linux-kernel - [PATCH 2/2] uml: Disable winch irq before freeing handler data.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <AANLkTikT9ch4NfL2MBDL=qUT=Q2ierehFNp1=Ux8tNNC@mail.gmail.com>
Date:	Sat, 13 Nov 2010 17:45:19 +0000
From:	Will Newton <will.newton@...il.com>
To:	Linux Kernel list <linux-kernel@...r.kernel.org>,
	user-mode-linux-devel@...ts.sourceforge.net,
	Jeff Dike <jdike@...toit.com>
Subject: [PATCH 2/2] uml: Disable winch irq before freeing handler data.

Disable the winch irq early to make sure we don't
take an interrupt part way through the freeing of
the handler data, resulting in a crash on shutdown:

winch_interrupt : read failed, errno = 9
fd 13 is losing SIGWINCH support
------------[ cut here ]------------
WARNING: at lib/list_debug.c:48 list_del+0xc6/0x100()
list_del corruption, next is LIST_POISON1 (00100100)
082578c8:  [<081fd77f>] dump_stack+0x22/0x24
082578e0:  [<0807a18a>] warn_slowpath_common+0x5a/0x80
08257908:  [<0807a23e>] warn_slowpath_fmt+0x2e/0x30
08257920:  [<08172196>] list_del+0xc6/0x100
08257940:  [<08060244>] free_winch+0x14/0x80
08257958:  [<080606fb>] winch_interrupt+0xdb/0xe0
08257978:  [<080a65b5>] handle_IRQ_event+0x35/0xe0
08257998:  [<080a8717>] handle_edge_irq+0xb7/0x170
082579bc:  [<08059bc4>] do_IRQ+0x34/0x50
082579d4:  [<08059e1b>] sigio_handler+0x5b/0x80
082579ec:  [<0806a374>] sig_handler_common+0x44/0xb0
08257a68:  [<0806a538>] sig_handler+0x38/0x50
08257a78:  [<0806a77c>] handle_signal+0x5c/0xa0
08257a9c:  [<0806be28>] hard_handler+0x18/0x20
08257aac:  [<00c14400>] 0xc14400

Signed-off-by: Will Newton <will.newton@...il.com>
---
 arch/um/drivers/line.c |    5 +++--
 1 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/arch/um/drivers/line.c b/arch/um/drivers/line.c
index 5f12fef..050e4dd 100644
--- a/arch/um/drivers/line.c
+++ b/arch/um/drivers/line.c
@@ -727,6 +727,9 @@ struct winch {

 static void free_winch(struct winch *winch, int free_irq_ok)
 {
+	if (free_irq_ok)
+		free_irq(WINCH_IRQ, winch);
+
 	list_del(&winch->list);

 	if (winch->pid != -1)
@@ -735,8 +738,6 @@ static void free_winch(struct winch *winch, int free_irq_ok)
 		os_close_file(winch->fd);
 	if (winch->stack != 0)
 		free_stack(winch->stack, 0);
-	if (free_irq_ok)
-		free_irq(WINCH_IRQ, winch);
 	kfree(winch);
 }

-- 
1.7.0.4

View attachment "0002-uml-Disable-winch-irq-before-freeing-handler-data.patch" of type "text/x-patch" (2055 bytes)