmlinkage unsigned long sys_brk(unsigned long brk)
>  	unsigned long rlim, retval;
>  	unsigned long newbrk, oldbrk;
>  	struct mm_struct *mm = current->mm;
> +	unsigned long min_brk;
>  
>  	down_write(&mm->mmap_sem);
>  
> -	if (brk < mm->start_brk)
> +#ifdef CONFIG_COMPAT_BRK
> +	min_brk = mm->end_code;
> +#else
> +	min_brk = mm->start_brk;
> +#endif
> +	if (brk < min_brk)
>  		goto out;
>  

OK, we have a problem here.

Somebody has gone and checked this patch into their tree and it now
appears in linux-next.

I do not know how to work out how this patch got into linux-next.

It's not in any of the trees which I pull so I guess that person has
been shuffling URLs without telling me.

One of the reasons this is bad is that, frankly, I trust almost nobody
to remember to backport fixes into 2.6.25.x.  I'm not even at all
confident that our mystery new part-time memory management maintainer
will remember to merge this into 2.6.26.  The fact that this person
failed to add a Cc:stable@...nel.org to the changelog doesn't inspire
confidence.

I shall merge this fix into my tree (y'know - the one where memory
management patches are hosted) and I'll get it into 2.6.26 and shall
offer it to the -stable team.  This will cause me to get collisions
with the duplicated patch in linux-next but fortunately it is small. 
This time.

And to whoever did this: please don't.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/